A qualitative evaluation of model-based security activities for software development

Most of the reoccurring types of security problems can be solved by known mitigations in most software products, preferably as early as possible during development. Representing mitigation knowledge in form of reusable security models will help developers in improving software security and learning from past mistakes. This paper explains six model-based security activities that can be integrated with most existing development processes, along with the methods and results of a qualitative evaluation involving software developers from the industry . The evaluation includes semi-structured interviews and questionnaires based on the Technology Acceptance Model (TAM).