Search

Security is an essential attribute of high‐quality software. However, effectively incorporating security practices into different phases of the software development life cycle (SDLC) remains challenging. Owing to less mature secure testing processes, organizations are prone to ineffective testing practices for defect detection, including severe security‐related failures. Thus, in this study, we present a maturity model for secure software testing (MMSST) to assist software development organizations in improving the secure testing of software applications. We conducted a multivocal literature review and identified 68 primary studies from the formal and gray literature. Then, based on the available evidence, 27 process areas were identified to develop the proposed MMSST. The MMSST includes five main categories: governance, contrive and design, execution, deployment and configuration, and mature. The MMSST was subsequently evaluated using case studies related to practical environments. Results demonstrate that the proposed MMSST is useful for estimating the maturity level of an organization with respect to the secure testing phase of the SDLC. The participants of the case studies also agreed that the proposed MMSST is useful in terms of structure, user satisfaction, and ease of use. We believe that the proposed MMSST can help organizations evaluate and improve software security testing practices. In addition, the proposed MMSST is expected to provide researchers and industry practitioners with an effective foundation for developing new secure testing approaches and tools. [ABSTRACT FROM AUTHOR]

Functional size measures are used in several software development processes, because they can be applied as soon as the functional user requirements of a software application have been specified. Quite often, functional user requirements are used as the main input of effort and cost estimation. Since effort and cost estimates are fundamental for decision making, project managers would like to get reasonably accurate estimates even before user requirements have been specified completely and at the proper level of detail. To this end, early size estimation methods have been proposed. In this paper, we consider a specific situation; namely, we consider processes in which the requirements elicitation and modeling phases are carried out according to the ICONIX process. The ICONIX process involves a few stages, each one tackling an aspect of requirements and delivering a specific artifact, in the form of a UML model. We explore the possibility of deriving from ICONIX artifacts the information needed to estimate the final size of the application. To this end, we analyzed the requirements of 21 software applications and derived statistical models that correlate the information extracted from ICONIX artifacts to the size, expressed in function points, of the application. The analysis of the achieved estimates shows that the approach is viable, in that it provides early estimates with good accuracy. [ABSTRACT FROM AUTHOR]

A key problem during copy-paste source code reuse is that, to reuse even a small section of code from a program as opposed to an API, a programmer must include a huge amount of additional source code from elsewhere in the same program. This additional code is notoriously large and complex, and portions can only be identified at runtime. In this paper, we propose execution record/replay as a solution to this problem. We describe a novel reuse technique that allows programmers to reuse functions from a C or C++ program, by recording the execution of the program and selectively modifying how its functions are replayed. We have implemented our technique and evaluated it in an empirical study in which eight programmers used our tool to complete four tasks over four hours each. The participants found our technique to be easier than manually reusing the code as part of their project. We also found that the resulting code was smaller and less complex than it would have been had the participants manually reused the code. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Software companies encourage and further the use of collaborative tools and skills at the work place in pursuit of the benefits of their use: they improve communication, productivity and efficiency, and competitiveness. Besides, undergraduate and graduate software engineering computing curricula recommend subjects related to effective cooperative working and group learning. In order to align industry needs and curricula recommendations, universities should provide graduates with the collaborative knowledge and skills that will be required when they finish their degrees and join the labor market. In this scenario, we asked three questions: Are collaborative tools beneficial to software projects? Is it easier for graduates with knowledge and skills of collaborative tools to find a job? Do enterprises use collaborative tools as a marketing strategy for the recruitment process or are they really empowering their employees to use collaborative tools? We devised a survey which was administered to 86 recent computer science graduates. We applied statistical techniques to analyze the responses. We conclude that graduates skilled in the use of collaborative tools do find it easier to get jobs, and companies are not only looking for people with collaborative skills but also regularly use collaborative tools in their work processes. Copyright © 2015 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

ABSTRACT In earlier work, it has been suggested that processes and applications seem to share many important characteristics and seem to be amenable to similar approaches of modeling, definition, and analysis. In most of this previous work, approaches and technologies for developing applications have been applied to the development of processes, largely with positive results. This paper suggests the opposite, namely that approaches and technologies for developing processes seem likewise to be applicable to developing applications. As an example, this paper notes that resource specification, allocation, and management are central issues in the development of many processes, and suggests that although these capabilities seem to be important for growing classes of application software, the ability to support them seems curiously neglected. The paper also notes that management of rework is a central issue of virtually all creative activities. This is evidenced by the observation that facilities for supporting rework are prominent features in so many creative domains. Accordingly, the paper suggests an analogous need for facilities for supporting rework in application software as well, especially in application software aimed at supporting human creativity. The paper concludes by noting that both application and process software technologies grow through consideration of the relevance of technologies developed for one to the other. This in turn should lead to a clearer understanding of the essence of what they have in common, leading to conjectures about the nature of a more abstract class of entities, that we refer to simply as software. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

