  This paper reports on an incremental method that allows adding security
mechanisms to an existing, but insecure system, such as a prototype or a legacy
system. The incremental method is presented and as a showcase its application
is demonstrated at the example of a Web-based information system.
