Search

By adopting agile and lean practices, DevOps aims to achieve rapid value delivery by speeding up development and deployment cycles, which however lead to more security concerns that cannot be fully addressed by an isolated security role only in the final stage of development. DevSecOps promotes security as a shared responsibility integrated into the DevOps process that seamlessly intertwines development, operations, and security from the start throughout to the end of cycles. While some companies have already begun to embrace this new strategy, both industry and academia are still seeking a common understanding of the DevSecOps movement. The goal of this study is to report the state‐of‐the‐practice of DevSecOps, including the impact of DevOps on security, practitioners' understanding of DevSecOps, and the practices associated with DevSecOps as well as the challenges of implementing DevSecOps. The authors used a mixed‐methods approach for this research. The authors carried out a grey literature review on DevSecOps, and surveyed the practitioners of DevSecOps in industry of China. The status quo of DevSecOps in industry is summarized. Three major software security risks are identified with DevOps, where the establishment of DevOps pipeline provides opportunities for security‐related activities. The authors classify the interpretations of DevSecOps into three core aspects of DevSecOps capabilities, cultural enablers, and technological enablers. To materialise the interpretations into daily software production activities, the recommended DevSecOps practices from three perspectives—people, process, and technology. Although a preliminary consensus is that DevSecOps is regarded as an extension of DevOps, there is a debate on whether DevSecOps is a superfluous term. While DevSecOps is attracting an increasing attention by industry, it is still in its infancy and more effort needs to be invested to promote it in both research and industry communities. [ABSTRACT FROM AUTHOR]

Non‐functional requirements define qualities of the software system that ensure effectiveness while embedding any constraints and restrictions on the design. A challenge rises with agile implementation in handling non‐function requirements in regulated environments. Thus, a practitioner's perceptions of agile method tailoring are described in relation to inter‐team boundaries and non‐functional requirements. The research comprises 18 practitioner interviews from two multinational agile software development companies. Interviews were recorded, transcribed, and analysed using an approach informed by grounded theory and information flow models were used to compare and contrast interactions of processes. It was discovered that one of the case study companies managed non‐functional requirements as artefacts in their agile methodology, while the other company reverts to conventional plan‐based software development practices of documentation, timeline estimations, and safety critical requirements. This research creates a detailed comparison of these contrasting approaches. The main contribution of this study is a set of proposed recommendations to deal with non‐functional requirements in a regulated environment using agile techniques. The introduction of two new artefacts, Documentation Work Item and Safety Critical Work Item, is recommended and it is accompanied with an illustrative example, to transform the handling of documentation and safety critical requirements in a more agile way. [ABSTRACT FROM AUTHOR]

Knowledge management systems (KMS) are computer‐based systems highly valued in business organizations because they support knowledge management (KM) processes. Most KMS have been developed using non‐intelligent computer technology—that is, DMS, CMS, DBMS, and CIS—, and thus, they cannot provide advanced capabilities. Consequently, enhanced KMS using intelligent technologies of ontologies with inference engines—called ontology‐based knowledge management systems (OKMS)—have been proposed in the last three decades. Nowadays, however, the implementation of OKMS in real‐world settings is still scarce. Lack of comprehensive and systematic development methodologies including Project Management and Technical Systems Engineering processes—as the Systems and Software Systems Engineering standards propose—have been suggested as a factor that inhibits OKMS implementations. In this study, we review the OKMS literature (1990–2021 period)—from six seminal studies located using a research search engine—to assess OKMS development methodologies that can be considered comprehensive and systematic. Five methodologies were identified and assessed using an evaluation subset from the ISO/IEC/IEEE 15288:2015 Systems and Software Engineering standard. Two of them—CommonKADS and NeON—were found with a high comprehensive and systematic level and both are suggested for organizations interested in OKMS implementations, but none of them qualified as agile, which is a current development approach for systems and software systems. Hence, further empirical research toward the realization of comprehensive and systematic OKMSs development methodologies, including agile versions, is suggested for fostering the implementation of OKMS in real‐world settings. [ABSTRACT FROM AUTHOR]

The maturity of organisations is measured using process assessment models like the International Organization for Standardization (ISO)/IEC 33001. Product quality is refined with internal and external product quality characteristics based on models like the ISO/IEC 25010. With the shift from the Tailorism‐driven process orientation to a more people‐centric organization, the process and product quality dimensions have to be extended by the teamwork quality (TWQ) dimension. For the sake of systematic organization development, this new third quality dimension needs to be integrated into existing quality frameworks to achieve a holistic quality approach. This article introduces agile TWQ as the method of choice. It explains its design, implementation and evaluation in the large enterprise context of the Volkswagen AG. It provides insights into the effectivity of this approach in heterogeneous multi‐team settings, as well as into its strengths, weaknesses, and limitations. [ABSTRACT FROM AUTHOR]

