A six-view perspective framework for system security: Issues, risks, and requirements

To secure information systems, the security risks and requirements must be clearly understood before the proper security mechanisms can be identified and designed. Today's security requirement specifications are generally incomplete and narrowly focused, which leads to ineffective security designs of information systems. The author asserts that multiple views-management, threat, resource, process, assessment, and legal-of information systems provides an opportunity for a better understanding of security risks and requirements. In this paper, the author proposes a six-view perspective of a system security framework to identify a more complete set of security risks and requirements. The proposed framework presents a synergistic view of the system security in which the author presents an extensive list of heuristics/guidelines under each view, discussing security issues, risks, and requirements. Through a case study, the authors shows that a multiple view perspective of system security is effective in determining a more complete set of security requirements than the traditional approach of focusing on threats alone.