CLIAMS:We claim:

1. A method for performing security audit for an executable code, the method comprising:
receiving, by a hardware processor, the executable code along with a plurality of life-cycle artifacts associated with the executable code;
performing a security assessment on the executable code and the plurality of life-cycle artifacts associated with the executable code to identify one or more potential security issues associated with the executable code;
determining a first set of questions based on the identified one or more security issues associated with the executable code;
determining a second set of questions based on a requirements specification associated with the executable code; and
performing a security audit session with one or more audit participants based on the first set of questions and the second set of questions.

2. The method of claim 1, wherein performing the security assessment on the executable code and the plurality of life-cycle artifacts comprises performing one or more of a security requirements analysis, threat modeling, security unit testing, penetration testing, and/or user acceptance testing on the executable code and the plurality of life-cycle artifacts associated with the executable code.

3. The method of claim 1, wherein determining the first set of questions based on the identified one or more security issues associated with the software executable file comprises:
correlating each of the one or more identified potential security issues with one or more questions from a plurality of stored questions; and
aggregating, for each of the one or more identified potential security issues, the correlated one or more questions to form the first set of questions.

4. The method of claim 1, wherein performing a security audit session with one or more audit participants based on the first set of questions and the second set of questions further comprises:
selecting randomly, one or more sets of questions from the first set of questions and one or more sets of questions from the second set of questions;
providing a randomly selected set of questions from the first set of questions and a randomly selected set of questions from the second set of questions to each of the one or more audit participants; and
receiving an answer associated with each of the provided questions from each of the one or more audit participants.

5. The method of claim 4, further comprising generating a security compliance report, wherein generating the security compliance report comprises:
determining, for each of the identified one or more potential security issues, a number of correct answers associated with the one or more questions correlated to the potential security issue;
comparing, for each of the one or more identified potential security issues, the number of correct answers with a predetermined threshold;
determining, for each of the one or more identified potential security issues, an extent of security violation based on the comparison and
indicating, for each of the one or more identified potential security issues, the determined extent of security violation.

6. The method of claim 5, further comprising categorizing the one or more potential security issues into high priority potential security issues and low priority security issues based on the security report.

7. A security audit apparatus for performing security audit for an executable code, the apparatus comprising:
at least one hardware processor; and
a memory comprising instructions executable by the at least one hardware processor, the instructions when executed, cause the at least one hardware processor to:
receive the executable code along with a plurality of life-cycle artifacts associated with the executable code;
perform a security assessment on the executable code and the plurality of life-cycle artifacts associated with the executable code to identify one or more potential security issues associated with the executable code;
determine a first set of questions based on the identified one or more security issues associated with the executable code;
determine a second set of questions based on a requirements specification associated with the executable code; and
performing a security audit session with one or more audit participants based on the first set of questions and the second set of questions.

8. The apparatus of claim 7, wherein the instructions further cause the at least one hardware processor to perform one or more of a security requirements analysis, threat modeling, security unit testing, penetration testing, and/or user acceptance testing on the executable code and the plurality of life-cycle artifacts associated with the executable code.

9. The apparatus of claim 7, the wherein the instructions further cause the at least one hardware processor to:
correlate each of the one or more identified potential security issues with one or more questions from a plurality of stored questions; and
aggregate, for each of the one or more identified potential security issues, the correlated one or more questions to form the first set of questions.

10. The apparatus of claim 7, wherein the instructions further cause the at least one hardware processor to:
select randomly, one or more sets of questions from the first set of questions and one or more sets of questions from the second set of questions;
provide a randomly selected set of questions from the first set of questions and a randomly selected set of questions from the second set of questions to each of the one or more audit participants; and
receive an answer associated with each of the provided questions from each of the one or more audit participants.

11. The apparatus of claim 10, wherein the instructions further cause the at least one hardware processor to:
determine, for each of the one or more identified potential security issues, a number of correct answers associated with the one or more questions correlated to the potential security issue;
compare, for each of the one or more identified potential security issues, the number of correct answers with a predetermined threshold;
determine, for each of the one or more identified potential security issues, an extent of security violation based on the comparison and
indicate, for each of the one or more identified potential security issues, the determined extent of security violation.

Dated this 21st day of August, 2014
Swetha S.N
Of K&S Partners
Agent for the Applicant
,TagSPECI:TECHNICAL FIELD
This disclosure relates generally to software security analysis, and more particularly to methods and systems for performing security audit for an executable code.