Security Requirements for the Development Team

Insight categories: SecurityAutomotiveCommunicationsConsumer and RetailFinancial ServicesHealthcareManufacturing and IndustrialMediaTechnology

In my last post, “Security Training for the Development Team,” I shared the experience of building a security training program for the development team. 

Today, I will cover another essential step of securing engineering: security requirements. After reading this blog, I hope you will have a better understanding and be able to improve your security processes by implementing the additional requirements you’ll find here from the beginning of the product engineering phase. 

Understanding a system’s security and privacy requirements is critical to building a secure system. Therefore, security requirements must be updated regularly to reflect current requirements and the constant threat of landscape changes. Security requirements should also be defined along with the functional requirements, as this will help the design team to create a better system that can both cover these requirements and build a new security culture and mindset. 

Below, we will discuss an agile development environment and how security requirements can be captured and tracked in different ways.

1. Security Epics And User Stories 

A team can track security requirements similar to the functional and feature requirements in the form of epics and user stories

Epics and user stories can document and track business-related security requirements like security requirements for policy/compliance, legal, contractual and regulatory requirements, or system functionalities, design levels like multi-factor authentication, logging, and tracing. These can be prioritized alongside other epics and user stories. 

Security epics and user stories ensure security requirements are considered from the beginning, making the team fully aware of these requirements. The team can also tag these epics and user stories by tracking them separately across a security board. 

2. Security Tasks

In addition to epics and user stories, a team can also track security requirements as part of the security tasks. Security tasks are more suitable for granular or implementation levels, for example, when a task is used to implement data encryption while capturing and storing PII data. 

Security tasks ensure that security is not missed while implementing business features and functionalities. 

3. Security Debt

Security tasks can also be captured and tracked through a function called security debt. Debt is those tasks that cannot be properly implemented because of the prioritization part of this list. 

But as with technical debt, a team should be cautious when tracking security debt, as this can grow rapidly and become a significant risk if it is not taken care of within a reasonable time. 

4. Operational Security Tasks 

The team can also capture and track operational-related security tasks as part of their operational security tasks. 

These tasks are typically not related to security requirements, meaning they are operational. Examples could include updating the development environment regularly, updating open-source libraries regularly (at least before each major release), resolving issues reported by SAST, etc.

5. Specialized Security Tasks

The engineering team can implement all of the above without any significant help from the security team. 

But there are a few tasks that require a deep understanding of security. These can be captured and tracked through specialized security tasks such as the performance of threat modeling, PEN testing, environment hardening, etc.



Kulbhushan Bhardwaj

VP Engineering and Global Security Practice Head

View all Articles

Trending Insights

If You Build Products, You Should Be Using Digital Twins

If You Build Products, You Should Be Using...

Digital TransformationTesting and QAManufacturing and Industrial
Empowering Teams with Agile Product-Oriented Delivery, Step By Step

Empowering Teams with Agile Product-Oriented Delivery, Step By...

AgileProject ManagementAutomotiveCommunicationsConsumer and RetailMedia

Top Authors

Ravikrishna Yallapragada

Ravikrishna Yallapragada

AVP, Engineering

Lavanya Mandavilli

Lavanya Mandavilli

Principal Technical Writer

Oleksandr Fedirko

Oleksandr Fedirko

Senior Solution Architect

Mark Norkin

Mark Norkin

Consultant, Engineering

Deborah Kennedy

Deborah Kennedy

Associate Vice President,Client Engagement

All Categories

  • URL copied!