By contrast, security requirements, particularly in software security, tend
to be either constraints on functionality or a statement of a needed property
(or attribute), that will be manifested by a software behavior. At least initially
during requirements capture, they will often be stated in negative terms.