{'fraction_non_alphanumeric': 0.017928286852589643, 'fraction_numerical': 0.0, 'mean_word_length': 5.523809523809524, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Persona Security: A Technique for Supporting the Elicitation of Security Requirements

Safety-critical embedded systems have assisted people in the execution of daily tasks, causing a search for security approaches in the initial phases of the development. The elicitation of security requirements in such systems is a key element for the definition of secure software. Nonetheless, security requirements are mostly ambiguous, incomplete or even not considered, which may be the reason of accidents. In this sense, it is essential to provide a good comprehension of peoples’ roles within the development process, and the interactions with the safety-critical embedded systems. This paper presents the Persona Security technique which aims at aiding software engineers in the elicitation of security requirements. We have performed a pilot study to verify the perception and relationship between the easiness of eliciting security requirements, and find out improvement points. The initial results indicate that dividing the requirements into both system and users allows the software engineer to have a clearer and more general view of the system. However, we also identified improvement opportunities such as: (a) the need for identifying requirements related to users and generating their traceability with the software requirements; and (b) the need for the identification of the security requirements that are most relevant for the problem domain, showing their dependencies and their selection impact.