Search

There is a need to identify requirements engineering (RE) practices that are important to global software development (GSD) project success. The objective of this paper is to report our recent empirical study results which aimed to identify the RE practices that are important to GSD projects. This study used an online survey questionnaire to elicit data from 56 RE experts of GSD projects. The survey included 66 RE practices identified by Sommerville et al. for non-GSD projects. The participants were asked to rank each RE practice on a four-point scale to determine the degree of importance of each practice in the context of GSD projects. This research identified a set of six key RE practices that mainly focuses on GSD project stakeholders, scope, standards and requirements traceability management. One common theme that is evident from the RE experts’ feedback analysis is the standardization of requirements documents to reduce requirements inconsistencies and improve communication in diverse and distributed GSD project environments Our results show that not all 66 RE best practices are important for GSD projects. We believe that a good understanding of the identified RE practices is vital in developing and implementing the situation-specific RE processes for GSD projects.

Global software development (GSD) is rapidly becoming standard practice in the software industry due to its many potential benefits. However, one of the biggest challenges in GSD projects is to explicitly include security in the different phases of the global software development life cycle (GSDLC). To make GSD projects secure and successful, it is necessary to identify secure software development (SSD) practices vital to GSD project success. This article aims to identify SSD practices critical for GSD projects. To do this, we selected 36 security practices vital to the security of non-GSD projects from existing scientific and grey literature on software security. From the identified security practices, we shortlisted the security practices which are critical for GSD projects based on practitioners’ opinions using an online survey. Fifty-four GSD practitioners participated in this survey. Participants who evaluated these practices were asked to score each SSD practice on a four-point scale to indicate its relevance to GSD projects. The results obtained from the survey uncovered critical SSD practices that are primarily applicable to GSD projects. Our findings reveal variations of opinion among GSD practitioners with varying experience and company size regarding the importance of selected security practices for GSD. According to study findings, 16/36 practices are critical for GSD projects. These identified security practices belong to various phases of GSDLC.

Security has become a vital factor for any Internet of things network but it is of paramount importance for Internet of Health Things (IoHT). IoHT also known as Internet of Medical Things (IoMT) is integration of IoT and healthcare environment, where fragile data related to the patients is transmitted from IoT devices to server. During this transmission, if, any eavesdropping or intrusion occurs then it will not only lead to the serious mutilation of entire network but this data will be handled maliciously for wrong doings as well. Therefore, a proper security is indispensable for IoHT based equipments due to exposure to different attacks. Security of IoHT has been the burning issue in last couple of years. In this regard different security models, surveys, frameworks have been presented. In this article, a proposed Identified Security Attributes (ISA) framework is presented to evaluate the security features of IoHT based device in healthcare environment. The proposed framework uses hybrid MCDM methods such as Analytical Hierarchical Process (AHP) and Technique for Order Preference by Similarity to Ideal Solution (TOPSIS). This framework works in two phase: in first phase the weights of attributes are derived by using AHP method and in second phase security assessment of alternatives is performed based upon security criteria by using TOPSIS method. The outcomes of proposed security assessment framework demonstrate that the reliable and secure alternative among alternatives is selected in IoMT system. This approach can be used as a guideline for future use in IoMT systems or any other IoT based domain. To the best of our knowledge, it is novel approach to address the security assessment of IoT and these MCDM methods have never been used before for assessment and decision making in IoHT system for security.

A sequence diagram is a modeling approach for visualizing the behavioral execution of a system. The objective of this research is to investigate the problem of security in a behavioral model (sequence diagram) through the application of model refactoring. We propose detection and correction techniques, empirical evaluation of the proposed techniques and assessment of security improvement in sequence diagrams. The detection of security bad smells is achieved through the adaptation of a genetic algorithm, while correction is accomplished by the model transformation approach. The results show significant detection recall and correction efficacy of the proposed detection and correction approaches, respectively. Our results show that the proposed approach is effective in detecting and correcting bad smells and can improve the security of UML Sequence Diagram.

Security is one of the most important software quality attributes. Software security is about designing and developing secure software that does not allow the integrity, confidentiality, and availability of its code, data, or service to be compromised. Organizations tend to consider security as an afterthought, and they continue to suffer from security risks. Developing secure software requires taking security into consideration in all phases of the Software Development Life Cycle (SDLC). Several approaches have been developed to improve software quality, such as Capability Maturity Model Integration (CMMI). However, software security issues have not been addressed in a proper manner and incorporating security practices into the SDLC remains a challenge. The objective of this paper is to develop a framework to improve the process of designing secure products in software development organizations. To achieve this objective, a Multivocal Literature Review (MLR) was conducted to identify the relevant studies in both the formal and grey literature. A total of 38 primary studies were identified, and available evidence was synthesized into 8 knowledge areas and 65 best practices to build a Secure Software Design Maturity Model (SSDMM). The framework was developed based on the structure of CMMI v2.0 and evaluated through case studies in real-world environments. The case study results indicate that SSDMM is useful in measuring the maturity level of an organization for the secure design phase of SDLC. SSDMM will assist organizations in evaluating and improving their software design security practices. It will also provide a foundation for researchers to develop new software security approaches.

