Software Development Practices Research Articles

Evaluation of requirement engineering best practices for secure software development in GSD: An ISM analysis

AbstractTechnological advancement makes the world a global village. Security is an evergreen and everlasting area, because of the continuous threat from Hackers and Crackers. The immense use of software systems has modernized human society in every aspect. Thus, it is crucial to devise new processes, techniques, and tools to support teams in the development of secure code from the early stages of the software development process, while potentially reducing the costs and shortening the time to market. Considering the significance of software security, it is important to consider the security practices from the early phase of the software development life cycle (SDLC), that is, requirements engineering (RE). Hence, this study aims to identify and categorize RE practices important to apply for secure software development (SSD) in a geographically distributed development environment. To study the RE practices concerning SSD, we conducted a questionnaire survey with industrial experts in the global software development (GSD) context.Furthermore, the interpretive structure modeling (ISM) approach was applied to evaluate the relationship between the RE security practice core categories. This paper identifies 70 practices and classifies them into 11 fundamental dimensions (categories) to assist GSD organizations in specifying the requirements for SSD. The ISM results show that the “Awareness of Secure Requirement Engineering (SRE)” category has the most decisive influence on the other 10 core categories of the identified RE security practices. With the help of empirical evidence and the ISM approach, this work attempts to identify potential security practices and to give a set of secure RE practices that can be used to improve the security of the software development process.

Successful Adoption of DevOps Practices in Software Development in DoD Acquisition Programs—The CREATE Example

A growing number of articles describe the challenges of adopting DevOps for DoD software development. A recent paper in this journal discussed DevOps adoption challenges within the acquisition programs of the Navy. For embedded software, these challenges have been overwhelming to date. However, for standalone applications, the story is different, even though the lingering impact of DoD Instruction 5000 and other DoD cultural practices remains problematic. The HPCMP CREATE™ program, or simply CREATE in this paper, is part of the portfolio of the DoD High Performance Computing Modernization Program (HPCMP). It has successfully adapted DevOps concepts and agile software development practices to develop a family of software applications that enable system-scale virtual prototyping and testing analysis for major DoD acquisition programs. This study describes the main enabling practices that made this possible.

GreenPy: Evaluating Application-Level Energy Efficiency in Python for Green Computing

The increased use of software applications has resulted in a surge in energy demand, particularly in data centers and IT infrastructures. As global energy consumption is projected to surpass supply by 2030, the need to optimize energy consumption in programming has become imperative. Our study explores the energy efficiency of various coding patterns and techniques in Python, with the objective of guiding programmers to a more informed and energy-conscious coding practices. The research investigates the energy consumption of a comprehensive range of topics, including data initialization, access patterns, structures, string formatting, sorting algorithms, dynamic programming and performance comparisons between NumPy and Pandas, and personal computers versus cloud computing. The major findings of our research include the advantages of using efficient data structures, the benefits of dynamic programming in certain scenarios that saves up to 0.128J of energy, and the energy efficiency of NumPy over Pandas for numerical calculations. Additionally, the study also shows that assignment operator, sequential read, sequential write and string concatenation are 2.2 times, 1.05 times, 1.3 times and 1.01 times more energy-efficient choices, respectively, compared to their alternatives for data initialization, data access patterns, and string formatting. Our findings offer guidance for developers to optimize code for energy efficiency and inspire sustainable software development practices, contributing to a greener computing industry.

Hybrid software development, challenges and best work practices from SMEs: a systematic literature review

Hybrid software development, challenges and best work practices from SMEs: a systematic literature review

Malicious source code detection using a translation model

Modern software development often relies on open-source code sharing. Open-source code reuse, however, allows hackers to access wide developer communities, thereby potentially affecting many products. An increasing number of such "supply chain attacks" have occurred in recent years, taking advantage of open-source software development practices. Here, we introduce the Malicious Source code Detection using a Translation model (MSDT) algorithm. MSDT is a novel deep-learning-based analysis method that detects real-world code injections into source code packages. We have tested MSDT by embedding examples from a dataset of over 600,000 different functions and then applying a clustering algorithm to the resulting embedding vectors to identify malicious functions by detecting outliers. We evaluated MSDT's performance with extensive experiments and demonstrated that MSDT could detect malicious code injections with precision@k values of up to 0.909.

