Security Over the Information Systems Development Cycle

The rapid development and expansion of network based applications have changed the computing world in the last decade. However, this overwhelming success has an Achilles’ heel: almost every software controlled system faces threats from potential adversaries both from internal and external users of the highly connected computing systems. These software systems must be engineered with reliable protection mechanisms, while still delivering the expected value of the software to their customers within the budgeted time and cost. The principal obstacle in achieving the above two different but interdependent objectives is that current software engineering processes do notprovide enough support for the software developers to achieve security goals. In this chapter, we reemphasize the principal objectives of both software engineering and security engineering, and strive to identify the major steps of a software security engineering process that will be useful for building secure software systems. Both software engineering and security engineering are ever evolving disciplines, and software security engineering is still in its infancy. This chapter proposes a unification of the process models of software engineering and security engineering in order to improve the steps of the software life cycle that would better address the underlying objectives of both engineering processes. This unification will facilitate the incorporation of the advancement of the features of one engineering process into the other. The chapter also provides a brief overview and survey of the current state of the art of software engineering and security engineering with respect to computer systems.

It has been reported in the literature that about twenty new software vulnerabilities are reported weekly. This situation has increased the security awareness in the software community. Nowadays, software services are expected not only to satisfy functional requirements but also to resist malicious attacks. As demand for more trustworthy systems is increasing, the software industry is adjusting itself to security standards and practices by increasing security assessment and testing effort. Even though there is a consensus that better software engineering is to improve software quality in the early stage of software development, so far, various approaches that have been proposed to analyze and quantitatively measure the software security target, primarily show the finished software products in their operational life. There are few achievements on how to reduce or effectively mitigate the security risks faced by software products during the development process. In this chapter, the authors introduce a novel model-driven perspective on secure software engineering, which integrates seamlessly software security analysis with traditional software development activities. A systematic security engineering process that starts in the early stages of the software development process and spans the entire software lifecycle is presented. Fundamental software security concepts and analysis techniques are also introduced, and several illustrative examples are presented, with focus on security requirements and risk analysis.

These days, if you say that you are doing research in the area of computer security you instantly receive attention. Sadly, the same cannot be said of software engineering. But are the two areas really so different? Both seem to be concerned with issues that range from the finely technical to the broadly social and that force us to make difficult tradeoffs among cost, performance, quality, and usability. Both seem to require that we conduct our research in an interdisciplinary context. In the end we realize that fully solving the security problem for ever larger and more complex systems is as intractable as fully solving the traditional software engineering problem.In this talk I will attempt to relate the challenges of security engineering and software engineering, and will argue that security engineering is more of a software engineering problem than many people would like to admit.

