Maintaining results from security assessments

Security assessments are cosily and lime consuming and cannot be carried out from scratch each lime a system is updated or modified This motivates the need for specific methodology addressing the maintenance Of assessment results, in particular, and a component-oriented approach to security assessment in general This paper presents such a methodology in the selling of model-based security assessment as developed by the EU-project CORAS. The main focus is on the maintenance part.