Security testing for software applications

A computer-implemented method for executing instructions stored on a computer readable storage medium, the method comprising:

• determining an attack model enumerating software attacks, the software attacks being represented by linked attack components;
• determining a software architecture to be tested, the software architecture being represented by linked architectural components in an architecture diagram;
• associating each attack component and each architectural component with at least one attack tag characterizing attack requirements;
• determining an attack test model, including associating attack components with corresponding architectural components, based on associated attack tags;
• and
• generating attack test workflows from the attack test model, to thereby test the software architecture.

A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable storage medium and comprising instructions that, when executed, are configured to:

• determine an attack model enumerating software attacks, the software attacks being represented by linked attack components;
• determine a software architecture to be tested, the software architecture being represented by linked architectural components in an architecture diagram;
• associate each attack component and each architectural component with at least one attack tag characterizing attack requirements;
• determine an attack test model, including associating attack components with corresponding architectural components, based on associated attack tags;
• and
• generate attack test workflows from the attack test model, to thereby test the software architecture.