addresses these problems by combining what he identifies as a requirements
engineering approach with a security engineering approach. In the framework,
security goals are defined that express the need to protect system assets from
harm by threats. These goals are “operationalized” into security requirements,