work of W. Edwards Deming has convinced industry that must first measure quality and then emphasise process to improve quality. In response to Deming's arguments and in light of perception that software industry is unable to produce quality products on schedule, and within budget, more software development organisations are now emphasising process measurement, monitoring, and assessment. This paper describes what is meant by software process and discusses an approach for its measurement and improvement. INTRODUCTION Unreliable software makes big news, from emergency services disasters to social security payment blunders. Improved software quality is essential to ensure reliable products and services, and gain customer satisfaction. While software development has existed for more than four decades, we failed so far to make as an industry and as an engineering discipline rather than craft. Developing reliable and usable software that is delivered on and within budget still represents difficult endeavour for many organisations. As role of software becomes increasingly critical for businesses as well as for human lives, problems caused by software products that are late, over budget, or that do not work, become magnified. If lives are lost or people inconvenienced due to incapable computer software, news media is there to make big stories. Organisations are realising that their fundamental problems is immaturity of their software process. Robert Lai (1993) proposes that process improvement is second maturity wave of software industry. He states that the first wave of software was developed using waterfall model in 1970's. Today we are Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 216 Software Management in midst of second wave maturity movement as we attempt to formally define development process and best ways to continuously improve it (Lai 1993). Taking lead in this area has been Watts Humphrey (Humphrey 1989, 1990, 1991), and Software Engineering Institute (SEI) at Carnegie Mellon University. SEI started in 1986 to develop process maturity framework to help organisations appraise maturity of their software process, and to provide guidance for organisations to improve their software process capability. A brief description of framework was released in September 1987, including maturity questionnaire. SEI evolved model and questionnaire into 5 -Level Capability Maturity Model (CMM) in 1991. In February 1993, released CMM version 1.1 (Paulk et al 1993). This paper discusses software process and describes capability maturity model (CMM). It also shows how CMM can be used as basis to measure maturity of software process of an organisation and plan its improvement. SOFTWARE QUALITY AND PROCESS IMPROVEMENT In his book Quality is Free Phil Crosby states that: Quality is free. It is not gift, is free. What cost money are unqualify of things all actions that involve not doing jobs right first time (Crosby 1980). If such statement is true for many disciplines, is particularly true for evidence is abundant in number of software products which exceeded their budget, were produced late, failed to satisfy user requirements, and are full of bugs. demand for improved software quality is increasing to ensure reliable products and services. benefits of improved quality comes in form of reduction in failure costs. For software projects failure costs include (DTI 1992): • costs of correcting defects, both before and after delivery • overruns against and budget • unnecessary high maintenance costs • indirect costs which users incur due to poor quality software link between process maturity and software quality is expressed in premise that The quality of software system is governed by quality of process used to develop and maintain it. One stumbling block to improving software quality seems to be that not enough attention is paid to overall development process itself. While software professionals typically devote their to developing, testing or documenting software products, no one has prime responsibility for improving software process. Experience has shown that if Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 Managing Systems 217 no one is working on software process, orderly improvement is unlikely. process certainly won't improve itself, rather, most likely, will deteriorate over time. Continuous improvement can occur only if process infrastructure is in place. Watts Humphrey argues in an early article published in Datamation, April 1989 that: Without work on process, there will be little or no progress in improving software. THE SOFTWARE PROCESS Adopting process view of software development represents revolutionary change in perspective. A process orientation to software development involves elements of structure, focus, measurement, ownership, skills, and supporting technology. In this section we investigate what is meant by software process. What Is Software Process According to Webster's dictionary, process is a system of operations in producing something .. series of actions, changes, or functions that achieve an end result. Chambers Concise Dictionary defines process as a series of actions or events .. sequence of operations or changes undergone. IEEE defines process as a sequence of steps performed for given purpose. In general business context, process is defined as a structured, measured set of activities designed to produce specified output for particular customer or market (Davenport 1993). These definitions put strong emphasis on HOW work is done, in contrast to product focus's emphasis on WHAT. Accordingly, process can be considered as a specific ordering of work activities across and place, with beginning, an end, and clearly identified inputs and outputs: structure for action. In this paper we will adopt following definitions quoted in (Humphrey 1990, Paulk et al 1993) are intended to encompass software throughout its life, which covers new development, enhancement, and repair. software process is The set of activities, methods, and practices used in production and evolution of software. software engineering process is The total set of software engineering activities needed to transform user's requirements into software. Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517 218 Software Management People and Software Process Software development is still people-intensive activity. Talented people are most important element in any software organisation. Even if you get best people available, if they do not follow common process, if everyone wrote in different programming languages, used different conventions, or didn't co-ordinate their design and code changes with their peers, results will be chaos. Successful software organisations have learned that even best professionals need structured and disciplined environment in which to do cooperative work. Software organisations that do not establish such disciplines condemn their people to endless hours of repetitively solving technically trivial problems. obvious fact is that attracting best people is vital, but is also essential to support them with an effectively managed software process. Technology and Software Process Another myth is widespread belief that some technologically advanced tool or method will provide magic answer to software crisis. This is not only wrong, but is dangerous. Organisations which jumped on bandwagon of CASE tools, and ended up in failure and wasted and effort have learned their lesson hard way. Just ask yourself before introducing technology: What do I want to automate? In absence of defined, practised, and managed process, introducing automation can lead to increased chaos. There are several factors which limit effective use of software technology: an illdefined process, inconsistent process implementation, and poor process management. Software technology cannot be fully effective until these problems have been properly addressed. Need for Defined Process If no effort is made to define and enhance software development process across whole organisation, each software development project latches on to its own tools, methods, and practices with little guidance available on how to use them. This ad hoc approach will not be sufficient to tackle task of developing complex software systems. goal of software process management is to enable organisations to produce software that meets cost, schedules, and quality objectives. principles are same that underpins statistical process control-principles that have been successfully used in controlling scientific experiments and in high -volume manufacturing operations. Statistical concepts have been found to be just as applicable to software development as they are to production of manufactured goods such as motor cars. Applying such concepts will only be possible if there is defined and managed process. Software Process Models Transactions on Information and Communications Technologies vol 8, © 1994 WIT Press, www.witpress.com, ISSN 1743-3517

