John Wilander and Jens Gustavsson [184] agree with Haley that the
“current practice in security requirements is poor.” They further observe that
“Security is mainly treated as a functional aspect composed of security features
such as login, backup, and access control. Requirements on how to secure