A process for mastering security evolution in the development lifecycle

Continuous system evolution makes it challenging to keep software systems permanently secure as changes either in the system itself or its environment may cause new threats and vulnerabilities. Therefore, suitable activities aligned with the software development process are required to master security evolution. This introduction to the special section on eternal security evolution presents a process for handling security evolution throughout the software development lifecycle and uses this process to position the individual contributions. We first present the underlying security development process comprising the phases initialization, security analysis, security design, security implementation, security testing, and security deployment. On this basis, we define the security evolution process comprising the activities security requirements review, adaptation of design models, code fixing and patch development, regression testing as well as re-deployment. Finally, the defined security evolution activities are discussed in context of the four articles on eternal security evolution presented in this special section of the International Journal on Software Tools for Technology Transfer.