text: Software development needs continuous quality control for a timely detection and removal of quality problems. This includes frequent quality assessments, which need to be automated as far as possible to be feasible. One way of automation in assessing the security of software are application scanners that test an executing software for vulnerabilities. At present, common quality assessments do not integrate such scanners for giving an overall quality statement. This paper presents an integration of application scanners into a general quality assessment method based on explicit quality models and Bayesian nets. Its applicability and the detection capabilities of common scanners are investigated in a case study with two open-source web shops.
  @cite_23: Software quality models are a well-accepted means to support quality management of software systems. Over the last 30 years, a multitude of quality models have been proposed and applied with varying degrees of success. Despite successes and standardisation efforts, quality models are still being criticised, as their application in practice exhibits various problems. To some extent, this criticism is caused by an unclear definition of what quality models are and which purposes they serve. Beyond this, there is a lack of explicitly stated requirements for quality models with respect to their intended mode of application. To remedy this, this paper describes purposes and usage scenarios of quality models and, based on the literature and experiences from the authors, collects critique of existing models. From this, general requirements for quality models are derived. The requirements can be used to support the evaluation of existing quality models for a given context or to guide further quality model development.
  @cite_2: Early software systems communicated in predefined ways, so they were easy to secure. However, the old ways of ensuring software systems' security and reliability are inadequate on the Internet. Although building secure systems is difficult, retrofitting existing systems to introduce security is even harder. For example, sendmail, the most popular mail transfer agent, has been plagued with security vulnerabilities ever since the Morris worm first exploited it in 1988.
summary: There is a wide variety of quality models. @cite_23 differentiate between quality definition models and quality assessment models. The former is a specification of what constitutes quality in a software system, the latter describes how a software system's quality can be assessed according to specific rules. In the area of software security, security pattern collections are an example of quality definition models, e.g., @cite_2 .