Proper testing is an essential and critical part of any development effort. However, software testing is a complex undertaking, especially in the midst of today's security threats. Hackers, social engineering scams, and unaware users, are just a few potential threats that developers must consider not only during development, but more importantly during testing. There are significant reputation and financial losses related to security aspects that could have been addressed during requirements specification. While a variety of approaches to security requirements specification have been proposed, there is a tangible lack in the support that they offer during testing. In this paper we describe the tool support of a new security requirements engineering technique called SURE-Secure and Usable Requirements Engineering. ASSURE - Automated Support for Secure and Usable Requirements Engineering -, is a system developed to aid in the mapping of security requirements into testing artifacts. This support goes beyond mapping and aids also in the management of users and projects.

Software security is an increasingly important aspect of computing; however, it is still addressed as an after thought in too many development efforts. While a variety of approaches have been proposed for security requirements engineering, we find many still lacking with respect to their usability. In this proposal I describe my work in the area of security requirements engineering. SURE, Secure and Usable Requirements Engineering, is a new approach that supports non-security experts in order to specify security requirements from which testing artifacts can be derived. In addition, ASSURE, Automated Support for Secure and Usable Requirements Engineering, a system that implements the SURE technique is presented.

As technology continues to evolve, so do different entities that threaten the security of this technology. We believe that in order to build dependable software security should be treated just as any other important aspect of a system; to do this we must emphasize it at the beginning of our development cycle and be able to carry these security requirements down the cycle. We focus on a technique known as the Common Criteria, which allows for the development of security requirements. We extend the capabilities of Common Criteria beyond the requirements phase, to allow us to take security requirements into further stages of the cycle. In this paper we describe CCARCH, a technique accompanied by a set of tools, that takes Common Criteria expressed security requirements to the architectural level. Our approach aids in making the usage of Common Criteria more beneficial and applicable.