Reducing the gap between security audit and software engineering methods

The information security aspect has become a major concern for software project leaders. The problem is that software engineers still consider security issues as add-on requirements expressed and verified by “external” actors like auditors or security managers. We aim to help software engineers by identifying precisely what they are expected to do and to deliver at each step, in order to enhance the security level of the targeted information system. In this paper, we focus on merging security issues in software life cycle. Therefore, we extract security requirements and best practices from security audit methods and embed them in software methods. We consider in particular the well-known UP and MEHARI methods. The idea is to anchor security recommendations from the MEHARI method in the lifecycle of the UP, by the mean of meta-modeling approach.