Search

Technological advancement makes the world a global village. Security is an evergreen and everlasting area, because of the continuous threat from Hackers and Crackers. The immense use of software systems has modernized human society in every aspect. Thus, it is crucial to devise new processes, techniques, and tools to support teams in the development of secure code from the early stages of the software development process, while potentially reducing the costs and shortening the time to market. Considering the significance of software security, it is important to consider the security practices from the early phase of the software development life cycle (SDLC), that is, requirements engineering (RE). Hence, this study aims to identify and categorize RE practices important to apply for secure software development (SSD) in a geographically distributed development environment. To study the RE practices concerning SSD, we conducted a questionnaire survey with industrial experts in the global software development (GSD) context. Furthermore, the interpretive structure modeling (ISM) approach was applied to evaluate the relationship between the RE security practice core categories. This paper identifies 70 practices and classifies them into 11 fundamental dimensions (categories) to assist GSD organizations in specifying the requirements for SSD. The ISM results show that the "Awareness of Secure Requirement Engineering (SRE)" category has the most decisive influence on the other 10 core categories of the identified RE security practices. With the help of empirical evidence and the ISM approach, this work attempts to identify potential security practices and to give a set of secure RE practices that can be used to improve the security of the software development process. [ABSTRACT FROM AUTHOR]

Blockchain is considered as a major emerging technology that is having an ever‐increasing spread both in industrial and academic contexts. As the usage of blockchain keeps increasing, a fourth generation of blockchain platforms is being proposed. Thus, applications of blockchain have evolved towards wider scopes than cryptocurrency and asset management. In this context, it is important for practitioners to have deep understanding of various blockchain assessment initiatives. Therefore, this work discusses blockchain assessment initiatives from a technology evolution viewpoint. Furthermore, a mapping was conducted to identify factors that impact blockchain initiatives, synthesize available evidence, and identify gaps between relevant approaches available in the literature. As a result, nine selected works were analyzed based on applicability, research approach, assessment process, blockchain adoption process, and blockchain waves. The findings can help practitioners to understand the main assessment factors that undermine blockchain implementations. [ABSTRACT FROM AUTHOR]

Abstract: Evolvability of software lies in intersection of 3 factors: evolving system properties, human factors present in the developer team, and evolution demands. The paper presents 5 recommendations that enhance software evolvability: defined processes of software change, distinction between evolving and stabilized part of the code, analyzable code segments, significant concept encapsulation, and avoidance of wrapping. [ABSTRACT FROM AUTHOR]

Practically all information retrieval based approaches developed to date for automatic bug localization are based on the bag-of-words assumption that ignores any positional and ordering relationships between the terms in a query. In this paper, we argue that bug reports are ill-served by this assumption because such reports frequently contain various types of structural information whose terms must obey certain positional and ordering constraints. It therefore stands to reason that the quality of retrieval for bug localization would improve if these constraints could be taken into account when searching for the most relevant files. In this paper, we demonstrate that such is indeed the case. We show how the well-known Markov Random Field based retrieval framework can be used for taking into account the term-term proximity and ordering relationships in a query vis-à-vis the same relationships in the files of a source-code library to greatly improve the quality of retrieval of the most relevant source files. We have carried out our experimental evaluations on popular large software projects using over 4000 bug reports. The results we present demonstrate unequivocally that the new proposed approach is far superior to the widely used bag-of-words based approaches. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Digitalization is transforming industry to an extent that we have only seen the beginnings of. Across domains, companies experience rapid changes to their existing practices due to new technologies and new entrants that current businesses. While digitalization brings endless opportunities, it comes with challenges that require companies to strategically engage with partners in their surrounding ecosystems. In this paper, we study how companies in the embedded systems domain experience the process of transitioning from product‐based companies to businesses where software, data, and artificial intelligence (AI) play an increasingly important role. To manage this, these companies need to evolve their existing ecosystems while at the same time create new ecosystems around new technologies. This involves maintaining existing technologies such as mechanics and electronics while at the same time expanding these with software, data, and AI. We provide a strategic decision framework that helps software‐intensive embedded systems companies to successfully navigate the digital transformation. We do this in two steps. First, we present three models that provide the technical content of the strategic decision framework. Second, we provide an overview of the strategic alternatives that incumbents and new entrants have available when existing technologies are commoditizing and new technologies are introduced. [ABSTRACT FROM AUTHOR]

