  Pushed by market forces, software development has become fast-paced. As a
consequence, modern development projects are assembled from 3rd-party
components. Security & privacy assurance techniques once designed for large,
controlled updates over months or years, must now cope with small, continuous
changes taking place within a week, and happening in sub-components that are
controlled by third-party developers one might not even know they existed. In
this paper, we aim to provide an overview of the current software security
approaches and evaluate their appropriateness in the face of the changed nature
in software development. Software security assurance could benefit by switching
from a process-based to an artefact-based approach. Further, security
evaluation might need to be more incremental, automated and decentralized. We
believe this can be achieved by supporting mechanisms for lightweight and
scalable screenings that are applicable to the entire population of software
components albeit there might be a price to pay.
