# Security Monitoring during Software Development:
## 3 Methodology
### Configuration of the Core Security Monitoring Mechanisms
#### 3.3.1 Quantitative Security Assessment  
As part of the VM4 SEC platform, we will deploy a novel mechanism able to compute high-level measures that reflect important security aspects of the analyzed software based on the results of security-related static analysis. In particular, we will utilize a state-of-the-art hierarchical security assessment model that was proposed by [PERSON] et al. [17], which, based on the guidelines of the ISO/IEC 25010 [42] security standard and a set of thresholds and weights systematically aggregates the results of static analysis in order to compute high-level security scores, including the security index, which is a score that reflects the security level of the software product under analysis. The general structure of the model is illustrated in Figure 13.  
As can be seen by inspecting Figure 13, the model hierarchically decomposes the notion of security into a set of security characteristics (e.g., Confidentiality, Integrity, etc. ), which are further decomposed into a set of low-level security properties (e.g., Null Pointer, Buffer Overflow, etc.). The security properties correspond to categories of security issues that the software application may exhibit, and are quantified through dedicated metrics, which are, in fact, the densities of static analysis alerts that correspond to these categories. In brief, initially, static analysis is applied to a given software application and the densities of each one of the selected vulnerability categories are computed. Subsequently, based on a set of thresholds, a score between 0 and 1 is assigned to their corresponding security properties, indicating how well the application avoids the associated vulnerability category. Then, based on a set of weights, the scores of the security properties are aggregated in order to compute the scores of the security characteristics of the model. Finally, the overall Security Index of the system is computed by taking the average of the scores of the security  
Figure 13: The general structure of the selected security assessment model. characteristics of the model. For more information about the security model, we refer the reader to the original paper [17]. From the above analysis, it is clear that the security characteristics, the security properties, the weights, and the thresholds of the model constitute its main design parameters that need to be defined properly in order to fit the needs of the company. This information was derived from the industrial case study that was presented in Section 3.1.1, and particularly, from the second step of the survey and the fourth block of the focus group. More specifically, it was decided that the final model would have three security characteristics, namely Confidentiality, Availability, and Integrity, as these were recognized as the most important security aspects of the software projects that are developed by the company. In addition to this, based on the information gathered from the participants of the industrial case study, those three characteristics were considered equally important for the overall security of the developed systems, indicating that they should receive equal weight in the model. The most important vulnerability categories according to the company (which act as the security properties of the model) were found to be: Null Pointer, Weak Cryptography, Insufficient/Incorrect Logging, Security Misconfiguration, and Non-optimum Resource Allocation. The thresholds of the model were calibrated utilizing a popular benchmarking approach [48; 49] based on a set of reference software projects that were selected by the software engineers of the company, as representative examples of the software applications that they build for their clients.