To perform requirements elicitation and analysis, effective communication and collaboration between stakeholders are necessary. Global Software Development (GSD), where software teams are located in different parts of the world, has become increasingly popular. However, geographical distance, cultural diversity, differences in time zones, and language barriers create difficulties for GSD stakeholders in engaging in effective communication. Taking into consideration the factors involved in GSD, previous research showed that the ways by which requirements are gathered and analyzed for collocated software development cannot be used effectively for GSD. Thus, in this paper, we present a method of requirements elicitation and analysis for GSD. The method consists of 4 stages: (1) data collection; (2) educating stakeholders about GSD issues; (3) post-education assessment; and (4) requirements elicitation and analysis. Past researchers used student groups in a university environment to play the roles of stakeholders in experiments in GSD studies. Likewise, we preliminarily validate our method by applying it to a case study of an online shopping system, where the roles of client, requirements engineer, project analyst, and designers were played by a group of students. [ABSTRACT FROM AUTHOR]

This paper analyzes developer-related factors that could influence the likelihood for a commit to induce a fix. Specifically, we focus on factors that could potentially hinder developers' ability to correctly understand the code components involved in the change to be committed as follows: (i) the coherence of the commit (i.e., how much it is focused on a specific topic); (ii) the experience level of the developer on the files involved in the commit; and (iii) the interfering changes performed by other developers on the files involved in past commits. The results of our study indicate that 'fix-inducing' commits (i.e., commits that induced a fix) are significantly less coherent than 'clean' commits (i.e., commits that did not induce a fix). Surprisingly, 'fix-inducing' commits are performed by more experienced developers; yet, those are the developers performing more complex changes in the system. Finally, 'fix-inducing' commits have a higher number of past interfering changes as compared with 'clean' commits. Our empirical study sheds light on previously unexplored factors and presents significant results that can be used to improve approaches for defect prediction. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Small and medium-sized enterprises (SMEs) involved in software development often experience problems in mastering their development processes. This can lead to time and cost overruns or failure to address functional and nonfunctional requirements. In general, this can significantly affect customer satisfaction and hamper business growth potential. This paper reports on a survey conducted in Belgium to assess more precisely which and how SMEs are affected by problems related to development processes. The survey was driven by the ISO29110 lightweight standard focusing on very small entities developing software, ie, whose internal IT department is less than 25 people. Worldwide, and in particular in Belgium, this represents a very large portion of SMEs in business. Survey results highlight the most frequent issues and how they may be linked to organization and project characteristics. The survey is based on a free online self-assessment tool. Therefore, results go 1 step further than identifying issues encountered in companies: the tool also infers a set of quick-win high-level recommendations to solve these issues. Our results are also compared with those reported by other surveys targeting both large and small companies. [ABSTRACT FROM AUTHOR]

Modern technologies and emerging wireless communication solutions in the Information and Communications Technology (ICT) world are empowering the spread of the most disparate ready‐to‐use software services distributed over the globe and accessed by an increasing number of users. This state of affairs encourages the development of systems based on the reuse of existing services through composition approaches, notably choreographies. Also Public Administrations are driven towards a digitalization process which exploits composition approaches to build complex and interoperable systems that can be remotely accessed by citizens and authorities. However, an automatic support is needed in order to realize the service composition and the distributed coordination logic that enforces the correct choreography realization. Moreover, the need for building dynamic and user‐centered systems calls for the realization of choreographies capable to adjust their behavior to the surrounding context. This work presents our proposal for addressing the choreography realization problem, by describing an automated process for the synthesis of choreography‐based systems. The synthesized systems are location‐aware and able to adapt the services' interaction according to the user's needs and context conditions. We show and evaluate our approach at work on a real use case scenario in the Public Administration domain. [ABSTRACT FROM AUTHOR]

It is well‐known that process improvement change requires “tools‐processes‐people.” Engineers have spent most energy on the tools and processes, but everything is done by people, and success depends on people and their competencies. The increasing focus on people is reflected in many change models; some are discussed in this paper. [ABSTRACT FROM AUTHOR]