Social loafing is a common issue encountered by many software development teams. In practice, agile software development teams often use team expectations agreements (TEAs), which contain rules to prevent social loafing behaviour. However, few studies in the software engineering literature examine how these rules are specified in TEAs and whether they serve the purpose. The authors intend to provide a better understanding on how to specify rules in TEAs to prevent social loafing behaviour in agile software development teams. A mixed‐method approach using both qualitative and quantitative data was employed. The results of our study show that agile software development teams specify the expectations of the whole team on meeting attendance and contribution, respect of tasks, roles and teammates, and collaboration with each other. These rules have the potential to prevent social loafing behaviours. However, specifying the rules in TEAs alone is not sufficient to make them effective. It needs to be complemented with team commitment to TEA rules. The work of the authors contributes to a better understanding of how to use TEAs to prevent social loafing in agile software development teams, and provides a conceptual basis for future research to investigate social loafing prevention using TEAs. [ABSTRACT FROM AUTHOR]

Species distribution models (SDMs) constitute the most common class of models across ecology, evolution and conservation. The advent of ready‐to‐use software packages and increasing availability of digital geoinformation have considerably assisted the application of SDMs in the past decade, greatly enabling their broader use for informing conservation and management, and for quantifying impacts from global change. However, models must be fit for purpose, with all important aspects of their development and applications properly considered. Despite the widespread use of SDMs, standardisation and documentation of modelling protocols remain limited, which makes it hard to assess whether development steps are appropriate for end use. To address these issues, we propose a standard protocol for reporting SDMs, with an emphasis on describing how a study's objective is achieved through a series of modeling decisions. We call this the ODMAP (Overview, Data, Model, Assessment and Prediction) protocol, as its components reflect the main steps involved in building SDMs and other empirically‐based biodiversity models. The ODMAP protocol serves two main purposes. First, it provides a checklist for authors, detailing key steps for model building and analyses, and thus represents a quick guide and generic workflow for modern SDMs. Second, it introduces a structured format for documenting and communicating the models, ensuring transparency and reproducibility, facilitating peer review and expert evaluation of model quality, as well as meta‐analyses. We detail all elements of ODMAP, and explain how it can be used for different model objectives and applications, and how it complements efforts to store associated metadata and define modelling standards. We illustrate its utility by revisiting nine previously published case studies, and provide an interactive web‐based application to facilitate its use. We plan to advance ODMAP by encouraging its further refinement and adoption by the scientific community. [ABSTRACT FROM AUTHOR]

Improved efficiency of Markov chain Monte Carlo facilitates all aspects of statistical analysis with Bayesian hierarchical models. Identifying strategies to improve MCMC performance is becoming increasingly crucial as the complexity of models, and the run times to fit them, increases. We evaluate different strategies for improving MCMC efficiency using the open‐source software NIMBLE (R package nimble) using common ecological models of species occurrence and abundance as examples. We ask how MCMC efficiency depends on model formulation, model size, data, and sampling strategy. For multiseason and/or multispecies occupancy models and for N‐mixture models, we compare the efficiency of sampling discrete latent states vs. integrating over them, including more vs. fewer hierarchical model components, and univariate vs. block‐sampling methods. We include the common MCMC tool JAGS in comparisons. For simple models, there is little practical difference between computational approaches. As model complexity increases, there are strong interactions between model formulation and sampling strategy on MCMC efficiency. There is no one‐size‐fits‐all best strategy, but rather problem‐specific best strategies related to model structure and type. In all but the simplest cases, NIMBLE's default or customized performance achieves much higher efficiency than JAGS. In the two most complex examples, NIMBLE was 10–12 times more efficient than JAGS. We find NIMBLE is a valuable tool for many ecologists utilizing Bayesian inference, particularly for complex models where JAGS is prohibitively slow. Our results highlight the need for more guidelines and customizable approaches to fit hierarchical models to ensure practitioners can make the most of occupancy and other hierarchical models. By implementing model‐generic MCMC procedures in open‐source software, including the NIMBLE extensions for integrating over latent states (implemented in the R package nimbleEcology), we have made progress toward this aim. [ABSTRACT FROM AUTHOR]