5

How I should represent Security Requirements if I use User Stories?

or

  • Should they be just "invisible" parts of user stories? I.e. if developer implements some User Story, he should already implement it with good security quality.
Improve this question

3 Answers 3

Reset to default
7

In Scrum (where User Stories also exist as part of Product Backlog), it is common to see Security, Availability, Speed of response and other non-functional requirements as part of definition of "Done". This kind of coincides with your notion:

I.e. if developer implements some User Story, he should already implement it with good security quality.

This is what Definition of "Done" means- all requirements from the list should be fulfilled in order for the User Story to be considered complete or done.

More on Definition of "Done"

More on handling non-functional requirements aka NFRs

Improve this answer
2
  • When I wrote my second opinion, I thought exactly about Definition of Done. But I decided to make question more common, that why I don't said about Scrum. Currently we handle security requirements exactly in this way. But I read about "evil stories" and thought, that maybe this approach is more correct.
    – Sergey Kudryavtsev
    Commented Jun 25, 2015 at 15:06
  • 2
    "Evil stories" seem to be a good way if you have a particular security requirement that applies at the present moment only. If after 1 year you have new "User stories" to which the security issue should apply- that would be difficult to handle IMHO (e.g. somebody forgets to apply the "evil story")
    – Maksim Afanasjev
    Commented Jun 26, 2015 at 7:21
2

You can have a look at how Microsoft approaches this topic. They introduced an idea of Security Development Lifecycle (SDL) which is a software development process that can be used to build more secure software.

One part of this process is activity called Threat Modelling; it's goal is to create a diagram that encapsulates your application interactions and includes both internal and external factors. It helps to identify spots in your application when security threats may occur.

On how to apply SDL and Threat Modelling you can read: https://technet.microsoft.com/en-us/security/hh855044.aspx

Hope it answers your questions and will give you at least some overview how to tackle issues like this.

Improve this answer
1
  • Interesting approach. Thank you for information.
    – Sergey Kudryavtsev
    Commented Jun 25, 2015 at 15:07
0

It's very good question, from my past experience we used to add this as a use cases for story or acceptance criteria of that particular story.

This way you can ask developer, to unit test your functionality on the basis of usecases/acceptance criteria.

I think this will help you

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.