  [Background] The rapidly changing business environments in which many
companies operate is challenging traditional Requirements Engineering (RE)
approaches. This gave rise to agile approaches for RE. Security, at the same
time, is an essential non-functional requirement that still tends to be
difficult to address in agile development contexts. Given the fuzzy notion of
"agile" in context of RE and the difficulties of appropriately handling
security requirements, the overall understanding of how to handle security
requirements in agile RE is still vague. [Objective] Our goal is to
characterize the publication landscape of approaches that handle security
requirements in agile software projects. [Method] We conducted a systematic
mapping to outline relevant work and contemporary gaps for future research.
[Results] In total, we identified 21 studies that met our inclusion criteria,
dated from 2005 to 2017. We found that the approaches typically involve
modifying agile methods, introducing new artifacts (e.g., extending the concept
of user story to abuser story), or introducing guidelines to handle security
issues. We also identified limitations of using these approaches related to
environment, people, effort and resources. [Conclusion] Our analysis suggests
that more effort needs to be invested into empirically evaluating the existing
approaches and that there is an avenue for future research in the direction of
mitigating the identified limitations.
