This paper presents a modeling language that can be used in place of four existing modeling languages: attack trees, vulnerability cause graphs, security activity graphs, and security goal indicator trees.

This article describes the modeling of such security-goal-based trees as part of requirements engineering. After the probands of our industry partner received training on existing security models, the necessary knowledge for creating security models was collected and applied. This resulted in three context-specific SGITs discussed in this article.

The purpose of this paper is to give an overview of some of the current approaches to graphical security modeling and present an initial study related to benefits of tool support.Our working hypothesis is that specialized security modeling tools will substantially outperform more general, prevailing tools, and we have sought indications of evidence for this claim.

The paper presents a review on the existing methods and approach about the modelling and the detection of vulnerabilities.

This paper describes a process for estimating relative costs of security activities, and based on security activity graphs, selecting the optimal set of activities that addresses a particular security problem.

The paper mainly presents results from another EU project (MPOWER) but also introduces the SHIELDS repository as an example on how reusable security requirements can be shared between development projects, and how repository content (in this case requirements).

Introduction of Guided Checklists (GC) that support inspectors to find defects violating security goals, description of the elements of GC, how GC are developed and how GC are applied.

Presentation of a passive security testing approach for SOA and Web Services.

Introduction to a new model that features positive and negative indicators, allowing for efficient inspection of security goal achievement throughout the Software Development Lifecycle.

Presentation of techniques that allow integrating timed security rules described in the Nomad language, within a formal specification of the system.

This paper describes how the S3P process, which is based on the use of vulnerability cause graphs and security activity graphs, can be used in conjunction with the OpenUP/Basic development process.

This paper contains the rationale behind the design of the S3P software process improvement process.

This paper describes the vulnerability cause graph formalism, and its application to the S3P software process improvement process.