Search

There is a need to identify requirements engineering (RE) practices that are important to global software development (GSD) project success. The objective of this paper is to report our recent empirical study results which aimed to identify the RE practices that are important to GSD projects. This study used an online survey questionnaire to elicit data from 56 RE experts of GSD projects. The survey included 66 RE practices identified by Sommerville et al. for non-GSD projects. The participants were asked to rank each RE practice on a four-point scale to determine the degree of importance of each practice in the context of GSD projects. This research identified a set of six key RE practices that mainly focuses on GSD project stakeholders, scope, standards and requirements traceability management. One common theme that is evident from the RE experts’ feedback analysis is the standardization of requirements documents to reduce requirements inconsistencies and improve communication in diverse and distributed GSD project environments Our results show that not all 66 RE best practices are important for GSD projects. We believe that a good understanding of the identified RE practices is vital in developing and implementing the situation-specific RE processes for GSD projects.

Security has become a vital factor for any Internet of things network but it is of paramount importance for Internet of Health Things (IoHT). IoHT also known as Internet of Medical Things (IoMT) is integration of IoT and healthcare environment, where fragile data related to the patients is transmitted from IoT devices to server. During this transmission, if, any eavesdropping or intrusion occurs then it will not only lead to the serious mutilation of entire network but this data will be handled maliciously for wrong doings as well. Therefore, a proper security is indispensable for IoHT based equipments due to exposure to different attacks. Security of IoHT has been the burning issue in last couple of years. In this regard different security models, surveys, frameworks have been presented. In this article, a proposed Identified Security Attributes (ISA) framework is presented to evaluate the security features of IoHT based device in healthcare environment. The proposed framework uses hybrid MCDM methods such as Analytical Hierarchical Process (AHP) and Technique for Order Preference by Similarity to Ideal Solution (TOPSIS). This framework works in two phase: in first phase the weights of attributes are derived by using AHP method and in second phase security assessment of alternatives is performed based upon security criteria by using TOPSIS method. The outcomes of proposed security assessment framework demonstrate that the reliable and secure alternative among alternatives is selected in IoMT system. This approach can be used as a guideline for future use in IoMT systems or any other IoT based domain. To the best of our knowledge, it is novel approach to address the security assessment of IoT and these MCDM methods have never been used before for assessment and decision making in IoHT system for security.

A sequence diagram is a modeling approach for visualizing the behavioral execution of a system. The objective of this research is to investigate the problem of security in a behavioral model (sequence diagram) through the application of model refactoring. We propose detection and correction techniques, empirical evaluation of the proposed techniques and assessment of security improvement in sequence diagrams. The detection of security bad smells is achieved through the adaptation of a genetic algorithm, while correction is accomplished by the model transformation approach. The results show significant detection recall and correction efficacy of the proposed detection and correction approaches, respectively. Our results show that the proposed approach is effective in detecting and correcting bad smells and can improve the security of UML Sequence Diagram.

Security is one of the most important software quality attributes. Software security is about designing and developing secure software that does not allow the integrity, confidentiality, and availability of its code, data, or service to be compromised. Organizations tend to consider security as an afterthought, and they continue to suffer from security risks. Developing secure software requires taking security into consideration in all phases of the Software Development Life Cycle (SDLC). Several approaches have been developed to improve software quality, such as Capability Maturity Model Integration (CMMI). However, software security issues have not been addressed in a proper manner and incorporating security practices into the SDLC remains a challenge. The objective of this paper is to develop a framework to improve the process of designing secure products in software development organizations. To achieve this objective, a Multivocal Literature Review (MLR) was conducted to identify the relevant studies in both the formal and grey literature. A total of 38 primary studies were identified, and available evidence was synthesized into 8 knowledge areas and 65 best practices to build a Secure Software Design Maturity Model (SSDMM). The framework was developed based on the structure of CMMI v2.0 and evaluated through case studies in real-world environments. The case study results indicate that SSDMM is useful in measuring the maturity level of an organization for the secure design phase of SDLC. SSDMM will assist organizations in evaluating and improving their software design security practices. It will also provide a foundation for researchers to develop new software security approaches.