This paper presents a semi-automatic approach for the recovery and evolution of the design of existing Web applications. The proposed approach is structured in two main phases and is based on the Ubiquitous Web Applications (UWA) design framework, a methodology and a set of models and tools for the user-centered design of multichannel context-aware Web applications. In the first phase a representative set of the application's front-end Web pages are analyzed to abstract the 'as-is' design model of the application according to the UWA methodology. In the second phase, the recovered design model is evolved to define the 'to be' version of it. This evolution activity considers the up-to-date requirements available for the application and UWA design guidelines to identify shortcomings and opportunities of improvement in the 'as-is' design. The reverse modeling phase exploits clustering and clone detection techniques and is supported by the RE-UWA tool, an Eclipse IDE customized to implement the reverse engineering process defined to extract formal UWA models expressed as instances of a MOF metamodel. The forward design phase is supported by a set of UWA modeling tools that are built on top of the Eclipse Modeling Framework (EMF) and the Eclipse Graphical Modeling Framework (GMF). The proposed design recovery and evolution approach is applied to four real-world Web applications and the obtained results are also presented in the paper. [ABSTRACT FROM AUTHOR]

Web applications are often used to expose business processes implemented as software systems. This paper describes a technique for recovering business processes based on a dynamic analysis of the applications behavior. The technique described here does not require any access to internal software artifacts of the application, such as source code or documentation. An initial process is inferred to by means of the analysis of execution traces, in which the execution of GUI elements such as forms and links is recorded. The recovered process is then abstracted by clustering its elements according to four different criteria: structural, page-based, dependency-based and semantical. A case study has been conducted with the aim of evaluating understandability and readability of the reverse engineered processes as well as the clustering techniques used in refining them. [ABSTRACT FROM AUTHOR]

We are happy to introduce you to this special issue that presents selected papers from the 15th IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM 2015). SCAM is a leading conference that brings together researchers and practitioners working on theory, techniques, and applications that concern analysis and/or manipulation of the source code of computer systems. While much attention in the wider software engineering community is properly directed towards other aspects of systems development and evolution, such as specification, design, and requirements engineering, it is the source code that contains the only precise description of the behavior of the system. The analysis and manipulation of source code thus remains a pressing concern. SCAM 2015 was held on September 27 to 28, 2015, in Bremen, Germany, together with 31st International Conference on Software Maintenance and Evolution (ICSME). [ABSTRACT FROM AUTHOR]

Summary: In this article, a strategy that seeks to assist the arduous cognitive process that involves understanding a GUI‐based system is presented. In order to reach this goal, a UML use case model with the most relevant features is obtained. To derive this model, the strategy performs the following steps: Extraction and filtering of specific system static information and implementation of a clustering process that inspects this information including GUI widgets, which are components closely related to the system problem domain. Although these steps are commonly known and used in the context of reverse engineering, the strategy introduces unusual approaches regarding the proposals found in the available literature. More specifically, the strategy presents (a) a set of metrics that infers the relative importance of a method or a function within the analysed system, (b) a summarization process driven by different features of software systems, and (c) a technique to cluster software artefacts and to map the cluster model onto a use case model. The article also propose a methodology that allows to compare the achieved results. The assessment of the approach suggests that the strategy can assist the software engineer to understand a software system providing a useful fine‐grained use case model. In the context of software maintenance, the most time‐consuming activities are those the software engineer must execute to understand a system. Reverse engineering provides methods and tools aiming to assist this arduous cognitive process. We propose a reverse engineering strategy that extracts a UML use case model with the most relevant features for the system under study. This model provides a connection between a high‐level abstraction of the system functionalities and the source code artifacts that implement those functionalities. [ABSTRACT FROM AUTHOR]

An introduction to the journal is presented in which the editor discusses various reports in the issue on the topics including one on Software Process Improvement (SPI), the other on electronic mobility concept and the third on Global Software Development (GSD).

The authors have been working on establishment of a knowledge structure for process improvement (PI) at "Japan SPI Consortium". Our objective is to store useful knowledge, to provide mechanisms for their usage, and to encourage creation of new knowledge. During our efforts to extract, categorize and consolidate knowledge from the presentation materials at our conferences, we saw problems with respect to the coverage of knowledge expressed in the experiences. To solve this issue, we devised a knowledge model that consists of seven information elements as a representation, and then introduced a standard template to be used when submitting a proposal to the conference. As a result, statistically significant change in the knowledge coverage was observed, and the amount of information has increased for items such as causal analysis, verification and validation of process improvement over the successive conferences. Positive feedback was obtained from proposal reviewers and conference participants for improved understandability. Percentage of successful stories has also increased among the presentations. [ABSTRACT FROM AUTHOR]

