Awareness of Secure Coding Guidelines in the Industry - A First Data Analysis

There is a long-standing challenge to narrow the gap between software engineering research and industry practice, to align their interests and realize true synergies between the two communities. Some difficulties to this challenge include mismatched agendas, priorities and expectations from the research collaboration on both sides. To overcome these difficulties, an initial step is to gain a clearer understanding of collaboration challenges from both perspectives. With this goal in mind, we organized the 5th International Workshop on Software Engineering Research and Industrial Practice, collocated with the International Conference on Software Engineering 2018. The workshop featured two keynote talks, one from industry and one from academia, followed by paper presentations and a round-table discussion session. Here we summarize experiences shared by the keynotes from industry and academia, along with findings from paper presentations and overall discussions by workshop participants on the ways of aligning software engineering research and industry practice.

The complexity management of software code has become one of the major problems in software development industry. With growing complexity the maintenance effort of code increases. Moreover, various aspects of complexity create difficulties for complexity assessment. The objective of this paper is to investigate the relationships of various aspects of code complexity and propose a method for identifying the most complex functions. We have conducted an action research project in two software development companies and complemented it with a study of three open source products. Four complexity metrics are measured, and their nature and mutual influence are investigated. The results and possible explanations are discussed with software engineers in industry. The results show that there are two distinguishable aspects of complexity of source code functions: Internal and outbound complexities. Those have an inverse relationship. Moreover, the product of them does not seem to be greater than a certain limit, regardless of software size. We present a method that permits identification of most complex functions considering the two aspects of complexities. The evaluation shows that the use of the method is effective in industry: It enables identification of 0.5% most complex functions out of thousands of functions for reengineering.

The prevalence of model-driven software engineering in industry combined with a personal interest in the topic led to the conception of a new course aimed at introducing students to topics related to modeling. This paper presents a retrospective examination of this course, including: a course overview, intra-student grade comparisons on topic-centered assessments, and student feedback regarding course topics and implementation. The paper provides sufficient detail of the course offering such that, if desired, readers could offer a course with similar goals, outcomes, and structure. Finally, specific lessons learned are presented in hopes of enabling future improvements to the course and as a warning to other academics should they begin to offer similar courses.

Software development is a fast-changing area. New methods and new technologies emerge all the time. As a result, the education of software engineering is generally considered not to be keeping pace with the development of software engineering in industry. Given the limited resources in academia, it is unrealistic to purchase all the latest software tools for classroom usage. In this chapter, the authors describe how free/open-source data and free/open-source tools are used in an upper-level software engineering class at Indiana University South Bend. Depending on different learning objectives, different free/open-source tools and free/open-source data are incorporated into different team projects. The approach has been applied for two semesters, where instructor’s experiences are assembled and analyzed. The study suggests (1) incorporating both free/open-source tools and free/open-source data in a software engineering course so that students can better understand both development methods and development processes and (2) updating software engineering course regularly in order to keep up with the advance of development tools and development methods in industry.

Software engineering is largely a communication-driven, team-oriented discipline. There are numerous hurdles for ensuring proper communication and interaction between all project stakeholders, including physical, technological, and cultural barriers. These obstructions not only affect software engineering in industry, but in academia as well. One possible issue that is often overlooked in software engineering education is how to best educate Deaf and hard-of-hearing (Deaf/HoH) students, and how to fully engage them in the classroom. In this paper, we present our experiences in teaching software engineering to Deaf/HoH students. In the classroom, these students work very closely in activities and on project teams with their hearing peers. We also present recommendations for creating a more robust software engineering educational experience for not only Deaf/HoH students, but for hearing students as well. We encourage instructors not only in software engineering programs, but in other computing disciplines to consider our recommendations and observations in order to enhance the educational experience for all students in the classroom, whether Deaf/HoH or hearing.

The growing enactment of Global Software Engineering in industry has triggered educational institutions to perceive the importance of preparing students for distributed software development. During the last twelve years we have disclosed advantages and pitfalls of GSE to our students through our Distributed Software Development course. After running the projects according to the iterative process model for eleven years, we decided to shift to an agile development model, SCRUM. This decision was due to the growing industrial adoption of agile methods, but more importantly to increase proactiveness, sense of responsibility, and to balance the workload among the project team members. In this paper we describe the process and outcomes of our first attempt at introducing SCRUM in our distributed course.

Trends that have contributed to the globalisation of the software engineering industry include virtual collaborative teams, off-shore outsourcing, and international migration of IT professionals. These three trends and the international spread of software engineering standards and methodologies are explored with specific examples from the Australian software engineering industry. Results from a Europe/Australia study about adoption of software best practice conducted in 16 countries are then summarised and analysed using Hofstede's cultural dimensions. The discussion considers the efficacy of the concept 'national culture' in light of the analysis and concludes that software engineering researchers need to reconsider the concept and measurement of national culture. Implications of the globalisation of software engineering standards and methodologies on various stakeholders are discussed.

This paper investigates the biological, psychological and societal reasoning for the disparity of females in the software engineering industry and how a more diverse workforce can have an advantage in this sector. Studies show that diversity in a company positively correlates to its financial profits. Furthermore, a severe lack of women in software engineering causes companies to limit themselves to smaller talent pools, decrease the creative outlook on fresh ideas and resolution of problems. There are superficially inherent reasons why computing appeals to men more than women, observations in multiple reports suggest that men may have a small advantage when it comes to mathematical and problem-solving skills. Additionally, it is elsewhere suggested that females interests reside in other fields related to ‘people’, whereas males are generally more interested in ‘things’. However, while societal factors and bias plays a role in the discouragement of women from the software engineering industry, studies have shown that countries with more gender-inegalitarian societies show an increase in the number of women in software engineering and STEM. This may imply that gender disparity in software engineering primarily emerges from personal choice rather than any discrimination or stereotyping.

