# Security Monitoring during Software Development:
## 3 Methodology
### Requirements Elicitation and Architecture Design
#### 3.2.1 Requirements Elicitation and Use Case Definition
\begin{table}
\begin{tabular}{l l} \hline \hline
**ID** & FR 1 \\ \hline
**Priority** & 1 \\ \hline
**Category** & Software Security Monitoring \\ \hline
**Dependence** & None \\ \hline
**Brief Description** & Identification of software security issues \\ \hline
**Detailed Description** & The system must detect security issues (i.e., potential vulnerabilities) that reside in the source code of the analyzed software application and report the identified issues to the user. \\ \hline
**Rationale** & Vulnerabilities usually stem from mistakes that are made by the developers during the coding phase of the SDLC. The ability to identify such security issues is critical for the optimization of the security level of the produced source code. \\ \hline
**Condition** & Access must be granted to the source code of the software application that should be analyzed. \\ \hline
**Expected Input** & The source code files of the selected software application. \\ \hline
**Expected Output** & A complete list of all the potential security issues that were identified, along with recommendations and examples of potential fixes (where possible). \\ \hline
**Expected Interface** & Integration to the broader platform and presentation of the results through visualization entities (e.g., charts and tables). \\ \hline \hline
**ID** & FR 3 \\ \hline
**Priority** & 1 \\ \hline
**Category** & Software Security Assurance \\ \hline
**Dependence** & FR 1 \\ \hline
**Brief Description** & Assessment of the security level of the software \\ \hline
**Detailed Description** & The system should assess the level of internal security of a software application whose code has been analyzed for potential vulnerabilities, providing quantitative security indicators. \\ \hline
**Rationale** & This is expected to facilitate decision-making during the implementation of software applications by the development team by providing a quantitative measurement of their security level. \\ \hline
**Condition** & To have successfully performed static code analysis. \\ \hline
**Expected Input** & The source code files of the software application. \\ \hline
**Expected Output** & A report containing both the overall security score of the analyzed software application and the individual lower-level security property scores, as well as the category in which the problem is classified. \\ \hline
**Expected Interface** & A table reporting the overall security index, as well as various graphs illustrating security properties at lower levels of a software product. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Functional requirements for identification of software security issues. \begin{table}
\begin{tabular}{l l} \hline \hline
**ID** & FR 3 \\ \hline
**Priority** & 1 \\ \hline
**Category** & Software Security Assurance \\ \hline
**Dependence** & FR 1 \\ \hline
**Brief Description** & Assessment of the security level of the software \\ \hline
**Detailed Description** & The system should assess the level of internal security of a software application whose code has been analyzed for potential vulnerabilities, providing quantitative security indicators. \\ \hline
**Rationale** & This is expected to facilitate decision-making during the implementation of software applications by the development team by providing a quantitative measurement of their security level. \\ \hline
**Condition** & To have successfully performed static code analysis. \\ \hline
**Expected Input** & The source code files of the software application. \\ \hline
**Expected Output** & A report containing both the overall security score of the analyzed software application and the individual lower-level security property scores, as well as the category in which the problem is classified. \\ \hline
**Expected Interface** & A table reporting the overall security index, as well as various graphs illustrating security properties at lower levels of a software product. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Functional requirements for assessment of the security level of the software.