Cloud computing (CC) is the delivery of computing services on demand and is charged using a “pay per you use” policy. Of the multiple services offered by CC, SaaS is the most popular and widely adapted service platform and is used by billions of organizations due to its wide range of benefits. However, security is a key challenge and obstacle in cloud adoption and therefore needs to be addressed. Researchers and practitioners (R&P) have discussed various security challenges for SaaS along with possible solutions. However, no research study exists that systematically accumulates and analyzes the security challenges and solutions. To fill this gap and provide the state-of-the-art (SOTA) picture of SaaS security, this study provides a comprehensive multivocal literature review (MVLR), including SaaS security issues/challenges and best practices for mitigating these security issues. We identified SaaS security issues/challenges and best practices from the formal literature (FL) as well as the grey literature (GL) to evaluate whether R&P is on the same page or if controversies exist. A total of 93 primary studies were identified, of which 58 are from the FL and 35 belong to the GL. The studies are from the last ten years, from 2010 to 2021. The selected studies were evaluated and analyzed to identify the key security issues faced by SaaS computing and to be aware of the best practices suggested by R&P to improve SaaS security. This MVLR will assist SaaS users to identify the many areas in which additional research and development in SaaS security is required. According to our study findings, data breaches/leakage, identity and access management, governance and regulatory compliance/SLA compliance, and malicious insiders are the key security challenges with the maximum frequency of occurrence in both FL and GL. On the other hand, R&P agree that up-to-date security controls/standards, the use of strong encryption techniques, regulatory compliance/SLA compliance, and multifactor authentication are the most important solutions.

The focus on secure software development has been growing steadily in all phases of the software development life cycle. Security awareness in the requirements engineering stage of software development is important in building secure software. One of the major issues faced by the software industry is that many organizations undertake secure software development initiatives without knowing whether they are ready to undertake them. Currently, there is no model to measure the readiness of security requirements engineering in an organization. The objective of this paper is to develop a security requirements engineering readiness model (SRERM) to enable organizations to assess their security requirements engineering (SRE) readiness levels. In order to achieve this goal, a systematic mapping study was conducted to identify the relevant studies in the SRE domain. A total of 104 primary studies were identified, and available evidence was synthesized into 12 security requirements categories and 76 best practices to build a SRERM. Initially, two case studies were conducted in order to evaluate the SRERM in a real-world environment. Based on the outcomes of the two case studies, some modifications were proposed to further improve the SRERM. After modifying the SRERM, two more case studies were conducted in order to evaluate the modifications made to the SRERM. The case study results indicate that the SRERM has the ability to identify the readiness levels of SRE in the software industry.

There is a significant need to give more careful consideration to the process and product quality assurance (PPQA) process area of the capability maturity model integration (CMMI) Level 2, especially in the context of smalland medium-sized software development organizations, to help such organizations achieve CMMI Level 2. The objective of this paper is to report the implementation of the PPQA process area for smalland medium-sized software development organizations in Saudi Arabia. An abstract-level model for each specific practice of the PPQA process area has been developed. In addition, an initial evaluation of the proposed models has been discussed. Data have been collected by exploring published research articles and high-level software process descriptions. Moreover, previous research works that dealt with the implementation of CMMI Level 2 process areas have been reviewed. Furthermore, research articles that provide guidance to software development organizations for implementing the process areas of CMMI Level 2 in their environments have been considered. The evaluation of the proposed models was also carried out using an expert panel review process and one case study. After careful analysis of the collected data, we have proposed a model for each specific practice in the PPQA process area. Each model is divided into core stages, and different activities associated with each stage are clearly indicated. Based on the evaluation, we are confident that our proposed models are clear, easy to use and learn, and can be applied to smalland medium-sized software development organizations in Saudi Arabia. In addition, the evaluation results show that the proposed models can help such organizations in implementing the PPQA process area according to the CMMI Level 2 maturity requirement.

There is a significant need to give careful consideration to Capability Maturity Model Integration (CMMI) Level 2 specific practices-SP 1.3 “manage requirements changes,”and SP 1.4 “maintain bidirectional traceability of requirements,”especially in the context of smalland medium-sized software development organizations in Saudi Arabia, in order to assist such organizations in getting one step closer to achieving CMMI Level 2 certification. The objective of this research is to implement CMMI Level 2 specific practices-SP 1.3 and SP 1.4. In this paper, a workflow model for each specific practice has been developed. In addition, initial evaluation of the models has been discussed. It is necessary to highlight that this paper contributes not only to the implementation of SP 1.3 and SP 1.4 of Requirements management process area in the context of smalland medium-sized software development organizations but also to the body of empirical studies in various context. Data has been collected by exploring published research articles and high-level software process descriptions. Moreover, previous research works that dealt with the implementation of CMMI Level 2 process areas have been reviewed. Furthermore, research articles that provide guidance to software development organizations for implementing process areas of CMMI Level 2 in their environments have been considered. After careful analysis of the collected data, we have proposed the models for two specific practices of CMMI level 2, i.e., managing requirements change and maintaining bidirectional traceability of requirements. Each model is divided into core stages, and different activities associated with each stage are clearly indicated. Initial evaluation of the proposed models was also conducted using the expert review process. Based on the initial evaluation, we are confident that our proposed models are clear and easy to learn, follow, and use. Moreover, our models are applicable to smalland medium-sized software development organizations in Saudi Arabia. The proposed models can also assist such organizations in implementing these two specific practices. For further evaluation, we need to perform multiple case studies in an industrial setting to test the proposed models.