The Composable Data Management System Manifesto

The requirement for specialization in data management systems has evolved faster than our software development practices. After decades of organic growth, this situation has created a siloed landscape composed of hundreds of products developed and maintained as monoliths, with limited reuse between systems. This fragmentation has resulted in developers often reinventing the wheel, increased maintenance costs, and slowed down innovation. It has also affected the end users, who are often required to learn the idiosyncrasies of dozens of incompatible SQL and non-SQL API dialects, and settle for systems with incomplete functionality and inconsistent semantics. In this vision paper, considering the recent popularity of open source projects aimed at standardizing different aspects of the data stack, we advocate for a paradigm shift in how data management systems are designed. We believe that by decomposing these into a modular stack of reusable components, development can be streamlined while creating a more consistent experience for users. Towards that goal, we describe the state-of-the-art, principal open source technologies, and highlight open questions and areas where additional research is needed. We hope this work will foster collaboration, motivate further research, and promote a more composable future for data management.

Contributions of enterprise architecture to software engineering: A systematic literature review

AbstractEnterprise architecture is a growing trend that aims to help deal with the complexity of socio‐technical systems such as human organizations, as well as their information technology and systems areas. Nevertheless, the contribution of enterprise architecture to the field of software engineering remains unclear. The purpose of this systematic literature review is to see how enterprise architecture is used in software development and maintenance practice. To this end, we first carried out a search in the SCOPUS database and then organized the papers according to the Software Engineering Body of Knowledge to determine what areas of software engineering are covered by each research study. To understand how enterprise architecture is used, we established a classification based on ISO 42010 and TOGAF. From the systematic literature review, we noticed that the early stages of development are the most impacted by the enterprise architecture. On the other hand, we observed that enterprise architecture is of assistance in the areas of engineering management, engineering processes, and engineering models and methods; these tasks are carried out by teams or managers using different, often agile, development methods or standards. In turn, we found that the most common categories are architecture descriptions; these are often used to facilitate communication and information‐sharing between different stakeholders, in addition to frameworks, which will help to establish common practices in the organization related to the joint use of enterprise architecture and software development.

What do software startups need from UX work?

Empirical research on software development practices in startups is growing. However, little has been investigated about how User eXperience (UX) work has been carried out in software startups. The primary objective of this paper is to investigate what software startups need from UX work. To achieve this goal, we conducted open-ended interviews and retrospective meetings with 16 software professionals from two software startups in Brazil. We analysed the data qualitatively using different coding approaches: initial coding, focused coding, and theoretical coding. We found 14 UX work-related needs which emerged from the daily practices used for software development in the two startups studied. Based on our findings, we propose an initial theoretical framework that highlights two theoretical themes and four groups underlying the needs identified. Our study reveals several relationships between UX work-related needs which are helpful to understand in order to identify what startups need from UX work in practice and to focus startup teams' efforts on the most urgent needs. As future work, we plan to explore ways in which these needs may be addressed so that UX work may be put into practice in software startups.

UL 4600: What to Include in an Autonomous Vehicle Safety Case

UL 4600 provides an umbrella for coordinating software development practices and computer-based system safety standards to make sure nothing is left out when assuring safety.

SLR: From Saltzer and Schroeder to 2021…47 Years of Research on the Development and Validation of Security API Recommendations

Producing secure software is challenging. The poor usability of security Application Programming Interfaces (APIs) makes this even harder. Many recommendations have been proposed to support developers by improving the usability of cryptography libraries—rooted in wider best practice guidance in software engineering and API design. In this SLR, we systematize knowledge regarding these recommendations. We identify and analyze 65 papers, offering 883 recommendations. Through thematic analysis, we identify seven core ways to improve usability of APIs. Most of the recommendations focus on helping API developers to construct and structure their code and make it more usable and easier for programmers to understand . There is less focus, however, on documentation , writing requirements , code quality assessment , and the impact of organizational software development practices . By tracing and analyzing paper ancestry, we map how this knowledge becomes validated and translated over time. We find that very few API usability recommendations are empirically validated, and that recommendations specific to usable security APIs lag even further behind.

A Formal Approach for Consistency Management in UML Models

Consistency is a significant indicator to measure the correctness of a software system in its lifecycle. It is inevitable to introduce inconsistencies between different software artifacts in the software development process. In practice, developers perform consistency checking to detect inconsistencies, and apply their corresponding repairs to restore consistencies. Even if all inconsistencies can be repaired, how to preserve consistencies in the subsequent evolution should be considered. Consistency management (consistency checking and consistency preservation) is a challenging task, especially in the multi-view model-driven software development process. Although there are some efforts to discuss consistency management, most of them lack the support of formal methods. Our work aims to provide a framework for formal consistency management, which may be used in the practical software development process. A formal model, called a Structure model, is first presented for specifying the overall model-based structure of the software system. Next, the definition of consistency is given based on consistency rules. We then investigate consistency preservation under the following two situations. One is that if the initial system is inconsistent, then the consistency can be restored through repairs. The other is that if the initial system is consistent, then the consistency can be maintained through update propagation. To demonstrate the effectiveness of our approach, we finally present a case study with a prototype tool.