The focus on secure software development has been growing steadily in all phases of the software development life cycle. Security awareness in the requirements engineering stage of software development is important in building secure software. One of the major issues faced by the software industry is that many organizations undertake secure software development initiatives without knowing whether they are ready to undertake them. Currently, there is no model to measure the readiness of security requirements engineering in an organization. The objective of this paper is to develop a security requirements engineering readiness model (SRERM) to enable organizations to assess their security requirements engineering (SRE) readiness levels. In order to achieve this goal, a systematic mapping study was conducted to identify the relevant studies in the SRE domain. A total of 104 primary studies were identified, and available evidence was synthesized into 12 security requirements categories and 76 best practices to build a SRERM. Initially, two case studies were conducted in order to evaluate the SRERM in a real-world environment. Based on the outcomes of the two case studies, some modifications were proposed to further improve the SRERM. After modifying the SRERM, two more case studies were conducted in order to evaluate the modifications made to the SRERM. The case study results indicate that the SRERM has the ability to identify the readiness levels of SRE in the software industry.

There is a significant need to give more careful consideration to the process and product quality assurance (PPQA) process area of the capability maturity model integration (CMMI) Level 2, especially in the context of smalland medium-sized software development organizations, to help such organizations achieve CMMI Level 2. The objective of this paper is to report the implementation of the PPQA process area for smalland medium-sized software development organizations in Saudi Arabia. An abstract-level model for each specific practice of the PPQA process area has been developed. In addition, an initial evaluation of the proposed models has been discussed. Data have been collected by exploring published research articles and high-level software process descriptions. Moreover, previous research works that dealt with the implementation of CMMI Level 2 process areas have been reviewed. Furthermore, research articles that provide guidance to software development organizations for implementing the process areas of CMMI Level 2 in their environments have been considered. The evaluation of the proposed models was also carried out using an expert panel review process and one case study. After careful analysis of the collected data, we have proposed a model for each specific practice in the PPQA process area. Each model is divided into core stages, and different activities associated with each stage are clearly indicated. Based on the evaluation, we are confident that our proposed models are clear, easy to use and learn, and can be applied to smalland medium-sized software development organizations in Saudi Arabia. In addition, the evaluation results show that the proposed models can help such organizations in implementing the PPQA process area according to the CMMI Level 2 maturity requirement.

There is a significant need to give careful consideration to Capability Maturity Model Integration (CMMI) Level 2 specific practices-SP 1.3 “manage requirements changes,”and SP 1.4 “maintain bidirectional traceability of requirements,”especially in the context of smalland medium-sized software development organizations in Saudi Arabia, in order to assist such organizations in getting one step closer to achieving CMMI Level 2 certification. The objective of this research is to implement CMMI Level 2 specific practices-SP 1.3 and SP 1.4. In this paper, a workflow model for each specific practice has been developed. In addition, initial evaluation of the models has been discussed. It is necessary to highlight that this paper contributes not only to the implementation of SP 1.3 and SP 1.4 of Requirements management process area in the context of smalland medium-sized software development organizations but also to the body of empirical studies in various context. Data has been collected by exploring published research articles and high-level software process descriptions. Moreover, previous research works that dealt with the implementation of CMMI Level 2 process areas have been reviewed. Furthermore, research articles that provide guidance to software development organizations for implementing process areas of CMMI Level 2 in their environments have been considered. After careful analysis of the collected data, we have proposed the models for two specific practices of CMMI level 2, i.e., managing requirements change and maintaining bidirectional traceability of requirements. Each model is divided into core stages, and different activities associated with each stage are clearly indicated. Initial evaluation of the proposed models was also conducted using the expert review process. Based on the initial evaluation, we are confident that our proposed models are clear and easy to learn, follow, and use. Moreover, our models are applicable to smalland medium-sized software development organizations in Saudi Arabia. The proposed models can also assist such organizations in implementing these two specific practices. For further evaluation, we need to perform multiple case studies in an industrial setting to test the proposed models.