In this lesson,
we will learn about security requirements.
Security requirements,
are the specific criteria a system must meet
to ensure protection against threats and vulnerabilities.
Security requirements can be categorized
as functional or non-functional.
Functional security requirements,
define specific security-related behaviors and features
that a system must have,
such as authentication mechanisms,
access controls and encryption protocols.
Non-functional security requirements focus
on the qualities of the system,
including its performance, reliability and usability.
A common challenge in security requirement implementation,
is security versus usability.
This can require a trade-off,
such as increasing security measures,
like implementing multi-factor authentication,
which may reduce user convenience and accessibility.
Let's learn more about functional,
versus non-functional requirements
and security versus usability trade-offs.
First, we have functional and non-functional requirements.
Let's compare functional and non-functional requirements,
while thinking about a fairytale castle.
Functional security requirements,
are like the specific defenses of the castle.
For example,
a moat with a drawbridge can control access,
while tall walls block invaders,
archers on towers detect and attack enemies
and locks on the gates prevent unauthorized entry.
These defenses represent direct, practical security features
that protect our fairytale castle from threats.
Similarly, in cybersecurity,
functional security requirements include features,
like user authentication,
which ensures only authorized users can access a system.
Authentication mechanisms may involve credentials,
such as passwords, biometric data,
or multi-factor authentication.
Next, access controls can be used
to determine who is permitted to access certain resources,
or areas within the system.
Access controls ensure that users are only allowed
to interact with the parts of the system relevant
to their role.
Finally, encryption protocols are used
to secure communications and data
by converting sensitive information
into unreadable ciphertext during transmission.
Encryption prevents unauthorized parties
from accessing or interpreting data.
These functional security measures,
are the digital equivalent of a castle's physical defenses,
protecting systems from unauthorized access and threats.
Non-functional security requirements,
on the other hand, are like the quality and resilience
of the castle.
For example, the castle's walls must not only be tall,
but strong enough to withstand attack.
The drawbridge must allow authorized individuals in quickly
without giving enemies a chance to enter.
And the structure must endure external forces like storms
without crumbling.
These qualities ensure
that the castle remains operational under pressure,
regardless of the number
of attackers or external challenges.
In cybersecurity,
non-functional security requirements are also important
for ensuring the system's performance and reliability.
For example,
encryption algorithms must be not only robust enough
to prevent attackers from breaking them,
using brute force or cryptographic techniques,
but also be optimized
to avoid significant delays in data processing.
This is because a system
that employs strong encryption, but performs slowly,
can hinder key operations,
particularly in environments
where real-time data processing is critical,
such as financial systems or healthcare networks.
Next, reliability demands
that a system remain operational,
even when subjected to high traffic loads,
hardware failures or partial system outages.
To achieve this, implementing features,
like redundancy and failover mechanisms is essential.
Redundancy ensures that if one component fails,
the system can switch
to backup components or alternate pathways,
maintaining availability and security,
even during disruptions.
In the end, non-functional security requirements guarantee
that the system is not only capable
of defending itself against threats,
but also remains efficient, resilient and robust
under various conditions,
ensuring continuous protection
without compromising performance.
Now, a common challenge in enterprise IT,
is finding the right balance
between making a system secure enough
to protect against threats while keeping it user-friendly
for day-to-day operations.
So, now, we will explore security versus usability.
To discuss security versus usability,
let's go back to our fairytale castle analogy.
You could design a castle with layers of complex defenses,
such as multiple drawbridges, secret passageways
and intricate locks.
But if it's too hard for even the castle's guards to enter,
then, daily operations will grind to a halt.
In this situation, friendly forces,
would spend so much time navigating the defenses
that the castle would become inefficient,
despite being highly secure.
This mirrors what happens in IT environments
when security measures become overly restrictive.
In an enterprise organization,
an example of this balance is multi-factor authentication,
or MFA.
MFA requires users to verify their identity
through two or more forms of authentication,
such as a password or a fingerprint,
or a one-time code sent to their mobile device.
While this adds an essential layer of security,
which is preventing unauthorized access,
even if someone's password is compromised,
it can also slow down legitimate users.
Employees may find the MFA process cumbersome,
especially if they have
to authenticate multiple times a day,
or if the additional factor,
involves using a separate device like a phone.
A cumbersome authentication process can lead
to frustration and lower productivity,
creating a natural tension
between strong security and user convenience.
In most cases,
the security benefits of MFA outweigh the inconvenience
of using it.
But things like single sign-on,
can help make the process more efficient.
Another technical challenge is the implementation
of encryption.
While encryption is used for protecting sensitive data,
it can also introduce latency.
The time it takes to encrypt and decrypt data can lead
to slower performance in applications.
This will cause problems,
particularly in environments
that require real-time processing,
such as financial transaction,
or large data transfer environments.
In some cases,
administrators may have to make tough trade-off choices,
like do they prioritize security
by using more complex encryption algorithms,
or do they sacrifice some level of encryption
to ensure the system runs efficiently?
Another layer of trade-off comes
with access control policies.
Highly granular access controls,
which limit what individual users or groups can do
in a system,
provide strong security, but can make workflows clunky.
For instance, a developer might need multiple approvals just
to access a specific tool or set of data,
always requiring multiple approvals can add up eventually
to delay project timelines.
So, security policies like these can enhance protection
against insider threats,
but they also risk slowing down legitimate users trying
to perform routine tasks.
So, remember,
security requirements are the specific criteria
that a system must meet
to protect against threats and vulnerabilities.
These requirements are divided
into functional and non-functional categories
where functional security requirements,
involve the specific features
and behaviors a system must have,
such as authentication mechanisms,
access controls and encryption.
Non-functional security requirements focus
on the system's qualities,
such as its performance, reliability
and ability to handle stress without failure.
A common challenge in implementing security requirements,
is finding the right balance
between strong security and usability.
This is because more robust security measures,
can sometimes reduce user convenience and system efficiency.