Reuse of Security Assessment Results under Design and Maintenance of IT Systems

Security assessments are costly and time consuming and cannot be carried out from scratch each time a system is updated or modified. This motivates the need for specific methodology addressing the maintenance and reuse of assessment results in particular, and a component oriented approach to security assessment in general. Traditionally, system development methodologies focus on the development of single systems. More recently, the emphasis has shifted towards the development of system product lines. We define a system product line, as a set of systems that share a common, managed set of features satisfying the specific needs of a particular market segment or mission and that are developed from a common set of core entities in a prescribed way. A well accepted idea is that components provide the perfect foundation for the practical application of product line development. The CORAS methodology supports reuse of assessment results in a product-line oriented system development.