Towards the selection of security tactics based on non-functional requirements: Security tactic planning poker

To achieve security requirements in software design, software architects often adopt security tactics which provide mechanisms to detect, resist, react, and recover from attacks. Nevertheless, there are situations in which the selection of security tactics must be performed in a group manner involving practitioners with different profiles for a more accurate achievement of the security requirements. In this article we propose Security Tactic Planning Poker (SToPPER), a technique that allows stakeholders to interact with each other in order to select security tactics in group form. To validate our proposal, an empirical study was performed in a group of 9 subjects who were presented with three specific non-functional requirements (NFRs) of a particular project. The results revealed that the use of our technique allowed establishing a common basis for the use of security tactics, generating the interaction of all stakeholders involving quick familiarization; a good process of interaction and integration; and the possibility to quickly learn security tactics. At the same time, it was observed that: (1) the subjects performed involuntarily trade-offs between security tactics, and (2) subjects with greater experience selected security tactics with more foundation than the novice subjects.