Agile software development and software practitioners’ productivity amidst the COVID-19 pandemic: a narrative review

PurposeAs the novel coronavirus 2019 (COVID-19) impacts the world, software practitioners are collaboratively working remotely from home. The pandemic has disrupted software practitioners’ productivity forcing changes to agile methodology adopted by software practitioners in software organizations. Therefore, this study aims to provide implication on the issues and recommendations for improving software practitioners’ productivity and also examine the impact of the COVID-19 pandemic on agile software development.Design/methodology/approachThis paper adopts a narrative literature review to provide early assessment based on secondary data from the literature and available document reports from studies published from 2019 to 2022 to explore software practitioners’ productivity and agile software development during the working from home directive amidst the COVID-19 pandemic. A total of 60 sources which met the inclusion criteria were used to provide preliminary evidence grounded on secondary data from the literature. Descriptive analysis was used to provide qualitative findings from the literature.FindingsFindings from this study present the significance of working from home directive on agile software development and software practitioners’ productivity. More importantly, findings from the secondary data shed light on software practitioners’ productivity adopting agile software development amidst the COVID-19 pandemic. Additionally, the findings present virtual collaborative platforms used by software practitioners, technical and social barriers of agile software development during the pandemic and recommendations for remote agile software development.Originality/valueThis study explores the significance of working from home directive on software practitioners’ productivity during COVID-19 pandemic and further investigates how are software practitioners’ productivity adopting agile software development practices amidst the COVID-19 pandemic. Besides, this study discusses the challenges software practitioners currently face and offers some strategies to bridge the gaps in agile software development to help software practitioners, system developers, software managers and software organizations adapt to the changes caused by the pandemic.

Towards the Integration of Security Practices in Agile Software Development: A Systematic Mapping Review

Software development must be based on more than just the experience and capabilities of your programmers and your team. The importance of obtaining a quality product lies in the risks that can be exploited by software vulnerabilities, which can jeopardize organizational assets, consumer confidence, operations, and a broad spectrum of applications. Several methods, techniques, and models have been suggested and developed to address software security. However, only a few have solid evidence for creating secure software applications. The main objective of this paper is to survey the literature for methods or models suitable for considering the integration of security in all or some of the phases of the software development life cycle and which ones are most considered or neglected. This study represents the beginning of research to generate a methodology that integrates security practices in agile software development, allowing inexperienced developers to create more secure applications.

Digital Initiatives in Academic Libraries: Challenges and Opportunities

Digital initiatives have become increasingly common in academic libraries, but inconsistent definitions, standards, and expectations limit and, in some cases, negatively impact the effectiveness of practitioners. This article explores the discourse surrounding professional titles and responsibilities in digital initiatives within North American academic libraries between 1990 and 2020. A review of job advertisements, position descriptions, and professional activities reveals ambiguously defined responsibilities, inadequate technical education, and limited opportunities for training. Current trends suggest digital initiatives will expand from traditional digitization and digital library projects toward more diverse and flexible digital project management. This change will require familiarity with software development, systems administration, and library practices. The implication for library science education is the need for course programming that reflects these trends.

Smart Automation for Enhancing Cyber-Security

In an intelligent automation ecosystem, namely in the context of Robotic Process Automation, there is a need to review the development and operation processes and practices, to combine competences from these two areas with the common good necessary for any organization or security team. It is with security that quality, efficiency, and profitability become possible. The elaboration of guidelines and best practices for the application of a DevSecOps culture is currently essential for Agile software development at any organization. In the digitalization era, teams increasingly need a collaborative method to involve several competencies and capabilities, from analysis to implementation and the evolution of a software product. Information security needs to be an integral part throughout the entire product’s lifecycle, as without it, fundamental aspects of confidentiality, integrity, and availability put information and software security at serious risk in the course of business operations. Without losing focus on customer needs, it is necessary to model software development practices, following more agile methodologies. In this way, teams can model the software throughout its lifecycle, focusing on facilitating the delivery of value to the customer and having greater certainty that requirements, plans, and results are 100% aligned with customer needs. This paper presents an analysis and proposal for the continuous improvement of an intelligent automation platform at a large-scale multinational organization. In parallel, aspects that generate resistance to the implementation of a DevSecOps methodology within the scope of RPA code development is considered.

Framework and tooling proposals for Agile certification of safety-critical embedded software in avionic systems

This article focuses on quality improvement in the development of DO-178C/ED-12C safety-critical software, optimizing development costs through the implementation of a “continuous certification” integral process. We discuss the major problems associated with traditional, V-cycle software development practices, and highlight the many advantages of adopting a “continuous certification” process based on a more Agile approach. The article proposes a framework for deploying this process, explaining the development of the framework and demonstrating its compliance with the requirements of certification standards. We also propose a tooling based on open-source, off-the-shelf solutions to implement the framework and illustrate its efficiency and effectiveness on an industrial case study.

