security-requirement-extraction

name	security-requirement-extraction
description	Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

Security Requirement Extraction

Transform threat analysis into actionable security requirements.

When to Use This Skill

• Converting threat models to requirements
• Writing security user stories
• Creating security test cases
• Building security acceptance criteria
• Compliance requirement mapping
• Security architecture documentation

Core Concepts

1. Requirement Categories

Business Requirements → Security Requirements → Technical Controls
         ↓                       ↓                      ↓
  "Protect customer    "Encrypt PII at rest"   "AES-256 encryption
   data"                                        with KMS key rotation"

2. Security Requirement Types

Type	Focus	Example
Functional	What system must do	"System must authenticate users"
Non-functional	How system must perform	"Authentication must complete in <2s"
Constraint	Limitations imposed	"Must use approved crypto libraries"

3. Requirement Attributes

Attribute	Description
Traceability	Links to threats/compliance
Testability	Can be verified
Priority	Business importance
Risk Level	Impact if not met

Templates

Template 1: Security Requirement Model

from dataclasses import dataclass, field
from enum import Enum
from typing import List, Dict, Optional, Set
from datetime import datetime

class RequirementType(Enum):
    FUNCTIONAL = "functional"
    NON_FUNCTIONAL = "non_functional"
    CONSTRAINT = "constraint"


class Priority(Enum):
    CRITICAL = 1
    HIGH = 2
    MEDIUM = 3
    LOW = 4


class SecurityDomain(Enum):
    AUTHENTICATION = "authentication"
    AUTHORIZATION = "authorization"
    DATA_PROTECTION = "data_protection"
    AUDIT_LOGGING = "audit_logging"
    INPUT_VALIDATION = "input_validation"
    ERROR_HANDLING = "error_handling"
    SESSION_MANAGEMENT = "session_management"
    CRYPTOGRAPHY = "cryptography"
    NETWORK_SECURITY = "network_security"
    AVAILABILITY = "availability"


class ComplianceFramework(Enum):
    PCI_DSS = "pci_dss"
    HIPAA = "hipaa"
    GDPR = "gdpr"
    SOC2 = "soc2"
    NIST_CSF = "nist_csf"
    ISO_27001 = 
    OWASP = 



 :
    : 
    title: 
    description: 
    req_type: RequirementType
    domain: SecurityDomain
    priority: Priority
    rationale:  = 
    acceptance_criteria: [] = field(default_factory=)
    test_cases: [] = field(default_factory=)
    threat_refs: [] = field(default_factory=)
    compliance_refs: [] = field(default_factory=)
    dependencies: [] = field(default_factory=)
    status:  = 
    owner:  = 
    created_date: datetime = field(default_factory=datetime.now)

     () -> :
        
         

     () -> :
        
         



 :
    name: 
    version: 
    requirements: [SecurityRequirement] = field(default_factory=)

     () -> :
        .requirements.append(req)

     () -> [SecurityRequirement]:
         [r  r  .requirements  r.domain == domain]

     () -> [SecurityRequirement]:
         [r  r  .requirements  r.priority == priority]

     () -> [SecurityRequirement]:
         [r  r  .requirements  threat_id  r.threat_refs]

     () -> [SecurityRequirement]:
         [r  r  .requirements  r.priority == Priority.CRITICAL]

     () -> :
        
        lines = []
        lines.append()

         domain  SecurityDomain:
            domain_reqs = .get_by_domain(domain)
             domain_reqs:
                lines.append()
                 req  domain_reqs:
                    lines.append(req.to_user_story())

         .join(lines)

     () -> [, []]:
        
        matrix = {}
         req  .requirements:
             threat_id  req.threat_refs:
                 threat_id   matrix:
                    matrix[threat_id] = []
                matrix[threat_id].append(req.)
         matrix

Template 2: Threat-to-Requirement Extractor

from dataclasses import dataclass
from typing import List, Dict, Tuple

@dataclass
class ThreatInput:
    id: str
    category: str  # STRIDE category
    title: str
    description: str
    target: str
    impact: str
    likelihood: str


class RequirementExtractor:
    """Extract security requirements from threats."""

