An Efficient Identification of Security Threats in Requirement Engineering Methodology

Table 4

Identified assets of the college ERP system.

Value resource ID	Name	Description
VR1	Patient, doctor, and admin	The value resource that relates to a patient, doctor, and admin
VR2	Patient’s login data	The patient’s credentials: username and password
VR3	Doctor login data	The doctor’s credentials: username and password
VR4	Admin login data	The admin’s credentials: username and password
VR5	Patient’s personal data	The personal data that the patient enters, such as patient record
VR6	Doctor’s personal data	The personal data that the doctor, such as doctor record and assets
VR7	System	Value resource that relates to the importance of the system
VR8	Accessibility of ERP system	If the hospital ERP system goes down, patient/and doctor cannot request or receive quotes.
VR9	Procedure	Value resources that relate to the process of running the web application
VR10	Request	Value resources that relate to the web application
VR11	Login	The web session associated with a logged-in patient, doctor, or admin
VR12	Backend DB session	The ability to interact with the database that stores, patient’s data, doctor’s data, and login credentials
VR13	Patient fee details	The patient’s fee record must be secure. Manipulation of the data causes loss in data.
VR14	Doctor salary details	The doctor’s salary record must be secure. Manipulation of the data causes loss in data.
VR15	Message notification	The message notification contains the information for patients and doctors
VR16	Audit data	Attackers might try to attack the system without being logged or audited
VR17	Access to the record	Authorized people only able to view the record