Contributors

In the past decade, there have been a number of notable changes in industrial software engineering, including the movement towards agility. The Agile Manifesto characterizes the term “agile”, and lists a set of principles that form a basis for agile methodologies [1], such as Extreme Programming (XP), OpenUP, and Scrum. There is creation, communication, and consumption of knowledge during (agile) software development [2]. For the success of an agile project, it is crucial that such knowledge be managed effectively. In doing so, an appropriate selection and use of certain tools and technologies can be helpful. In the past few years, there has been a proliferation of Social Web Applications, such as Wiki [3]. Indeed, a number of noteworthy uses of Wiki in software engineering have been reported [4]. However, these studies are largely independent of any software development methodology, and are centered mostly on collaboration. The primary reasons for selecting Wiki for agile software development include the following: (1) the deployment of agile methodologies, especially XP and Scrum, with teams that are increasingly geographically-dispersed, (2) the involvement in sustainable software development by organizations with basic infrastructure and modest budgets for resources, and (3) the need of inexpensive, mature, and widely-available tools for supporting iterative development, by almost anybody, at anytime, anywhere, using almost any device. The purpose of this research is to provide a framework for integrating Wiki for the purpose of facilitating the dynamics of knowledge during agile software development.

This paper provides an analysis of embedded systems education using a didactic approach. Didactics is a field of educational studies mostly referring to research aimed at investigating what's unique with a particular subject and how this subject ought to be taught. From the analysis we conclude that embedded systems has a thematic identity and a functional legitimacy. This implies that the subject would benefit from being taught with an exemplifying selection and using an interactive communication, meaning that the education should move from teaching “something of everything” toward “everything of something.” The interactive communication aims at adapting the education toward the individual student, which is feasible if using educational methods inspired by project-organized and problem-based learning. This educational setting is also advantageous as it prepares the students for a future career as embedded system engineers. The conclusions drawn from the analysis correlate with our own experiences from education in mechatronics as well as with a recently published study of 21 companies in Sweden dealing with industrial software engineering.

We are delighted to welcome the Fourth International Conference on Communities and Technologies: Communities and Technologies 2009 (C&T 2009) to the College of Information Sciences and Technology (IST) of the Pennsylvania State University. In an increasingly networked world, the concept of community has taken on new meanings and inspired the development of a wide range of technologies aimed at forging connections, improving communication, and enabling coordination among groups of people. Concepts and tools such as community networks, virtual community, blogging, podcasting, social networking sites, and smart mobs have become commonplace, yet each represents a complex system of hardware, software, and people, shaped by perceptions, norms, rules, and habits, and occurring within varied social and cultural settings. It is clear that successful outcomes for information and communication technologies depend upon our understanding how these technologies interact with and can effectively support dynamic human communities. This is no small endeavor. The Communities and Technologies biennial international conference serves as a forum for stimulating and disseminating research on the complex connections between communities -- both physical and virtual -- and information and communication technologies. Researchers, designers, educators, and students from the many disciplines and perspectives bearing on the interaction between community and technology contribute to this conference. These areas include anthropology, art and architecture, business, cognitive science, communication studies, community informatics, computer science, design studies, education, ergonomics, geography, graphic design, human-computer interaction, information science, information systems, industrial engineering, interaction design, journalism, knowledge management, law, learning science, linguistics and semiotics, management, psychology, requirements engineering, sociology, software engineering, technical communication, and user experience design. The conference program for C&T 2009 includes competitively selected, peer-reviewed papers, as well as workshops, tutorials, a doctoral consortium, and invited speakers.

The purpose of this study is to clarify the mechanism of how software engineering capabilities relate to the business performance of IT vendors based on the continuous researches in 2005, 2006 and 2007. To end this, we developed a structural model, including the Software Engineering Excellence (SEE) indicator which consisted of deliverables, project management, quality assurance, process improvement, research and development, human resource development and customer contact. By analyzing the data collected from 100 major IT vendors in Japan in 2007, we reproducibly observed that the effort level on human resource development, quality assurance and project management made better performance of customer contact, research and development and process improvement of the IT vendors in Japan, as we found the similar tendency in 2006. However, the causal relationships differ significantly from the origins of the vendors, i.e., IT makers, IT users and independent vendors.

Software test management is a hot field of software engineering both in academia and industry. However, traditional research are focused on software quality rather than test quality which could be evaluated by test management. Meanwhile, previous works on evaluating software test management were mostly based on statistical methods. In recently years, machine learning algorithms and techniques are developing rapidly. Logistic Regression is one of the important and often used algorithms. It is widely used in many domains such as credit investigation, book classification and so on. Therefore, our objective is to establish a logistic regression based approach for software test management to evaluate test quality. In this paper, we introduce our methodology to build metrics framework for test management, and enumerate the definition, type and range of each metric. We also show some results of our experiments using some data samples from a huge data sets.

Student skipping content is common in traditional learning modules that present a large amount of content in a linear format. This can lead to lower student engagement, and may yield poor learning. In this paper, we compare student learning between enhanced learning modules (2.0) and traditional modules (1.0) aimed at providing knowledge on secure coding to students in lower-level programming courses. We discuss the results of a quasi-experiment across two sections of CS0. The study compares students' secure coding awareness, general software security awareness and students' ability to identify security vulnerabilities (integer overflow, input validation and buffer overflow) in three separate code segments. A total of 53 students participated in the study. While results indicate significant improvement in secure coding and general software security awareness in both 1.0 and 2.0 modules, students using 2.0 modules performed significantly better than students using 1.0 modules in applying secure coding knowledge by identifying security vulnerabilities in code segments.