Using Multi-Level Security Annotations to Improve Software Assurance

Current annotation technologies suffer from poor coverage over the development process phases, limited support for the broad scope of the security requirement types and inadequate interconnection between different process phases. In this paper, we introduce the concept of multi-level security annotation for software artifacts, which addresses these problems. Multi-level security annotations are traceable trough the development phases to provide a light-weight, user-friendly alternative to full-fledged assurance methodologies and simplify the system evolution over time with respect to security.