jperezduerto.info
Security in depth · Unit 28 · Lesson 3 of 11
Turn security wishes into requirements
Turn a privacy goal into an observable actor, action, and data rule.
Helpful before thisThreat modeling: ask before building
After this lesson you can
- Write a requirement that distinguishes permitted profile fields from protected contact data.
One idea. One situation. One reasoned decision.
From a goal to a rule
A useful security requirement states who may perform which action on what data, under which conditions, and what observable result is expected. “Private profiles” leaves those decisions open. A feature can contain both shared and private fields.
Read the supplied record
R1 describes a fictional volunteer directory.
| Product decision | Approved meaning |
|---|---|
| Display name | Readable by signed-in members |
| Emergency phone | Readable only by its authenticated profile owner |
| Other staff exceptions | None in this workflow |
| Current test note | Phone field hidden on another member’s page |
Assume identity and profile ownership are established correctly. The missing requirement concerns delivery of the protected field, not how sign-in works.
Write the rule around returned data: another member may receive the display name but must not receive the emergency phone. The owner’s permitted read must still work. The supplied test note describes appearance; it does not establish what data the service returned.
Your acceptance rows should identify requester, target profile, requested field, expected result, and observed result. Use distinct synthetic profiles so the ownership relationship is explicit. Record missing observations as unverified rather than treating a blank screen as complete evidence.
Scope matters too. This exercise covers directory reads, not recovery staff, exports, or emergency operations. If the product later adds an exception, require the owner to define its authority and expected behavior before extending the rule.
The key distinction: A measurable privacy rule describes allowed data delivery, not only page appearance.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which requirement best matches R1’s approved policy?
Show the answer
Correct answer: Permit members to read display names; return an emergency phone only to its authenticated profile owner. It identifies actors, fields, and expected access outcomes while preserving the approved public-to-members function.
Try it
- WriteRewrite R1 as one requirement, then add two acceptance rows: another member requests a display name, and another member requests an emergency phone. Record the expected data returned in each case.