    # Mapping of STRIDE categories to security domains and requirement patterns
    STRIDE_MAPPINGS = {
        "SPOOFING": {
            "domains": [SecurityDomain.AUTHENTICATION, SecurityDomain.SESSION_MANAGEMENT],
            "patterns": [
                ("Implement strong authentication for {target}",
                 "Ensure {target} authenticates all users before granting access"),
                ("Validate identity tokens for {target}",
                 "All authentication tokens must be cryptographically verified"),
                ("Implement session management for {target}",
                 "Sessions must be securely managed with proper expiration"),
            ]
        },
        "TAMPERING": {
            "domains": [SecurityDomain.INPUT_VALIDATION, SecurityDomain.DATA_PROTECTION],
            "patterns": [
                ("Validate all input to {target}",
                 "All input must be validated against expected formats"),
                ("Implement integrity checks for {target}",
                 ),
                (,
                 ),
            ]
        },
        : {
            : [SecurityDomain.AUDIT_LOGGING],
            : [
                (,
                 ),
                (,
                 ),
                (,
                 ),
            ]
        },
        : {
            : [SecurityDomain.DATA_PROTECTION, SecurityDomain.CRYPTOGRAPHY],
            : [
                (,
                 ),
                (,
                 ),
                (,
                 ),
            ]
        },
        : {
            : [SecurityDomain.AVAILABILITY, SecurityDomain.INPUT_VALIDATION],
            : [
                (,
                 ),
                (,
                 ),
                (,
                 ),
            ]
        },
        : {
            : [SecurityDomain.AUTHORIZATION],
            : [
                (,
                 ),
                (,
                 ),
                (,
                 ),
            ]
        },
    }

     () -> RequirementSet:
        
        req_set = RequirementSet(
            name=,
            version=
        )

        req_counter = 
         threat  threats:
            reqs = ._threat_to_requirements(threat, req_counter)
             req  reqs:
                req_set.add(req)
            req_counter += (reqs)

         req_set

     () -> [SecurityRequirement]:
        
        requirements = []
        mapping = .STRIDE_MAPPINGS.get(threat.category, {})
        domains = mapping.get(, [])
        patterns = mapping.get(, [])

        priority = ._calculate_priority(threat.impact, threat.likelihood)

         i, (title_pattern, desc_pattern)  (patterns):
            req = SecurityRequirement(
                =,
                title=title_pattern.(target=threat.target),
                description=desc_pattern.(target=threat.target),
                req_type=RequirementType.FUNCTIONAL,
                domain=domains[i % (domains)]  domains  SecurityDomain.DATA_PROTECTION,
                priority=priority,
                rationale=,
                threat_refs=[threat.],
                acceptance_criteria=._generate_acceptance_criteria(
                    threat.category, threat.target
                ),
                test_cases=._generate_test_cases(
                    threat.category, threat.target
                )
            )
            requirements.append(req)

         requirements

     () -> Priority:
        
        score_map = {: , : , : , : }
        impact_score = score_map.get(impact.upper(), )
        likelihood_score = score_map.get(likelihood.upper(), )

        combined = impact_score * likelihood_score

         combined >= :
             Priority.CRITICAL
         combined >= :
             Priority.HIGH
         combined >= :
             Priority.MEDIUM
         Priority.LOW

     () -> []:
        
        criteria_templates = {
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
        }
         criteria_templates.get(category, [])

     () -> []:
        
        test_templates = {
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
            : [
                ,
                ,
                ,
            ],
        }
         test_templates.get(category, [])

Template 3: Compliance Mapping

from typing import Dict, List, Set

class ComplianceMapper:
    """Map security requirements to compliance frameworks."""

    FRAMEWORK_CONTROLS = {
        ComplianceFramework.PCI_DSS: {
            SecurityDomain.AUTHENTICATION: ["8.1", "8.2", "8.3"],
            SecurityDomain.AUTHORIZATION: ["7.1", "7.2"],
            SecurityDomain.DATA_PROTECTION: ["3.4", "3.5", "4.1"],
            SecurityDomain.AUDIT_LOGGING: ["10.1", "10.2", "10.3"],
            SecurityDomain.NETWORK_SECURITY: ["1.1", "1.2", "1.3"],
            SecurityDomain.CRYPTOGRAPHY: ["3.5", "3.6", "4.1"],
        },
        ComplianceFramework.HIPAA: {
            SecurityDomain.AUTHENTICATION: ["164.312(d)"],
            SecurityDomain.AUTHORIZATION: ["164.312(a)(1)"],
            SecurityDomain.DATA_PROTECTION: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"],
            SecurityDomain.AUDIT_LOGGING: ["164.312(b)"],
        },
        ComplianceFramework.GDPR: {
            SecurityDomain.DATA_PROTECTION: ["Art. 32", "Art. 25"],
            SecurityDomain.AUDIT_LOGGING: ["Art. 30"],
            SecurityDomain.AUTHORIZATION: ["Art. 25"],
        },
        ComplianceFramework.OWASP: {
            SecurityDomain.AUTHENTICATION: ["V2.1", "V2.2", "V2.3"],
            SecurityDomain.SESSION_MANAGEMENT: ["V3.1", "V3.2", "V3.3"],
            SecurityDomain.INPUT_VALIDATION: [, , ],
            SecurityDomain.CRYPTOGRAPHY: [, ],
            SecurityDomain.ERROR_HANDLING: [, ],
            SecurityDomain.DATA_PROTECTION: [, , ],
            SecurityDomain.AUDIT_LOGGING: [, ],
        },
    }

