Retrofitting Security into a Web-Based Information System
  This paper reports on an incremental method that allows adding security mechanisms to an existing, but insecure system, such as a prototype or a legacy system. The incremental method is presented and as a showcase its application is demonstrated at the example of a Web-based information system. 
David Bettencourt da Cruz, Bernhard Rumpe, Guido Wimmel
cs.SE