Understanding Software‐centered Evolutive Ecosystems through Activity Theory

AbstractThis paper proposes an interdisciplinary approach aimed to bring into practice some novel Software Engineering theoretical paradigms. The premise of these news paradigms is based on the idea of “ecologies” as realities that take place in the environment of a Software product. These “ecologies” are understood as tight but flexible interactions between the human, social, and technical components involved, where Software is just another component. However, the theoretical paradigms discussed do not offer a viable way to make sense of these ecologies into the practice of Software design and development. Thus, as a more operationalized approach, this paper proposes a framework based on Networks of Activities, a concept derived from Activity Theory, as a resource to help in the design, development, and evolution of these new emergent complex socio‐technical ecologies. This framework has been conceived as a tool for the design, capture, and, especially, to analyze the evolution of these ecologies. The concepts and notations used by the proposed approach are illustrated through a proof of concept that shows the essential ideas and their use in real scenarios. In this way, the concepts discussed contribute to the improvement of related fields like Requirements Engineering, Human‐Computer Interaction, or Software Architecture, among others.

The ESCAPE Open-source Software and Service Repository

Purpose: The purpose of the ESCAPE Open-source Software and Service Repository (OSSR) is to provide a central location for the dissemination and use of trusted open-source software in the fields of astronomy, astroparticle physics, and particle physics. The repository allows users to easily access and download tools and services developed within the community, and to contribute their own tools and services. Methods: The ESCAPE project has set up a curated repository of software that provides tools and an environment to make it easy for users to find and download the software and services that they need. The repository is regularly updated and is maintained by a curation board, ensuring that the software and services are reliable and up-to-date. The curation and onboarding process makes the OSSR a trustworthy source of software that can be used for scientific analysis. The software included in the repository must include documentation and instructions and follow a set of modern best practices in software development. Training is provided to students and researchers to help them provide high-quality scientific software following modern software development practices. Outcome: The OSSR currently contains a wide range of software and services, including those for data management, data analysis, and machine learning. These tools and services are used by researchers and other users around the world. The OSSR has proven to be an effective means for disseminating and providing open-source software and services developed by the ESCAPE project partners and welcomes contributions from the entire community.

Software Development Practice as Baradian Entanglement

Software development practice is a messy, complicated, and constantly shifting human endeavor. Barad’s concept of “entanglement” helps to theorize complex sociotechnical systems. We are testing the application of this theory to understand and explain software development practices, as our work appears to be the only ethnographic research using Barad in any technology industry. Our continual aim is to understand large-scale, collaborative software development more deeply in practice and to discover appropriate theories that describe our observations and insights. Both authors are experienced software engineers and researchers. Through an ongoing longitudinal ethnographic study at a large Australian software development company, we explore, support, and improve the lived experience and practice of the software developers that work there. Ethnographic insights and an appreciation of the mutual constitution of situated phenomena have expanded over several years into an elaboration of entanglement as a more insightful explanation of software development practice. This research is having a significant impact on the participant developers and organization, including changes in measurement practices, mentoring, knowledge management, and innovation.

Exploring granular test coverage and its evolution with matrix visualizations

Current software-development tools that are used in practice make understanding the test execution of software difficult, for both granular tasks ( e.g., answering questions such as, “which test cases execute this method?”) and global tasks ( e.g., answering questions such as, “what is the proportion of unit tests to system tests?”). Current tools typically support local, file-based views of a project’s test suite and its execution data, and rarely offer a global overview. Even more rarely, do they provide access to historical information of this nature. Such global overviews can provide a larger context for a method’s execution by test cases; help identify other similar, or related methods; and even reveal similarity between individual tests. This work approaches such challenges with a novel, interactive, matrix-based visual interface that provides a global overview of a software project’s test suite, specifically in the context of the methods available in the project’s codebase. Through a series of interactive functions to sort, filter, query, and explore a test-matrix visualization, we evaluate how developers can effectively answer questions about their project’s test suite, and the code executed by such tests. We built a dynamic test-suite analysis and software-visualization tool that implements our designed interface to address the challenges of understanding the testing of software systems. With this implementation, we conducted a user study of 20 software developers to assess their ability to understand and report test execution information and measured accuracy and time. Additionally, we present a series of case studies to demonstrate a number of insights that our tool reveals. Our evaluations, performed on 26 real-world software systems, show that the interactive visualization assisted developers to answer questions about software tests and the code they execute. Further, the visualization consistently outperforms traditional development tools, both in accuracy and time taken to complete software-engineering tasks. Global-overview test matrices offer novel perspectives on test-suite composition, which can guide software development and testing practices.