# Security Monitoring during Software Development:
## 3 Methodology  
In this section, a detailed description of the overall methodology that was followed for setting up a security monitoring platform tailored to the needs of a specific company is \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Requirements** & **SonarQube** & **Coverity** & **Fortify** & **VM4 SEC** \\ \hline Identification of Security Issues & ✓ & ✓ & ✓ & ✓ \\ Visualization of Analysis Results & ✓ & ✓ & ✓ & ✓ \\ Quantitative Security Metrics & & & & ✓ \\ Vulnerability Prediction & & & & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison between existing popular static analysis tools and platforms and the VM4 SEC platform. provided. The overall methodology is illustrated in Figure 1. As can be seen by Figure 1, the adopted approach consists of the following major steps:  
1. **Survey:** Initially, a 2-step survey was conducted for identifying (i) the current state of the company with respect to employed security monitoring techniques, (ii) the most suitable security monitoring mechanisms that should be added to the workflows of its software engineers, and (iii) the most common security issues and most critical security aspects faced during the development of its software applications. The first two points are important for eliciting the requirements of the envisaged platform, whereas the latter is crucial for properly configuring the parameters of the platform's mechanisms, so as to be tailored to the company's needs. Online questionnaires were utilized as the main instruments for gathering the required feedback from the participants. 2. **Focus group**: Subsequently, an open discussion was conducted with the software engineers and project managers of the company, based on the topics discussed in the questionnaire, through a dedicated focus group. The open discussion provided additional insights about the current security state of the company, its security monitoring needs, and the most suitable security mechanisms to be deployed, along with their required configuration. The focus group was also vital for defining the requirements, the use cases, and, eventually, the final architecture of the VM4 SEC platform. 3. **Requirements Elicitation and Architecture Design**: The feedback collected through the 2-step survey and the focus group was utilized as the basis for eliciting the functional and non-functional requirements of the platform, along with its main use cases. A formal requirements elicitation process was followed in order to ensure transparency and clear specification. Apart from the information collected through the survey and the focus group, several iterations of _question and feedback_ sessions were conducted with the software engineers and the project managers of the company, in order to ensure the completeness of the requirements list. Based on the extracted requirements, the overall architecture of the platform was defined following the Data Flow Diagram (DFD) architectural design paradigm. 4. **Model/Mechanisms Configuration/Tuning**: The selected security monitoring mechanisms, i.e., the quantitative security assessment (QSA) and vulnerability prediction models (VPMs), were calibrated in order to adapt to the specific needs of the company. More specifically, as will be explained later, the VPMs were constructed based on a vulnerability dataset that was curated with the aid of the company's developers, comprising real-world vulnerability examples that are commonly found in the company's projects. Moreover, the QSA model was built is such a way so that it will be able to identify security issues that are considered more relevant and important for the applications of the company, as well as compute high-level metrics that are of interest to the company. For this purpose, information that was gathered by the questionnaire was leveraged and statistically analyzed, whereas advanced multi-criteria decision-making (MCDM) techniques were employed for deriving the models' parameters. 5.