Search

Studies on requirements engineering with Agile methods for software development have shown difficulties in managing the quality of the requirements and communicating with users. Some of these studies have proposed conceptual modeling as a solution to these problems. However, the effort that is required to create conceptual models conflicts with Agile values. In this paper, we propose an approach for using conceptual models in projects while adhering to Agile principles. This approach focuses on projects in which requirements are expressed as user stories that are the main artifacts of the requirements used for software development with Agile methods. First, the paper presents a literature review in which we have systematically searched for the challenges to requirements engineering with Agile methods. Next, we report on a survey study in which we interviewed 16 experts in the Agile methodology to confirm the identified challenges and find new ones that are not covered in the literature. Based on a thematic analysis of the challenges, we argue that most of them map to the two main purposes of using conceptual models in software development: improving communication and understanding requirements. To effectively use conceptual models in projects that use the Agile methodology, several conditions must be met, which we make explicit in the paper. The paper ends by illustrating how these conditions can be met demonstrating the models that can be automatically generated from a given set of user stories. This demonstration was subsequently used to obtain feedback from the experts on the perceived benefits of conceptual models in addressing the challenges of requirements engineering.

User stories are a widely used artifact in Agile software development. Currently, only a limited number of secondary studies have reviewed the research on the user story technique. These research reviews focused on specific research topics related to ambiguity of requirements, effort estimation, and the application of Natural Language Processing. To our knowledge, a systematic mapping of all user story research has not been performed. To this end, we study the academic literature to investigate what user stories research has been performed, what types of problems have been identified, what sort of solutions or other types of research outcomes have been achieved, how mature the research is, and what research gaps exist. We followed Systematic Mapping Study guidelines to synthesize the currently available academic research on user stories. In total, we found 186 unique peer-reviewed studies, published in the period 2001-2021. We observed that research on the user story technique and its use had grown exponentially over the last seven years. Further, using a five-dimensional classification framework– requirements engineering activity, problem class, outcome class, type of research, type of publication– we observed several patterns in the classification of these studies across the different framework dimensions, which provided insights into the state-of-the-art and maturity of the research. We also identified four research gaps: the paucity of focused literature reviews; a lack of research on the role that user stories play in human cognition and interaction; a lack of comprehensive and mature solutions for resolving ambiguity issues with user stories early in the project; and a lack of validation and evaluation of proposed solutions. Several research opportunities are suggested, making our paper a useful reference for future research on user stories allowing researchers to clearly position their contributions.

Prior studies have shown that the behaviours and attitudes of Internet users influence the likelihood of being victimised by phishing attacks. Many scammers design a step-by-step approach to phishing in order to gain the potential victim’s trust and convince them to take the desired actions. It is important to understand which behaviours and attitudes can influence following the attacker in each step of a phishing scam. This will enable us to identify the root causes of phishing and to develop specific mitigation plans for each step of the phishing process and to increase prevention points. This study investigates to what extent people’s risk-taking and decision-making styles influence the likelihood of phishing victimisation in three specific phishing steps. We asked participants to play a risk-taking game and to answer questions related to two psychological scales to measure their behaviours, and then conducted a simulated phishing campaign to assess their phishability throughout the three phishing steps selected. We find that the attitude to risk-taking and gender can predict users’ phishability in the different steps selected. There are however other possible direct and indirect behavioural factors that could be investigated in future studies. The results of this study and the model developed can be used to build a comprehensive framework to prevent the success of phishing attempts, starting from their root causes.

The General Data Protection Regulation (GDPR), adopted in 2018, profoundly impacts information processing organizations as they must comply with this regulation. In this research, we consider GDPR-compliance as a high-level goal in software development that should be addressed at the outset of software development, meaning during requirements engineering (RE). In this work, we hypothesize that natural language processing (NLP) can offer a viable means to automate this process. We conducted a systematic mapping study to explore the existing literature on the intersection of GDPR, NLP, and RE. As a result, we identified 448 relevant studies, of which the majority (420) were related to NLP and RE. Research on the intersection of GDPR and NLP yielded nine studies, while 20 studies were related to GDPR and RE. Even though only one study was identified on the convergence of GDPR, NLP, and RE, the mapping results indicate opportunities for bridging the gap between these fields. In particular, we identified possibilities for introducing NLP techniques to automate manual RE tasks in the crossing of GDPR and RE, in addition to possibilities of using NLP-based machine learning techniques to achieve GDPR-compliance in RE.

Phishing is an online scam where criminals trick users with various strategies, with the goal of obtaining sensitive information or compromising accounts, systems, and/or other personal or organisational Information Technology resources. Multiple studies have shown that human factors influence the success of phishing attempts. However, these studies were conducted before the COVID-19 pandemic, which is significant because security reports show that the numbers of phishing attacks have been rapidly increasing since the start of COVID-19. This study investigates the extent to which users’ fear, anxiety and stress levels regarding COVID-19, impact falling for common and COVID-19 themed phishing scams during the outbreak period. Prior studies have depicted the effects of human behaviour on phishing attacks before the pandemic, such as risk-taking preferences and users’ demographic factors, hence this study also focuses on the effects of those factors on the likelihood of phishing victimisation. More concretely, we present the results of a scenario-based roleplay experiment to study the relationship between fear, anxiety, stress, risk-taking, and demographic factors and the success of phishing attacks during the pandemic. The findings indicate that fear of COVID-19 influences the success of COVID-19 specific themed phishing scams, while anxiety, stress, and risk-taking influences the success of both the COVID-19 themed and common phishing scams. Our findings also suggest that the users’ education level impacts common phishing attacks during the pandemic.