Combining Functional and Security Requirements’ Processes

Requirements elicitation for a new system requires extensive involvement with stakeholders who usually have varying aims, backgrounds and disciplines, and this process is complicated further if the system has critical security, or other non-functional requirements. Established approaches to the elicitation and analysis of functional and non-functional requirements are very different the former focussing on boundary behaviour and the later on threats to assets. This paper describes how requirements were established for the Distributed Aircraft Maintenance Environment (DAME) system, showing how established practice from both disciplines can be effectively combined, and the interaction and iteration that is needed between functional and non-functional requirements processes in order to meet both their objectives in practice.