Software security evaluation based on a top-down McCall-like approach

The authors present a methodology for software security evaluation and certification. A systematic approach has been used to build software security throughout the whole life cycle. This leads to using specific development and certification techniques according to the initial risk and vulnerability analysis. In the security certification process, it is of prime importance to measure the specific security nonfunctional attributes of software. The authors therefore propose a top-down approach for their definitions. This approach is compatible with the factor, criteria, and metrics approach of J.A. McCall et al. (1977), thus enabling a common approach with software quality assurance practices.