There are also risk management methods like EBIOS, OCTAVE, CORAS, and CRAMM which enforce security levels based on risk measure.

To prioritize the elicited security requirements, one needs to measure underlying risks. The root cause of security requirements is the mitigation of different types of risk associated with the threats.

There are proposal on discovering and eliciting of security requirements like abuse case, misuse case, common criteria, attack trees. Firesmith defined security requirement as high level requirements that gives specification of system behavior and distinguish these from security related architectural constraints so that requirement engineers can discover true security requirements. This leads to development of security measure at the early phase of SDLC (Software Development Life Cycle). As a result the final software system may use inefficient mechanism with increased cost. Current software development processes enforce security measures during design phase which may end up in specifying security related architecture constraints that are not really necessary. Security engineering focuses on processes and methods for implementing security in software and related systems.The rapid development of internet based software systems which maintain sensitive information and carry out critical activities has initiated an increasing attention on how to build secure software. We have stored various cryptographic techniques and their analytic attributes in the repository to find out the specific cryptographic technique that would eventually help in the later stages of the design process by eliminating unnecessary design constraints in a particular scenario.

The identified design attributes are prioritized and a security design template is prepared. To eliminate this problem, we propose a Framework for Security Engineering Process that involves converting security requirements and threats into design decisions to mitigate the identified security threats. Developers enforces security measures during design phase of software development processes which may end up in specifying security related architecture constraints that are not really necessary.

To design, build and deploy secure systems, we must integrate security into our application development life cycle and adapt current software engineering practices and methodologies to include specific security-related activities.

Sdl threat modeling tool 3.1.8