Model-driven Secure Development Lifecycle

Building security into software development lifecycles and doing it right is hard. To address the challenge, several prominent organizations have published process-oriented security guidelines to bring security activities into a structured way. Although these eorts contribute to measurable improvements in software and system security, they are often too verbose and fuzzy to be implementable in a development lifecycle involving people (e.g., security experts, developers, and managers) with dierent skillsets. In this paper, we propose the model-driven secure development lifecycle (MD-SDL), an approach that leverages on modeling methods and the advances in model-driven security to simplify the process of eciently integrating security into development lifecycles for the development of securitycritical software and systems.