Welcome to the International Conference on Software and Systems Process (ICSSP) held in Zurich, Switzerland, on June 2nd and 3rd, 2012. Having grown from a Software Process Workshop in 2005 to the International Conference on Software Process (ICSP) in 2007, and finally to the International Conference on Software and Systems Process (ICSSP) in 2011, this conference series has established its place in the software engineering community as a respected conference focusing on research and practice related to software and systems development process. Software and software systems development use processes as one major means for achieving and ensuring the quality of the final product. This leads to specific challenges regarding software processes such as simplicity, adaptability, standard conformance, the coordination of multiple domains and lifecycles, etc. Processes from other domains (e.g., health care, manufacturing, business, aerospace, automotive systems, and others) face similar challenges. Yet, they share interesting similarities with and differences to software processes. The question is: How can we in the software domain learn from other domains to meet our software process engineering challenges? The ICSSP conferences hence connect the traditional software and systems process community with outside views and insights, broadening its scope of software development processes to system development and explicitly including processes of other domains such as health care, business, and manufacturing. By sharing process development theories and practices from such domains, ICSSP 2012 is investigating novel solutions to today's process challenges. Correspondingly, the main theme of ICSSP 2012 is Beyond Software and Software Systems Processes, signaling our goal of learning from domains other than the traditional software process community.

Software engineers have always been experimenting with various models in an endeavor to improve upon software processes. Recently, a new area of software process improvement through experience management has got attention of the software engineering community. Software developers are experimenting with experience management to improve software process. This chapter explores the role of experience management in mitigating the effects of software crisis and investigates the current state of EM in Indian software engineering environment. The chapter discusses the need and integration of knowledge and experience management practices in software engineering environments. The chapter begins with the discussion of the ills of software engineering, classically referred to as “software crisis,” like late delivery of the systems, ill-functionality, and cost overruns, and justifies how managing the knowledge and experience of software engineers and practitioners can ward off these evils. The chapter then discusses the models and methodologies for knowledge and experience management in software engineering. Finally, the chapter sheds light on the major works carried out in this area and suggests possible future research avenues in this domain.

Empathy, defined as the ability to understand and share others’ perspectives and emotions, is essential in software engineering (SE), where developers often collaborate with diverse stakeholders. It is also considered as a vital competency in many professional fields such as medicine, healthcare, nursing, animal science, education, marketing, and project management. Despite its importance, empathy remains under-researched in SE. To further explore this, we conducted a socio-technical grounded theory (STGT) study through in-depth semi-structured interviews with 22 software developers and stakeholders. Our study explored the role of empathy in SE and how SE activities and processes can be improved by considering empathy. Through applying the systematic steps of STGT data analysis and theory development, we developed a theory that explains the role of empathy in SE. Our theory details the contexts in which empathy arises, the conditions that shape it, the causes and consequences of its presence and absence. We also identified contingencies for enhancing empathy or overcoming barriers to its expression. Our findings provide practical implications for SE practitioners and researchers, offering a deeper understanding of how to effectively integrate empathy into SE processes.

