Defining security requirements

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is a testable security requirement?

A The system must lock an account for 15 minutes after 5 failed login attempts.

B The system must be very secure against hackers.

2. What does a security requirement state?

A The programming language the developers must use

B The protection a system must provide for its data and functions

3. Which requirement is mainly about confidentiality?

A Only the student and their teachers can view a student's results.

B The results website must be online 99.9% of the time.

4. Which requirement is mainly about integrity?

A Marks must be encrypted so unauthorised users cannot read them.

B Any change to a mark must be logged and only allowed for authorised staff.

5. Which requirement is mainly about availability?

A The booking system must recover from a failure within 30 minutes.

B The booking system must hide customers' addresses from other users.

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1The system shall encrypt all student records stored in the database using AES-256.		AThe system shall lock an account for 15 minutes after 5 failed login attempts.
2The system shall be available 99.9% of the time during school terms, measured monthly.		BThe system shall restrict access to personal information to staff with an approved role, in line with the Privacy Act 1988.
3A legal requirement drawn from privacy law: the system must protect personal information and only disclose it as permitted.		CIt is vague and not measurable. Words like 'very secure' and 'well' cannot be tested, and no asset or control is named.
4A testable requirement states a specific, measurable condition that a tester can check as pass or fail.		DIt ignores the assets, users and laws involved, so it does not say who or what is protected or why. 'Strong' is also not defined.
5The system shall be very secure and protect all data well.		EA confidentiality requirement: it protects data so only authorised parties can read it.
6Requirement: Staff must use strong passwords. (Written without identifying the system's users, assets or laws.)		FAn availability requirement: it sets a measurable level of uptime so authorised users can access the system.

Definitions

security requirement

Fill in the Blanks

Complete each line of code by filling in the missing parts.

asset: student health records need: _______________ rule: Only the school nurse can view them.

asset: exam marks need: _________ rule: Any mark change must be logged.

asset: online booking system need: ____________ rule: Must be online 99.9% of the time.

asset: customer personal details source: _____ (Privacy Act 1988) rule: Protect data from misuse and loss.

requirement: Lock account after 5 bad logins ____: Enter 5 wrong passwords, check lock

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A ASSET: student marks table

B TYPE: availability

C RULE: Only teachers view marks

D TEST: Student login is denied

Question 2

A LAW: Copyright Act 1968

B ASSET: customer personal data

C REQ: Encrypt data at rest

D TEST: DB file is unreadable

Question 3

A ASSET: order total

B TYPE: integrity

C REQ: Users can edit any total

D TEST: Edited total is rejected

Question 4

A ASSET: online booking site

B TYPE: availability

C REQ: Site must be mostly up

D TEST: Monitor logs uptime

Question 5

A ASSET: staff payroll file

B USER: all students and staff

C REQ: Login with MFA to view

D TEST: Login without MFA fails

Answer Key

Defining security requirements

Section A: Quick Questions

A — The system must lock an account for 15 minutes after 5 failed login attempts.

B — The protection a system must provide for its data and functions

A — Only the student and their teachers can view a student's results.

B — Any change to a mark must be logged and only allowed for authorised staff.

A — The booking system must recover from a failure within 30 minutes.

Section B: Match the Pairs

The system shall encrypt all student records stored in the database using AES-256. → A confidentiality requirement: it protects data so only authorised parties can read it.

The system shall be available 99.9% of the time during school terms, measured monthly. → An availability requirement: it sets a measurable level of uptime so authorised users can access the system.

A legal requirement drawn from privacy law: the system must protect personal information and only disclose it as permitted. → The system shall restrict access to personal information to staff with an approved role, in line with the Privacy Act 1988.

A testable requirement states a specific, measurable condition that a tester can check as pass or fail. → The system shall lock an account for 15 minutes after 5 failed login attempts.

The system shall be very secure and protect all data well. → It is vague and not measurable. Words like 'very secure' and 'well' cannot be tested, and no asset or control is named.

Requirement: Staff must use strong passwords. (Written without identifying the system's users, assets or laws.) → It ignores the assets, users and laws involved, so it does not say who or what is protected or why. 'Strong' is also not defined.

Section C: Definitions

security requirement — A statement of the protection a system must provide for its data and functions, based on its assets, users and laws, written so it can be tested.

Section D: Fill in the Blanks

asset: student health records
need: confidentiality
rule: Only the school nurse can view them.

asset: exam marks
need: integrity
rule: Any mark change must be logged.

asset: online booking system
need: availability
rule: Must be online 99.9% of the time.

asset: customer personal details
source: legal (Privacy Act 1988)
rule: Protect data from misuse and loss.

requirement: Lock account after 5 bad logins
test: Enter 5 wrong passwords, check lock

Section E: Spot the Error

B — The requirement limits who can view the marks, so it is a confidentiality requirement. It should be TYPE: confidentiality.

A — Protecting customer personal data falls under the Privacy Act 1988 (Cwlth), not the Copyright Act. The line should be LAW: Privacy Act 1988 (Cwlth).

C — An integrity requirement must stop unauthorised changes to the data. Letting users edit any total breaks it. It should say the server alone sets the total.

C — 'Mostly up' is vague and cannot be tested. A security requirement needs a measurable target such as uptime is 99.9% monthly.

B — The users of the asset must be identified correctly. Only payroll officers need the payroll file, so the line should be USER: payroll officers only.