Search

Through the rise of the Internet and Web-based software our computing environment has evolved from well-defined topologies into loosely organized, unbounded topologies where user profiles and intentions are largely unknown. With less than 20 years experience in this chaotic computing environment, software developers and maintenance professionals are still learning efficient and systematic means of locating faults and code vulnerabilities that can be exploited by malicious users. Exponential growth in software intrusions, attacks, and security incidents has been observed worldwide. The question that arises, however, is whether software security considerations are genuinely new issues, or can they be addressed using existing definitions, technologies, and tools. That is, can we portray software vulnerabilities, especially specific instances of exploitable code, as software faults so that systematic software maintenance practices can be applied? In this paper we present a longitudinal analysis of software vulnerabilities in a widely used file-transfer program, by examining 12 years of maintenance records documenting perfective, corrective, and adaptive changes to the software suite. Our analysis of the program's software faults and vulnerabilities indicate that they are not distinct categories, but rather two overlapping sets that should not be addressed separately. An in-depth analysis of two dominant security flaws shows that they are canonical software faults that can lead to failure even in the absence of malicious user behavior. Our longitudinal analysis demonstrates that every security vulnerability in the program suite could have been eliminated prior to release via proactive software maintenance engineering. Copyright © 2005 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Requirements are the foundation of the software release process. They provide the basis for estimating costs and schedules, as well as developing design and testing specifications. When requirements have been agreed on by both clients and maintenance management, then adding to, deleting from, or modifying those existing requirements during the execution of the software maintenance process impacts the maintenance cost, schedule, and quality of the resulting product. The basic problem is not the changing in itself, hut rather the inadequate approaches for dealing with changes in a way that minimizes and communicates the impact to all stakeholders. Using data collected from one organization on 44 software releases spanning seven products, this paper presents two quantitative techniques for dealing with requirements change in a maintenance environment. First, exploratory data analysis helps one to understand the sources, frequency, and types of changes being made. Second, a regression model helps managers communicate the cost and schedule effects of changing requirements to clients and other release stakeholders. These two techniques can help an organization provide a focus for management action during the software maintenance process. [ABSTRACT FROM AUTHOR]

Reports global developments in the computer software industry as of March 1988. Selection of the Martin Marietta Information Systems to develop a central simulation facility by the United States Defense Department; Interview with founder Tom DeMarco of the Atlantic Systems Guild on parallel processing; Integration approach for factory automation.

Presents news briefs on the computer software industry as of May 1990. Highlights of the 12th International Conference on Software Engineering; Focus of the International Conference on Computer Languages; Visions and concerns of the ACM Computer Science Conference.