  The openness of modern IT systems and their permanent change make it
challenging to keep these systems secure. A combination of regression and
security testing called security regression testing, which ensures that changes
made to a system do not harm its security, are therefore of high significance
and the interest in such approaches has steadily increased. In this article we
present a systematic classification of available security regression testing
approaches based on a solid study of background and related work to sketch
which parts of the research area seem to be well understood and evaluated, and
which ones require further research. For this purpose we extract approaches
relevant to security regression testing from computer science digital libraries
based on a rigorous search and selection strategy. Then, we provide a
classification of these according to security regression approach criteria:
abstraction level, security issue, regression testing techniques, and tool
support, as well as evaluation criteria, for instance evaluated system,
maturity of the system, and evaluation measures. From the resulting
classification we derive observations with regard to the abstraction level,
regression testing techniques, tool support as well as evaluation, and finally
identify several potential directions of future research.

Cryptography and Security;Software Engineering