Towards a Security Requirements Management Framework for Open-Source Software

Abstract

Security refers to a class of non-functional requirements (NFRs) related to system confidentiality, integrity, and availability. It plays a critical role in many open source software (OSS) projects. Experience indicates that considering security early in the software life cycle can help address security problems, such as reducing information breach and unauthorized data access. However, unlike up-front requirements engineering (RE), requirements are fully discussed and become elaborated in OSS projects only after the implementation begins. Therefore, security management approaches which based on up-front RE shall be modified or improved while applied to OSS projects. To make OSS projects more secure, this research extends existing security requirements management approaches and proposes a new security management framework for OSS projects. I also describe obstacles for building our framework and formulate their conquering as research questions. Analysis and discussion of research questions will enable me to gain valuable insights, which I will use to improve the proposed framework.