Patterns

In today’s organizations, a vast amount of existing software systems is insecure, which results in compromised valuable assets and has negative consequences on the organizations. Throughout the years, many attempts have been made to build secure software systems, but the solutions proposed were limited to a few add-on fixes made after implementation and installation of the system.The contribution of the research in this thesis is a software security engineering methodology, called Controlled Security Engineering Process, which provides support to developers when developing more secure software systems by integrating software lifecycle and security lifecycle, and enhancing the control in the engineering process. The proposed methodology implements security in every phase of general software system engineering, i.e., requirement, design, implementation, and testing, as well as operation and maintenance to certify that software systems are built with security in mind.The Controlled Security Engineering Process methodology addresses security problems in the development lifecycle. Construction of a secure software system involves specific steps and activities, which include security requirements specifications of system behavior, secure software design, an analysis of the design, implementation, with secure coding and integration, and operating and maintenance procedures.The methodology incorporates software security patterns and control of the engineering process. The software security patterns can be used as security controls and information sources to demonstrate how a specific security task should be performed or a specific security problem solved. Many patterns can be implemented in an automated way, which can facilitate the work of software engineers.The control of the engineering process provides visibility over the development process. The control assures that authorised developers access legitimate and necessary information and projects’ documents by using authentication, and authorization.To support implementation of automated patterns and provide control over the engineering process, a design of a multi-agent system is provided. The multi-agent system supports implementation of patterns and extracting security information, and provides traceability in the engineering process. The security information is requirements, threats and security mechanisms that are provided by matching project documents, and traceability is achieved by monitoring and logging services.The Controlled Security Engineering Process methodology has been evaluated through interviews with developers, security professionals, and decision makers in different types of organizations but also through a case study which was carried out in an organization.

There is no empirical evidence whatsoever to support most of the beliefs on which software construction is based. We do not yet know the adequacy, limits, qualities, costs and risks of the technologies used to develop software. Experimentation helps to check and convert beliefs and opinions into facts. This research is concerned with the replication area. Replication is a key component for gathering empirical evidence on software development that can be used in industry to build better software more efficiently. Replication has not been an easy thing to do in software engineering (SE) because the experimental paradigm applied to software development is still immature. Nowadays, a replication is executed mostly using a traditional replication package. But traditional replication packages do not appear, for some reason, to have been as effective as expected for transferring information among researchers in SE experimentation. The trouble spot appears to be the replication setup, caused by version management problems with materials, instruments, documents, etc. This has proved to be an obstacle to obtaining enough details about the experiment to be able to reproduce it as exactly as possible. We address the problem of information exchange among experimenters by developing a schema to characterize replications. We will adapt configuration management and product line ideas to support the experimentation process. This will enable researchers to make systematic decisions based on explicit knowledge rather than assumptions about replications. This research will output a replication support web environment. This environment will not only archive but also manage experimental materials flexibly enough to allow both similar and differentiated replications with massive experimental data storage. The platform should be accessible to several research groups working together on the same families of experiments.

The rapid development and expansion of network based applications have changed the computing world in the last decade. However, this overwhelming success has an Achilles’ heel: almost every software controlled system faces threats from potential adversaries both from internal and external users of the highly connected computing systems. These software systems must be engineered with reliable protection mechanisms, while still delivering the expected value of the software to their customers within the budgeted time and cost. The principal obstacle in achieving the above two different but interdependent objectives is that current software engineering processes do notprovide enough support for the software developers to achieve security goals. In this chapter, we reemphasize the principal objectives of both software engineering and security engineering, and strive to identify the major steps of a software security engineering process that will be useful for building secure software systems. Both software engineering and security engineering are ever evolving disciplines, and software security engineering is still in its infancy. This chapter proposes a unification of the process models of software engineering and security engineering in order to improve the steps of the software life cycle that would better address the underlying objectives of both engineering processes. This unification will facilitate the incorporation of the advancement of the features of one engineering process into the other. The chapter also provides a brief overview and survey of the current state of the art of software engineering and security engineering with respect to computer systems.

