I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions and one story was As a user I can commit for marketing card that was selected previously in order to buy my goods, the conditions of satisfactions in this case contained some conditions in addition to The system must secure the Credit Card data across the internet connection using httpsI disagreed with that and said this is a thing that must be done, not just in case the user asked me to protect it, and it is a fatal threat like or more important than SQl Injections and this is a non-functional requirement at the technical level and if the user mention it or didn't this must be taken in our development, some project managers in the course showed their disagreement and said this is a time wast on features that the user didn't ask for!, the instructor didn't give my comment any attention and didn't reply to me.I really think I'm true and not convinced, but all of those trained people disagreed with me[I'm new in the software engineering field but used always to work as a developer], so I'm asking you about this.
Is securing the credit card data is considered a requirement from the customer
agile;security;requirements;user story
You bring up an interesting point, as I don't see that many requirements documents would contain things like:The application shall be free of SQL Injection vulnerabilities, orThe application shall be free of CSRF vulnerabilities,as such a list might actually be (more or less) unbounded, and securing credit card numbers with HTTPS is an implementation detail.That said, the requirement probably does exist somewhere, even if it's in the form:The application shall secure credit cards in a manner acceptable to the credit card companies.It's a real, testable  requirement, and needs to be documented somewhere.  It's not an implied requirement, any more than The application shall use best practices while coding is an implied requirement, even though it is a good idea.