Long-lived software systems often undergo evolution over an extended period. Evolution of these systems is inevitable as they need to continue to satisfy changing business needs, new regulations and standards, and introduction of novel technologies. Such evolution may involve changes that add, remove, or modify features; or that migrate the system from one operating platform to another. These changes may result in requirements that were satisfied in a previous release of a system not being satisfied in subsequent versions. When evolutionary changes violate security requirements, a system may be left vulnerable to attacks. In this article we review current approaches to security requirements engineering and conclude that they lack explicit support for managing the effects of software evolution. We then suggest that a cross fertilization of the areas of software evolution and security engineering would address the problem of maintaining compliance to security requirements of software systems as they evolve.

Context is a significant factor in deciding the set of requirements relevant to a system (i.e., software product construction), the alternatives the system can adopt to satisfy these requirements, and the quality assessment of each alternative. By context we mean the conditions in the operating environment of an system that influences how the system should behave in different situations. However, the relationship between context and requirements can be challenging to capture and analyze. Presently this area of requirements engineering is largely under-researched. In this position paper, we discuss several ways by which context can be related to requirements and subsequently used for product derivation. We outline an approach that facilitates better understanding and use of contextual information in requirements. Our approach integrates three requirements engineering approaches - goal modeling, feature modeling, and problem frames - and is aimed at facilitating treatment of contextual variability in requirements.

The satisfaction of a software requirement is commonly stated as a Boolean value, that is, a security requirement is either satisfied (true) or not (false). However, a discrete Boolean value to measure the satisfaction level of a security requirement by deployed mechanisms is not very useful. Rather, it would be more effective if we could quantify the level of satisfaction of security requirements on a continuous scale. We propose an approach to achieve this for cloud software systems based on relationships between defense strength, exploitability of vulnerabilities, and attack severity. We extend the concept of entailment relationship from the field of requirements engineering with the satisfiability aspects of security requirements. The proposed approach enables us to systematically structure security concepts into three sets of related descriptions to quantify the satisfaction level of security requirements with the deployed security solutions. To demonstrate the feasibility of the proposed approach, we evaluate the approach in a case study. As a result, security administrators are able to deploy more effective and appropriate security solutions based on their assessment.