work of W. Edwards Deming has convinced industry that must first measure quality and then emphasise process to improve quality. In response to Deming's arguments and in light of perception that software industry is unable to produce quality products on schedule, and within budget, more software development organisations are now emphasising process measurement, monitoring, and assessment. This paper describes what is meant by software process and discusses an approach for its measurement and improvement. INTRODUCTION Unreliable software makes big news, from emergency services disasters to social security payment blunders. Improved software quality is essential to ensure reliable products and services, and gain customer satisfaction. While software development has existed for more than four decades, we failed so far to make as an industry and as an engineering discipline rather than craft. Developing reliable and usable software that is delivered on and within budget still represents difficult endeavour for many organisations. As role of software becomes increasingly critical for businesses as well as for human lives, problems caused by software products that are late, over budget, or that do not work, become magnified. If lives are lost or people inconvenienced due to incapable computer software, news media is there to make big stories. Organisations are realising that their fundamental problems is immaturity of their software process. Robert Lai (1993) proposes that process improvement is second maturity wave of software industry. He states that the first wave of software was developed using waterfall model in 1970's. Today we are Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 216 Software Management in midst of second wave maturity movement as we attempt to formally define development process and best ways to continuously improve it (Lai 1993). Taking lead in this area has been Watts Humphrey (Humphrey 1989, 1990, 1991), and Software Engineering Institute (SEI) at Carnegie Mellon University. SEI started in 1986 to develop process maturity framework to help organisations appraise maturity of their software process, and to provide guidance for organisations to improve their software process capability. A brief description of framework was released in September 1987, including maturity questionnaire. SEI evolved model and questionnaire into 5 -Level Capability Maturity Model (CMM) in 1991. In February 1993, released CMM version 1.1 (Paulk et al 1993). This paper discusses software process and describes capability maturity model (CMM). It also shows how CMM can be used as basis to measure maturity of software process of an organisation and plan its improvement. SOFTWARE QUALITY AND PROCESS IMPROVEMENT In his book Quality is Free Phil Crosby states that: Quality is free. It is not gift, is free. What cost money are unqualify of things all actions that involve not doing jobs right first time (Crosby 1980). If such statement is true for many disciplines, is particularly true for evidence is abundant in number of software products which exceeded their budget, were produced late, failed to satisfy user requirements, and are full of bugs. demand for improved software quality is increasing to ensure reliable products and services. benefits of improved quality comes in form of reduction in failure costs. For software projects failure costs include (DTI 1992): • costs of correcting defects, both before and after delivery • overruns against and budget • unnecessary high maintenance costs • indirect costs which users incur due to poor quality software link between process maturity and software quality is expressed in premise that The quality of software system is governed by quality of process used to develop and maintain it. One stumbling block to improving software quality seems to be that not enough attention is paid to overall development process itself. While software professionals typically devote their to developing, testing or documenting software products, no one has prime responsibility for improving software process. Experience has shown that if Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 Managing Systems 217 no one is working on software process, orderly improvement is unlikely. process certainly won't improve itself, rather, most likely, will deteriorate over time. Continuous improvement can occur only if process infrastructure is in place. Watts Humphrey argues in an early article published in Datamation, April 1989 that: Without work on process, there will be little or no progress in improving software. THE SOFTWARE PROCESS Adopting process view of software development represents revolutionary change in perspective. A process orientation to software development involves elements of structure, focus, measurement, ownership, skills, and supporting technology. In this section we investigate what is meant by software process. What Is Software Process According to Webster's dictionary, process is a system of operations in producing something .. series of actions, changes, or functions that achieve an end result. Chambers Concise Dictionary defines process as a series of actions or events .. sequence of operations or changes undergone. IEEE defines process as a sequence of steps performed for given purpose. In general business context, process is defined as a structured, measured set of activities designed to produce specified output for particular customer or market (Davenport 1993). These definitions put strong emphasis on HOW work is done, in contrast to product focus's emphasis on WHAT. Accordingly, process can be considered as a specific ordering of work activities across and place, with beginning, an end, and clearly identified inputs and outputs: structure for action. In this paper we will adopt following definitions quoted in (Humphrey 1990, Paulk et al 1993) are intended to encompass software throughout its life, which covers new development, enhancement, and repair. software process is The set of activities, methods, and practices used in production and evolution of software. software engineering process is The total set of software engineering activities needed to transform user's requirements into software. Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 218 Software Management People and Software Process Software development is still people-intensive activity. Talented people are most important element in any software organisation. Even if you get best people available, if they do not follow common process, if everyone wrote in different programming languages, used different conventions, or didn't co-ordinate their design and code changes with their peers, results will be chaos. Successful software organisations have learned that even best professionals need structured and disciplined environment in which to do cooperative work. Software organisations that do not establish such disciplines condemn their people to endless hours of repetitively solving technically trivial problems. obvious fact is that attracting best people is vital, but is also essential to support them with an effectively managed software process. Technology and Software Process Another myth is widespread belief that some technologically advanced tool or method will provide magic answer to software crisis. This is not only wrong, but is dangerous. Organisations which jumped on bandwagon of CASE tools, and ended up in failure and wasted and effort have learned their lesson hard way. Just ask yourself before introducing technology: What do I want to automate? In absence of defined, practised, and managed process, introducing automation can lead to increased chaos. There are several factors which limit effective use of software technology: an illdefined process, inconsistent process implementation, and poor process management. Software technology cannot be fully effective until these problems have been properly addressed. Need for Defined Process If no effort is made to define and enhance software development process across whole organisation, each software development project latches on to its own tools, methods, and practices with little guidance available on how to use them. This ad hoc approach will not be sufficient to tackle task of developing complex software systems. goal of software process management is to enable organisations to produce software that meets cost, schedules, and quality objectives. principles are same that underpins statistical process control-principles that have been successfully used in controlling scientific experiments and in high -volume manufacturing operations. Statistical concepts have been found to be just as applicable to software development as they are to production of manufactured goods such as motor cars. Applying such concepts will only be possible if there is defined and managed process. Software Process Models Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517