     () -> [, []]:
        
        mapping = {}
         framework  frameworks:
            controls = .FRAMEWORK_CONTROLS.get(framework, {})
            domain_controls = controls.get(requirement.domain, [])
             domain_controls:
                mapping[framework.value] = domain_controls
         mapping

     () -> [SecurityRequirement]:
        
        matching = []
        framework_controls = .FRAMEWORK_CONTROLS.get(framework, {})

         domain, controls  framework_controls.items():
             control_id  controls:
                matching.extend(requirement_set.get_by_domain(domain))

         matching

     () -> [, [, []]]:
        
        matrix = {}

         framework  frameworks:
            matrix[framework.value] = {}
            framework_controls = .FRAMEWORK_CONTROLS.get(framework, {})

             domain, controls  framework_controls.items():
                 control  controls:
                    reqs = .get_requirements_for_control(
                        requirement_set, framework, control
                    )
                     reqs:
                        matrix[framework.value][control] = [r.  r  reqs]

         matrix

     () -> [, []]:
        
        gaps = {: [], : []}
        framework_controls = .FRAMEWORK_CONTROLS.get(framework, {})

         domain, controls  framework_controls.items():
            domain_reqs = requirement_set.get_by_domain(domain)
             control  controls:
                matching = .get_requirements_for_control(
                    requirement_set, framework, control
                )
                  matching:
                    gaps[].append()
                 (matching) < :
                    gaps[].append()

         gaps

Template 4: Security User Story Generator

class SecurityUserStoryGenerator:
    """Generate security-focused user stories."""

    STORY_TEMPLATES = {
        SecurityDomain.AUTHENTICATION: {
            "as_a": "security-conscious user",
            "so_that": "my identity is protected from impersonation",
        },
        SecurityDomain.AUTHORIZATION: {
            "as_a": "system administrator",
            "so_that": "users can only access resources appropriate to their role",
        },
        SecurityDomain.DATA_PROTECTION: {
            "as_a": "data owner",
            "so_that": "my sensitive information remains confidential",
        },
        SecurityDomain.AUDIT_LOGGING: {
            "as_a": "security analyst",
            "so_that": "I can investigate security incidents",
        },
        SecurityDomain.INPUT_VALIDATION: {
            "as_a": "application developer",
            "so_that": "the system is protected from malicious input",
        },
    }

    def generate_story(self, requirement: SecurityRequirement) -> str:
        """Generate a user story from requirement."""
        template = self.STORY_TEMPLATES.get(
            requirement.domain,
            {"as_a": "user", "so_that": "the system is secure"}
        )

        story = f"""
## {requirement.id}: {requirement.title}

**User Story:**
As a {template['as_a']},
I want the system to ,
So that .

**Priority:** 
**Type:** 
**Domain:** 

**Acceptance Criteria:**


**Definition of Done:**
- [ ] Implementation complete
- [ ] Security tests pass
- [ ] Code review complete
- [ ] Security review approved
- [ ] Documentation updated

**Security Test Cases:**


**Traceability:**
- Threats: 
- Compliance: 
"""
         story

     () -> :
         .join(  c  criteria)  criteria  

     () -> :
         .join(  t  tests)  tests  

     () -> :
        
        reqs = requirement_set.get_by_domain(domain)

        epic = 
         epic

Best Practices

Do's

• Trace to threats - Every requirement should map to threats
• Be specific - Vague requirements can't be tested
• Include acceptance criteria - Define "done"
• Consider compliance - Map to frameworks early
• Review regularly - Requirements evolve with threats

Don'ts

• Don't be generic - "Be secure" is not a requirement
• Don't skip rationale - Explain why it matters
• Don't ignore priorities - Not all requirements are equal
• Don't forget testability - If you can't test it, you can't verify it
• Don't work in isolation - Involve stakeholders

Resources

• OWASP ASVS
• NIST SP 800-53
• Security User Stories