Software Engineering

8.3.6 
Identify data security needs
The requirements for data security must be specified to ensure that proper data 
access and control procedures are implemented. The requirements for data secu-
rity must be evaluated to ensure that business and personal data cannot be com-
promised. The business rules that govern whom within the business operation 
can access, modify, or delete data from persistent storage must be specified. The 
requirements for data access control privileges for each class of users must be spec-
ified, as well as specific software requirements for access control monitoring and 
enforcement.
An important aspect of data security is assigning a security classification identi-
fier for sensitive data elements. The different data security classification levels must 
be defined and the criteria for data elements to be assigned to each classification 
level should be specified. 
Table 8.1
 shows some typical security classification levels 
used in the private and government sectors.
In addition, the need for the application to apply cryptography algorithms to 
encrypt data before it is stored or transmitted must be specified. Personnel secu-
rity levels and user classes or roles that may access data must be identified, and 
the user classes, passwords, and data security administration responsibilities must 
be identified. How the application is to enforce these responsibilities, provide the 
Table 8.1 
Typical Private and Government Sector Security Classification Levels