A major application area of information systems technology and multimedia content management is that of support systems for engineering processes. This includes the particularly important area of software engineering. Effective support of software engineering processes requires large amounts of content (texts, diagrams, code, data, executables etc.) from different conceptual domains. The term “software crisis” disappeared gradually when content modelling and management addressed domains from application analysis and system design in addition to the sheer computational code domain.In this paper we introduce an innovative conceptual content model and apply it in support of software engineering processes and their artefacts. We base our approach on the core model of the computational domain which abstracts computational content (bodies of function code) by the computational concept of signatures (lists of typed function parameters). We generalise this functional abstraction model beyond the computational domain by introducing the notion of asset abstraction which models entities domain-independently by general content-concept pairs. We introduce an asset language and discuss the essentials of an asset system implementation.In the application part of the paper we argue that software engineering can be substantially simplified by modelling SE entities from all the domains involved in an SE process homogeneously in an asset-oriented approach—entities ranging from application domains over intermediate architectural and design domains down to the computational domain. Furthermore, we discuss how the mappings between such domains can be substantially supported by services based on asset-oriented information systems.KeywordsContent ManagementAsset ClassConceptual ContentMediation ModuleInformation System TechnologyThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A typical software engineering course consists of a series of lectures along with a small associated class project. Although this may seem like a logical approach, practical, didactic, and timing reasons necessarily lead to a lack of an in-depth treatment of the critical issues involved in the overall process of software engineering. This paper introduces and lays out our plans for constructing SimSE, a graphical, interactive, educational software engineering simulation environment that teaches the software process in a practical manner without the constraints of an actual class project. We anticipate that the use of SimSE will enable students to form a practical understanding of the software process by allowing its users to explore different approaches to managing the software process and giving them insight into the complex cause and effect relationships underlying the process.

In order to develop reliable software and systems, we depend on practical techniques for the construction and analysis of such software and systems. This special issue of Software Tools for Technology Transfer presents various tool-supported techniques that can help with the construction and analysis of such reliable software and systems. The papers in this special issue are extended versions of selected conference papers from the proceedings of the 24th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2018).

In this paper we introduce MuiCSer, a conceptual process framework for Multi-disciplinary User-centred Software Engineering (UCSE) processes. UCSE processes strive for the combination of basic principles and practices from software engineering and user-centred design approaches in order to increase the overall user experience with the resulting product. The MuiCSer framework aims to provide a common understanding of important components and associated activities of UCSE processes. As such, the conceptual framework acts as a frame of reference for future research regarding various aspects and concepts related to this kind of processes, including models, development artefacts and tools. We present the MuiCSer process framework and illustrate its instantiation in customized processes for the (re)design of a system. The conceptual framework has been helpful to investigate the role of members of a multi-disciplinary team when realizing artefacts in a model-based approach. In particular process coverage of existing artefact transformation tools has been studied.

