# Security Monitoring during Software Development:
## 1 Introduction  
In the traditional software development lifecycle (SDLC), security is treated as an afterthought. In particular, software products are built without having security in mind, and is added during their deployment phase through the addition of external protection mechanisms, such as attack detection, firewalls, etc., in an attempt to prevent malicious individuals from exploiting existing vulnerabilities [1, 2]. Although this approach was considered sufficient for common offline software applications, the observed transition to the cloud and the software-as-a-service (SaaS) paradigm that makes the software applications accessible via the Internet, along with the fact that external protection mechanisms can be bypassed regardless of their strength, showcase the need for a more careful consideration of security aspects during the overall SDLC. The above reasons, along with the numerous real-world examples of software vulnerabilities that led to devastating financial and reputation damages (e.g., Equifax Breach [3], HeartBleed [4], WannaCry [5], Log4j[6], etc. ),forced software companies to shift their focus towards the security-by-design paradigm, that is, on adopting a secure SDLC that leads to the construction of software applications that are highly secure (i.e., vulnerability-free) from their ground up. The vast majority of software vulnerabilities are introduced during the coding phase of the SDLC through coding mistakes that are made by the developers [2; 7; 8], either due to their lack of security expertise or due to strict production deadlines that force them to make compromises on the quality of their produced code [9; 10]. Hence, appropriate tools are required to help developers avoid the introduction of such issues during the development and project managers better monitor the security of developed source code. Static analysis is considered one of the most effective mechanisms for detecting potential vulnerabilities during the overall development, and therefore it is a must-have feature for all of the popular Secure SDLCs, including Microsoft's SDL [11], Cigital's Touchpoints [1], and OWASP OpenSAAM ([[http://www.opensamm.org/](http://www.opensamm.org/)]([http://www.opensamm.org/](http://www.opensamm.org/))). However, the main problem of static analysis tools is that they produce long lists of raw warnings that, while encapsulating important security information for the analyzed software, are difficult to comprehend by technical and non-technical stakeholders. Therefore, there is a need for knowledge extraction tools that are able to post-process these results in order to extract useful security-relevant information and present it in a more attractive and easy-to-understand way. Several mechanisms have been proposed in the literature over the years for enabling the security monitoring of software products during their development, by leveraging security-related results produced by static analysis. Two such mechanisms that have attracted the attention of the research community are (i) the security assessment models, which are models that provide high-level metrics that reflect important security aspects of the analyzed software that are computed by aggregating the results of static analysis, and (ii) the vulnerability prediction models, which are models that are able to detect security hotspots, i.e., software components that are likely to contain vulnerabilities. Both models can be leveraged by project managers for facilitating their decision-making activities during the SDLC. In fact, they allow them to better monitor the security of the developed software and identify those security aspects or components that require immediate attention by the development team. However, the main shortcoming of these mechanisms, which also explains their limited adoption in practice, is that they are difficult to set up and to be tailored to the needs of a specific software company.