Objectives . Agile methodologies are crucial in software engineering and information systems (IS) development. However, traditional training methods can struggle to convey abstract theoretical concepts effectively and may lead to reduced engagement. We propose that combining several learning methodologies and incorporating serious games and gamification strategies in training can offer a more innovative and engaging approach to improve comprehension. This article outlines a game-based learning strategy designed to instruct information systems students in agile development. Our approach is rooted in active learning principles, incorporating methodologies such as problem/project-based learning, microlearning, collaborative learning, and learning by doing. The course design unfolds in two phases. Initially, participants delve into short, serious games that vividly demonstrate theoretical concepts, followed by brief moments of theoretical exposition. In the subsequent phase, participants apply all the knowledge they have acquired through an extensive project. To illustrate and evaluate the overall process, this approach was implemented to teach Scrum in several training courses. Participants . The participants in this study were information technology and systems students at different academic levels. Study Method . The research model adopted in this work is based on the Design Science Research (DSR) method. Adhering to the DSR method, the study advanced through distinct phases: recognizing the challenge of engaging Agile Development education, formulating a solution with a course design that blends game-based learning and diverse learning methodologies, developing the course artifact, practically implementing it with Scrum with several groups in different contexts, and assessing its effectiveness using pre- and post-course quizzes. The course aimed to instruct participants in agile methods within information system development. Findings . Feedback from the courses was clearly positive, with participants expressing a preference for the proposed game-based approach over traditional expository lecture methods. Pre- and post-course knowledge quizzes revealed a noteworthy increase in correct answers and overall scores in the end. Conclusions . The novelty lies in an integrated approach that combines multiple active learning methodologies—such as game-based learning, microlearning, collaborative learning, project-based learning, and learning by doing—to facilitate the comprehension of theoretical concepts through practical application.

All approaches to information systems and software development assume lifecycle models, which have a significant impact upon the perspective adopted for design and development. In recognition of the limitations of conventional software engineering lifecycles, the Information Systems (IS) community has focused upon gaining recognition of organizational and human issues in systems design. The Human-Computer Interaction (HCI) community has also tried to introduce user-centered practices into software engineering, but its success has been limited because it has augmented existing lifecycle models that are document or risk-driven. Yet, user-centered design can only be fully realized through the adoption of a user-centered model of the information systems lifecycle as the basis for developing ICT-based systems. This paper explains how several of the limitations of current IS and HCI theory and practice can be overcome by modeling development lifecycles in terms of social transformation. The paper then presents an information systems development lifecycle based upon social transformation and illustrates how a user-centered software development lifecycle can be integrated into the IS development process.

Since today's enterprises must constantly adapt to rapidly changing external environment, it is necessary to be able to deal with variation and changing conditions in information systems (IS) development. This may be achieved by the use of multifractal IS development methodologies. Fractal approaches to some extent have already been tested in adaptive enterprise development, adaptive manufacturing systems development, and software development. This suggests that multifractal IS development, on the one hand, is appropriate, because the information system should properly reflect the business enterprise (in this case a fractal one) and, on the other hand, it is possible, because some elements of it have already been implemented. Development of multifractal IS aims at managing relative completeness by relative simplicity that has to be discovered in different subsystems that influence the development of the information system. This, in essence, implies the need of thorough analysis an understanding of business structures and processes to discover patterns useful for the identification of fractal features. Currently, only some guidelines for development of multifractal IS are derived from reported experiences of fractal systems development and the use of fractal approaches in other domains.

The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.