Usability is integral to software quality. Software developers increasingly acknowledge the importance of user-centered, Web site development. The value of usability engineering and the role of the usability engineer (UE) are less understood. A common assumption is that the UE’s role is only to be a user advocate. To this role, we add the responsibility of addressing concerns of other stakeholders in Web site design and development. We discuss usability engineering and the processes that it encompasses, such as project planning, requirements definition, user-centered design (UCD) and evaluation/testing within the context of traditional software engineering lifecycles. We define the UE’s role throughout a user-centered, Web site development lifecycle. This lifecycle integrates compatible usability engineering processes into software engineering processes, drawing examples from research and experience.

With the rapid development of science and technology, database programming technology has become more mature and perfect, and it has been widely used in the field of computer software engineering, laying a good foundation for the development of computer software engineering and the whole society. Based on this, this paper briefly introduces the database file generation process in computer software engineering, and then summarizes the database programming technology in computer software engineering. Based on this, it analyzes the importance of database programming technology in computer software engineering, discusses the application points of database programming technology in computer software engineering, and provides support for better application of database programming technology.

Network teaching is to use computer equipment and Internet technology in the virtual space, through a certain method to implement the teaching method on the network, the perfection of the network teaching system can directly replace the traditional teaching method in the whole process of teaching. In order to solve the problem of system development, this paper carries out the demand analysis. First, the use of data flow graph technology, depicting information flow and data from the input to the output of the process of transformation; and then, the use of data dictionary technology, defining the relevant elements of the data flow diagram; finally, the use of tree structure diagram is represented by the administrator subsystem, teacher subsystem and student subsystem structure of the system. The requirement analysis system design the bridge of analysis and software, has laid a foundation for the system development.

Due to the high complexity and numerous abstract processes in the subject Software Engineering (SWE), both, challenges in teaching and in learning arise. The teaching of Software Engineering is attempted by a new didactic approach to convey a deeper understanding of the complexity and the processes of Software Engineering in the context of the course. The approach complements the classical ex-cathedra lecture with a seminar and a project phase, whereby the direct application of theoretical knowledge is achieved in real-world situations. In addition to the consolidation of factual knowledge, transferable skills, such as presentation, communication and teamwork skills, can be encouraged. The approach focuses on self-studying as well as collaborative learning. The knowledge gained from team working is multiplied by the Wiki and spread over the whole semester.

It is often observed that software engineering (SE) processes and practices for computational science and engineering (CSE) lag behind other SE areas [7]. This issue has been a concern for funding agencies, since new research increasingly relies upon and produces computational tools. At the same time, CSE research organizations find it difficult to prescribe formal SE practices for funded projects.Theoretical and experimental science rely heavily on independent verification of results as part of the scientific process. Computational science should have the same regard for independent verification but it does not.In this paper, we present an argument for using reproducibility and independent verification requirements as a driver to improve SE processes and practices. We describe existing efforts that support our argument, how these requirements can impact SE, challenges we face, and new opportunities for using reproducibility requirements as a driver for higher quality CSE software.

A software engineering curriculum must provide the student with: a strong mathematical and theoretical base; problem solving and analysis skills; written and oral communication skills; knowledge of and experience in software engineering principles, processes, and products; knowledge of and experience in measurement, analysis, and control of software processes and products; and an understanding of applicable societal and ethical issues. To effectively address the needs of industry, software engineering education must include experience of applying software engineering principles to nontrivial problems. Here, the author describes how, in an environment of rapidly changing technology and limited educational budgets, delivering a sufficiently robust software engineering educational experience is a challenge.

Due to the unceasing growth of web sites and applications, developers and evaluators have interesting challenges not only from the development but also from the quality assurance point of view. The quality assurance was and is one of the challenging processes in software engineering as well as for the web engineering, as a new discipline. Although there exist many design guidelines, and metrics for the evaluation of web sites and applications, most of them lack a well-defined specification framework and even worse a strategy for consultation and reuse. The main theme of the research paper is to provide optimization techniques to improve the correctness of the website.