Genie in a Model? Why Model Driven Security will not secure your Web Application

More often a new software development methodology called Model Driven Engineering (MDE) is used to increase productivity by supporting powerful code generation tools, which allows a less errorprone implementation process. However the idea of modeling system aspects during the design phase so called Model Driven Security (MDS) was proposed by the scientific community decades ago and yet it is still unclear whether MDS can improve the security of a software project. In this paper we provide a comprehensive evaluation of current MDS approaches based on a web application scenario in regards to the most common web security attacks. We discuss their strengths and limitations as well as the practicability of MDS for modern web application security in general.