Software Process Improvement (SPI) initiatives have been applied in a wide set of organisations including very small entities (VSE). In fact, this kind of organisations is facing several hurdles when overarching a SPI initiative. In this context, the ISO/IEC 29110 has been used as a lightweight reference model for steering VSEs in their SPI initiatives. The inherent uncertainty behind the SPI curtains blocks the organisations in their investments. Due to these reasons, we need to identify relationships and similarities in order to predict whether a SPI will succeed or not. We propose the use of Self‐Organising Maps for identifying patterns from these SPI studies. The aim of this paper is to identify correlations among SPI studies and to discover patterns from them. [ABSTRACT FROM AUTHOR]

Software development firms have begun adopting the practice of global software development (GSD). The main reason for the shift toward globalization is the various benefits received by software development firms. However, there are several issues faced by GSD organizations, particularly those associated with software process improvement (SPI). It has been noticed that a formal process improvement approach could assist in successfully executing development activities in GSD. The core objective of this research work is to develop a global software engineering process improvement model (GSEPIM) to assess and improve software process activities in a GSD environment. The proposed model will be developed based on existing models in other domains, an empirical study conducted with GSD practitioners, and an understanding of critical success factors and challenges of SPI. In this study, the first step in the development of GSEPIM is completed by identifying the challenges of SPI in GSD and presenting a solution in the form of a robust framework. [ABSTRACT FROM AUTHOR]

The Web Content Accessibility Guidelines was developed by World Wide Web Consortium with a goal of providing a single shared standard for web content accessibility that meets the needs of individuals, organizations, and governments. Given that there is a large percentage of very small entities that develop software who also utilize the ISO/IEC software process standard, the purpose of this study is the development of software design patterns for users with visual disabilities. As a result, four accessibility design patterns are defined: Authentication adapter, Blindness adapter, Dichromatic color vision adapter, and Blurry vision adapter. These patterns will help to improve the design of the web applications built using them while being compliant with the ISO/IEC 29110 standard. The use of design patterns also enables the transfer of design experience to programming practices and improves the software documentation. To validate the set of patterns, an online course for Spanish speakers was developed, and the evaluation was carried out using simulators, automated tools, experts, and users. Simulators and automated tools showed no accessibility errors and experts evaluated 10 heuristics principles and did not identify any severity issues. Taken together, our results provide positive evidence that users with visual disabilities could benefit from the proposed features. In this study, we introduce design patterns within the software implementation process of ISO/IEC 29110 to guarantee a good level of accessibility in the products built using this standard. The accessibility design patterns defined in this proposal are an authentication adapter and three adapters for three types of visual disabilities: blindness, dichromatic color vision, and blurry vision. The evaluation of the web application was carried out using simulators, automated tools, experts, and users resulting in no accessibility errors. [ABSTRACT FROM AUTHOR]

The culture of traditional organizations favors firmly established processes and standardization. Therefore, the adoption of Agile and Lean approaches in these organizations is a challenging issue. This paper presents an overview and outlook of the most well‐known Agile and Lean approaches in order to identify which kind of continuous software process improvement (SPI) is inherent in these approaches. The main objective of this research is to show that Lean and Agile SPI approaches can be pursued depending on the target environment, both in traditional and in agile organizations. The culture of traditional organizations favors established processes and standardization. Therefore, the adoption of Agile and Lean approaches in these organizations is a challenging issue. This paper presents an outlook of the most well‐known Agile and Lean approaches in order to identify which kind of continuous software process improvement (SPI) is inherent in these approaches. The objective of this research is to show that Lean and Agile SPI approaches can be pursued both in traditional and in agile organizations. [ABSTRACT FROM AUTHOR]

Defect‐based testing is a powerful tool for finding errors in software. Many software manufacturers avoid this method because it requires a detailed defect taxonomy that is expensive to construct and difficult to validate. The Association for the Advancement of Medical Instrumentation is developing SW91, a defect taxonomy to be published as a standard for health software. This paper details three methods to validate SW91 for its comprehensiveness. The initial validations of SW91 were conducted via mapping vulnerabilities from the common weakness enumeration and a dataset from a medical device software development company in Ireland. Taxonomy‐based testing is another validation method proposed in this research, and its applicability was investigated using empirical data from a medical device software development company in Ireland. Finally, the paper details future plans to implement taxonomy‐based testing to improve software quality in medical device software and to validate SW91. This validation will focus on the efficiency, reliability, and ability to perform useful analyses and defect coverage of SW91. [ABSTRACT FROM AUTHOR]

No abstract is available for this article. [ABSTRACT FROM AUTHOR]

An introduction is presented in which the editors discuss various reports within the issue on topics including computer software development, software engineering and application software.