Building secure software systems requires the intersection between two engineering disciplines, software engineering and security engineering. There is a lack of a defined security mechanism for each of the software development phases, which affects the quality of the software system intensively. In this paper, the authors are proposing a framework to consider the security aspects in all the phases of the software development process from the requirements until the deployment of the software product, with three additional phases that are important to automatically produce a secure system. The framework is developed after analyzing the existing models for secure system development. The key elements of the framework are the addition of the phases like physical, training, and auditing, where they improve the level of security in software engineering projects. The authors found so a solution for the replacement of the knowledge of the security engineer through the construction of an intelligent knowledge-based system, which provides the software developer with the security rules needed in each phase of the software development lifecycle and it improves the awareness of the software developer about the security-related issues in each phase of the software development lifecycle. The framework and the expert system are tested on a variety of software projects, where a significant improvement of security in each phase of the software development process is achieved.

Software process is the most important part of software project management, and software process models are important means of implementing the software process in any software organization. When there is need to improve the software process, then the need to improve the work-task part (software process models) of the software process must arise. As, there is need of increasing the commitment of software project managers through out the software development life cycle (SDLC), so we need to give them the list of activities in Waterfall Model, which should be made efficient by the software development team, to get the 80% productivity (output) easily, by reducing the effort of software development and ultimately increasing the performance of the software process. So, the idea of 80/20 rule (Pareto Principle, 1935) can be applied in the software engineering process model, in this regard. The Pareto Principle (1935) directed us to focus on what is really important in any field and field's work. Software process is most important part of software project management (SPM). This is also then ultimately needed for software project management (SPM) improvement. Our main research work is to improve the work-task part of the software process (i.e. software process models by applying the Pareto Principle - 80/20 Rule (1935) (or law of vital few) (1935), in the software engineering process models (or work-task part of the software process). This will be to facilitate the software project manager, using the software process models practically more efficient than without application of 80/20 Rule in software engineering Waterfall model. This has resulted in the reduction of the software development effort and increase in the performance of the software process. The results (efficient and improved software process models) will be implemented in the software industry, by software project managers, by focusing on the list of activities giving 80 percent of the overall productivity of the software process. The results will be the list of activities having the capability to give 20 percent of the overall productivity of the software Waterfall process, to be ignored, eliminated or designated to reduce the effort.

The International Conference on Software and System Processes (ICSSP), continuing the success of Software Process Workshop (SPW), the Software Process Modeling and Simulation Workshop (ProSim) and the International Conference on Software Process (ICSP) conference series, has become the established premier event in the field of software and systems engineering processes. It provides a leading forum for the exchange of research outcomes and industrial best-practices in process development from software and systems disciplines. ICSSP 2018 was held in Gothenburg, Sweden, 26-27 May 2018, co-located with the 40th International Conference on Software Engineering (ICSE). The theme of ICSSP 2018 was studying \Demands on Processes, Processes on Demand" by recognizing the demands on processes that include the need for both welldeveloped plans and incremental deliveries (agile and hybrid processes), utilization of increased automation (model-based engineering and DevOps), higher degrees of customer collaboration, comprehensive analysis of existing products for reuse (open source and COTS), and performance requirements of enterprise-level architectures. Papers presented at ICSSP discussed these issues across different domains, providing concepts, evidence, and experiences.

Background: Systematic literature reviews (SLRs) have become an established methodology in software engineering (SE) research however they can be very time consuming and error prone. Aim: The aims of this study are to identify and classify tools that can help to automate part or all of the SLR process within the SE domain. Method: A mapping study was performed using an automated search strategy plus snowballing to locate relevant papers. A set of known papers was used to validate the search string. Results: 14 papers were accepted into the final set. Eight presented text mining tools and six discussed the use of visualisation techniques. The stage most commonly targeted was study selection. Only two papers reported an independent evaluation of the tool presented. The majority were evaluated through small experiments and examples of their use. Conclusions: A variety of tools are available to support the SLR process although many are in the early stages of development and usage.