into positive functional requirements is still an unresolved “hard problem” for
which, although it is widely acknowledged and actively researched, there has
still been no practical solution proposed outside of academia.
Software Security Assurance State-of-the-Art Report (SOAR) 293