The increasing flexibility in industry leads to an ecosystem of change, affecting the balance of processes and technology as well as the developers who have to cope with the change. Furthermore, the change itself might impact the ability to use quantitative methods to learn from previous experience. The goal of this study is to better understand the ecosystem of mutual impacts and changes of process and technologies as well as how developers perceive a technology setting and deal with its change. Therefore, we conducted a case study at Ericsson, performing a series of interviews among 6 employees (senior developers and architects). We identified a time line of changes that happened over 7 years. A set of observations about the relation between processes and tooling, and observations about developer's perceptions of the technology settings, and their strategy to deal with these changing technology settings. We discuss how the observed change impacts the ability to perform quantitative evaluations of technology and processes. The findings show that a bad choice of technologies can lead to unexpected impact on team dynamics. Furthermore, change happens so regular that it needs to be considered when collecting data for a quantitative evaluation of, eg, productivity. [ABSTRACT FROM AUTHOR]

Since the original development of program slicing in 1979 there have been many attempts to define a suitable semantics, which will precisely define the meaning of a slice. Particular issues include handling termination and nontermination, slicing nonterminating programs, and slicing nondeterministic programs. In this paper we review and critique the main attempts to construct a semantics for slicing and present a new operational semantics, which correctly handles slicing for nonterminating and nondeterministic programs. We also present a modified denotational semantics, which we prove to be equivalent to the operational semantics. This provides programmers with 2 different methods to prove the correctness of a slice or a slicing algorithm and means that the program transformation theory and FermaT transformation system, developed last 25 years of research, and which has proved so successful in analyzing terminating programs, can now be applied to nonterminating interactive programs. [ABSTRACT FROM AUTHOR]

Evolutionary coupling (EC) is defined as the implicit relationship between 2 or more software artifacts that are frequently changed together. Changing software is widely reported to be defect-prone. In this study, we investigate the effect of EC on the defect proneness of large industrial software systems and explain why the effects vary. We analysed 2 large industrial systems: a legacy financial system and a modern telecommunications system. We collected historical data for 7 years from 5 different software repositories containing 176 thousand files. We applied correlation and regression analysis to explore the relationship between EC and software defects, and we analysed defect types, size, and process metrics to explain different effects of EC on defects through correlation. Our results indicate that there is generally a positive correlation between EC and defects, but the correlation strength varies. Evolutionary coupling is less likely to have a relationship to software defects for parts of the software with fewer files and where fewer developers contributed. Evolutionary coupling measures showed higher correlation with some types of defects (based on root causes) such as code implementation and acceptance criteria. Although EC measures may be useful to explain defects, the explanatory power of such measures depends on defect types, size, and process metrics. [ABSTRACT FROM AUTHOR]

Knowledge and experience are not the only prerequisite for a successful project; a well-performing team using proper tools and techniques ensures efficient project management. Adequate tool is essential to support decision making in management of any organizational business units. TALAIA OpenPPM is an open-source solution for managing projects, programs, and portfolios. SM2, founder of TALAIA OpenPPM, after 4 years of experience of the tool implementation in companies from different sectors, came to a conclusion that the successful adoption of the tool is strongly affected with existing maturity level of the project management processes established in the organization. Also, this article derives lessons learned by SM2 in expansion and opening of a new business line in the international market. [ABSTRACT FROM AUTHOR]

No abstract is available for this article. [ABSTRACT FROM AUTHOR]

Cloud systems provide elastic execution environments of resources that link application and infrastructure/platform components, which are both exposed to uncertainties and change. Change appears in 2 forms: the evolution of architectural components under changing requirements and the adaptation of the infrastructure running applications. Cloud architecture continuity refers to the ability of a cloud system to change its architecture and maintain the validity of the goals that determine the architecture. Goal validity implies the satisfaction of goals in adapting or evolving systems. Architecture continuity aids technical sustainability, that is, the longevity of information, systems, and infrastructure and their adequate evolution with changing conditions. In a cloud setting that requires both steady alignment with technological evolution and availability, architecture continuity directly impacts economic sustainability. We investigate change models and change rules for managing change to support cloud architecture continuity. These models and rules define transformations of architectures to maintain system goals: Evolution is about unanticipated change of structural aspects of architectures, and adaptation is about anticipated change of architecture configurations. Both are driven by quality and cost, and both represent multidimensional decision problems under uncertainty. We have applied the models and rules for adaptation and evolution in research and industry consultancy projects. [ABSTRACT FROM AUTHOR]