Security Quality Requirements Engineering (SQUARE) Methodology

Parent SEI Program

CERT

Related SEI Project

Requirements Engineering for Improved System Security

Related Publications

How To Compare the Security Quality Requirements Engineering (SQUARE) Method with Other Methods

Security Quality Requirements Engineering (SQUARE): Case Study Phase III

System Quality Requirements Engineering (SQUARE): Case Study on Asset Management System, Phase II

System Quality Requirements Engineering (SQUARE) Methodology: Case Study on Asset Management System

SQUARE Project: Cost/Benefit Analysis Framework for Information Security Improvement Projects in Small Companies

Nancy R. Mead
Eric D. Hough
Theodore R. Stehney II

Technical Report
CMU/SEI-2005-TR-009

HTML File
PDF File

Requirements engineering, a vital component in successful project development, often does not include sufficient attention to security concerns. Studies show that up-front attention to security can save the economy billions of dollars, yet security concerns are often treated as an afterthought to functional requirements. Industry can thus benefit from a model to examine security requirements in the development stages of the production life cycle.

This report presents the Security Quality Requirements Engineering (SQUARE) Methodology for eliciting and prioritizing security requirements in software development projects, which was developed by the Software Engineering Institute's Networked Systems Survivability (NSS) Program. The methodology's steps are explained, and results from its application in recent case studies are examined. The NSS Program continues to develop SQUARE, which has proven effective in helping organizations understand their security posture and produce products with verifiable security requirements.