Patent ID: 8413249

Claim:
A method comprising: providing in a non-transitory machine readable storage device a first information structure that includes a software configured system architecture model of a system that includes a representation of multiple component machines and that includes a representation of at least one communication channel between two or more of the component machine representations and that includes an association of indicia of mitigation of a vulnerability with at least one component machine representation or at least one communication channel representation; providing as-built code that comprises an implementation of the software configured system architecture model; providing in a machine readable storage device, a database that identifies a code element characteristic that designates an observation point within as-built code, and wherein the database identifies observation information that corresponds to the observation point and that designates at least one observation point attribute that is indicative of whether a mitigation of the vulnerability that corresponds to the observation point is provided; observing in the as-built code, the designated observation point and the corresponding designated at least one observation point attribute; producing in a machine readable storage device, a log that includes an entry that identifies an observation point observed in the as-built code and that identifies at least one observation point attribute observed in the as-built code; and using the computer to produce a map in a machine readable storage device, that associates the observation point identified within the entry with at least one component within the threat model and that associates the at least one observation point attribute identified within the entry with the indicia of mitigation associated within the threat model with the at least one component that the map associates with the observation point identified within the entry.