Modelling Security Requirements Through Extending Scrum Agile Development Framework

277 Pages·2016·4.21 MB·English

by  Minahi Alotaibi

Modelling Security Requirements Through Extending Scrum Agile Development Framework

Modelling Security Requirements
Through Extending Scrum Agile
Development Framework
PhD Thesis
Minahi Hamed Alotaibi

Software Technology Research Laboratory
Faculty of Technology
De Montfort University

This thesis is submitted in partial fulfilment of the requirements for the
Doctor of Philosophy

February 2016
1
Modelling Security Requirements Through Extending Scrum Agile Development Framework

To the spirit of my father and my brother

2
Modelling Security Requirements Through Extending Scrum Agile Development Framework

3
Modelling Security Requirements Through Extending Scrum Agile Development Framework

ABSTRACT
Security is today considered as a basic foundation in software development and therefore, the
modelling and implementation of security requirements is an essential part of the production of
secure software systems. Information technology organisations are moving towards agile
development methods in order to satisfy customers' changing requirements in light of accelerated
evolution and time restrictions with their competitors in software production. Security engineering
is considered difficult in these incremental and iterative methods due to the frequency of change,
integration and refactoring. The objective of this work is to identify and implement practices to
extend and improve agile methods to better address challenges presented by security requirements
consideration and management.
A major practices is security requirements capture mechanisms such as UMLsec for agile
development processes. This thesis proposes an extension to the popular Scrum framework by
adopting UMLsec security requirements modelling techniques with the introduction of a Security
Owner role in the Scrum framework to facilitate such modelling and security requirements
considerations generally. The methodology involved experimentation of the inclusion of UMLsec
and the Security Owner role to determine their impact on security considerations in the software
development process. The results showed that overall security requirements consideration
improved and that there was a need for an additional role that has the skills and knowledge to
facilitate and realise the benefits of the addition of UMLsec.
KEYWORDS
Security requirements, UML, UMLsec, agile, Scrum, security requirements, Security Owner.
4
Modelling Security Requirements Through Extending Scrum Agile Development Framework

DEDICATION
The work of this thesis dedicated to:
My mother
A strong and gentle who taught me to trust in Allah, to believe in hard work and that so much
could be done with less
My father
For being my first teacher, earning an honest living for us and for supporting and encouraging
me to believe in myself
My wife
For giving me her love, supporting me in all critical and difficult times
My children
For adding a sweet with love in most of my studies and research days
My brothers and sisters
For supporting me during my educational career

5
Modelling Security Requirements Through Extending Scrum Agile Development Framework

DECLARATION
I declare that the work of this thesis was submitted to De Montfort University for the degree of
Doctor of Philosophy in computer security and software engineering in the Software Technology
Research Laboratory (STRL), Faculty of Technology, De Montfort University, Leicester, United
Kingdom. The work contained herein is my original work with an exemption to the citations and
that this work has not been submitted at any other university, either in part or its entirety, for the
award of any degree.

6
Modelling Security Requirements Through Extending Scrum Agile Development Framework

ACKNOWLEDGEMENTS
Initially and foremost, praise be to Allah, who blessed me completing this thesis. Thanks to him
that honoured me with faith, patience and confidence in order to accomplish this research.
Without him I could not complete the work or part of it.
I am grateful with special thanks to the main supervisor Dr. Helge Janicke who was the leader at
all stages of my research, who guided me and helped to get me started on my PhD degree, his
encouragement and belief in me throughout have been extremely helpful. He was all the time
available for any questions, open mind and listen to my queries. He gave generously from his
time, even was busy, and vast knowledge. He always knew the answers to problems facing me
while leading me to the correct source. Thanks go to the second supervisor Dr. Martin Ward for
following me through my research.
I also like to extend my sincere thanks to Professor Hussein Zedan, Professor Hongji, Dr. Platt
and Dr. Cau, the previous Software Technology Research Laboratory staff, at De Montfort
University, for their guidance, persistent support, and encouragement throughout this research.
Moreover, they gave me motivation for starting my new topic and freedom in my research
interests. Welcome and good impression when meet me as a new researcher.
Thanks continue to all of the current staff members in the department, Dr. Siewe, Dr. AlBayatti,
Dr. Chen, and all others, for their support in helping me and all the researchers.
I would like to thank all researchers and my colleagues of the STRL, for their valuable comments
and knowledge sharing especially in my research area. Last but not least, my thanks and
appreciation to my family, who are always partners in the achievement and my successes.

7
Modelling Security Requirements Through Extending Scrum Agile Development Framework

PUBLICATIONS
Alotaibi, M. (2014), 'Security Requirements Modelling in Agile Development Methods', paper
presented in 7th Scientific Saudi Conference SSC 14 in Edinburgh, UK, 1st-2nd Feb. 2014.

Alotaibi, M. (2014), 'UMLsec in Agile', poster presented in 7th Scientific Saudi Conference SSC
14 in Edinburgh, UK, 1st-2nd Feb. 2014.

Alotaibi, M. and Janicke, H. (2015), ' Extending Scrum Framework to Emphasize Security How a
“Security Owner” is integrated in the Scrum Team.', paper presented in 8th Scientific Saudi
Conference SSC 15 in London, UK, 31st Jan -1st Feb. 2015.

Alotaibi, M. and Janicke, H. (2015), ‘Integrating Security Owner within the Agile Teams’,
poster presented in 6th PhD Experience Conference (PhDEC) in the University of Hull, UK, 7th -
8th April. 2015.

8
Modelling Security Requirements Through Extending Scrum Agile Development Framework

CONTENTS
ABSTRACT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
DEDICATION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
DECLARATION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
ACKNOWLEDGEMENTS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
PUBLICATIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
LIST OF APPREVIATIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
LIST OF FIGURES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
LIST OF TABLES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

CHAPTER ONE: INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
1.2 Research Motivation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.3 Research Aims, Objectives and Hypotheses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4 Research Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
1.5 Research Contribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
1.6 Research Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.7 Thesis Outline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

CHAPTER TWO: LITERATURE REVIEW. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
2.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2.2 Literature Review Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
9
Modelling Security Requirements Through Extending Scrum Agile Development Framework

2.3 Requirements Gathering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
2.4 UML Modelling Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
2.4.1 Use Cases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
2.5 UMLsec. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
2.5.1 Misuse Cases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
2.6 Agile Software Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2.6.1 Success Factors in Agile Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
2.6.2 Teamwork in Agile. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
2.7 Security in Agile Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
2.7.1 Contemporary Efforts to Integrate Security. . . . . . . . . . . . . . . . . . . . . . . . . . 62
2.8 Scrum Development Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
2.8.1 Functions (Roles) of Scrum. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
2.8.2 Product Backlog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
2.8.3 Definition of Done. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
2.8.4 Sprint Planning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
2.8.5 Daily Scrum. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
2.8.6 Sprint Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
2.8.7 Sprint Retrospective. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
2.8.8 Scrum Releases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
2.8.9 Scrum Challenges. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
2.9 Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

CHAPTER THREE: RESEARCH METHODOLOGY. . . . . . . . . . . . . . . . . . . . . . . . . 79
10