Abstract Global software development (GSD) refers to developing software with a distributed team spanning multiple locations and time zones. Based on relationships, there are four types of outsourcing: dyadic (one client–one vendor), multi‐vendor (one client–many vendors), co‐sourcing (many clients–one vendor), and complex outsourcing (many clients–many vendors). Compared to the other types of outsourcing contracts, complex outsourcing contracts are the hardest to work on and have the highest risk of project failure. This paper presents a model, the complex outsourcing relationships management model (CORMM), to assist the complex outsourcing stakeholders (both the clients and vendors) in managing their relationships in the context of GSD. This paper aims to develop a CORMM to assist the complex outsourcing relationships management stakeholders in GSD. Also, we are interested in identifying the applicability and effectiveness of the CORMM in the real‐world industry. The research approach follows a structured methodology comprising multiple phases. Initially, it leverages a systematic literature review (SLR) as its primary research method. The second phase involves the validation of the SLR findings via an empirical study. Subsequently, in the third phase, a model is developed. Finally, the proposed research approach is validated by incorporating two industrial case studies to assess the organization's relationship management utilizing the Motorola tool. The case study results show that CORMM can successfully point out relationship management issues in a complex outsourcing context. The feedback received from the participants of both companies indicates several positive and valuable insights about the CORMM and its application in the context of complex outsourcing relationships. The results highlight that CORMM serves as an assessment tool for evaluating an organization's relationship management capability and a means for organizations to enhance their position. Through CORMM, complex outsourcing organizations (many clients–many vendors) can identify strengths and weaknesses in their relationship management practices, enabling targeted improvement efforts.

ABSTRACT Cybersecurity is a critical component of digital transformation, as the two must be integrated to enable business modernization and the adoption of innovative technologies while ensuring system security. Modern technologies introduce increasingly complex threats as more data is stored, transmitted, and processed across systems. Threats include the violation or misuse of data, such as data corruption, data theft, or a privacy violation. Determining if an organization applies the best practices requires measurements using maturity models. Several maturity models with different goals and qualities have been developed. However, no cybersecurity maturity model is related to digitally enabled or transforming organizations. The objective of this study is to develop a model that measures cybersecurity maturity for digitally transformed organizations. The model aims to provide a customizable assessment method for organizations of different sizes and domains. Two multivocal literature reviews (MLRs) were conducted to identify the available maturity models and best practices from formal and grey literature. After analyzing 165 studies, seven cybersecurity categories, as the capability areas, and 22 practice areas, were identified. Moreover, an assessment tool that supports self‐assessment was developed. Finally, the model was evaluated through five case studies and expert judgments. As a result, a cybersecurity maturity model for digitally transformed organizations is developed, along with its assessment methodology and automation tool. The model evaluation showed promising results in terms of the ability to identify the maturity level.

Context: In today's interconnected digital landscape, cultivating a robust Information Security culture within organizations is imperative to mitigate data breaches and unauthorized access risks.

Context: Agile methodologies have gained immense popularity in software development organizations for their numerous advantages, like increased flexibility and better customer satisfaction. However, integrating security measures into Agile practices presents significant challenges and complexities.

Abstract Security is an essential attribute of high‐quality software. However, effectively incorporating security practices into different phases of the software development life cycle (SDLC) remains challenging. Owing to less mature secure testing processes, organizations are prone to ineffective testing practices for defect detection, including severe security‐related failures. Thus, in this study, we present a maturity model for secure software testing (MMSST) to assist software development organizations in improving the secure testing of software applications. We conducted a multivocal literature review and identified 68 primary studies from the formal and gray literature. Then, based on the available evidence, 27 process areas were identified to develop the proposed MMSST. The MMSST includes five main categories: governance, contrive and design, execution, deployment and configuration, and mature. The MMSST was subsequently evaluated using case studies related to practical environments. Results demonstrate that the proposed MMSST is useful for estimating the maturity level of an organization with respect to the secure testing phase of the SDLC. The participants of the case studies also agreed that the proposed MMSST is useful in terms of structure, user satisfaction, and ease of use. We believe that the proposed MMSST can help organizations evaluate and improve software security testing practices. In addition, the proposed MMSST is expected to provide researchers and industry practitioners with an effective foundation for developing new secure testing approaches and tools.

Abstract Context Organizations constantly strive to protect their assets from outsider attacks by implementing various security controls, such as data encryption algorithms, intrusion detection software, firewalls, and antivirus programs. Unfortunately, attackers strike not only from outside the organization but also from within. Such internal attacks are called insider attacks or threats, and the people responsible for them are insider attackers or insider threat agents. Insider attacks pose more significant risks and can result in greater organizational losses than outsider attacks. Thus, every organization should be vigilant regarding such attackers to protect its valuable resources from harm. Finding solutions to protect organizations from such attacks is critical. Despite the importance of this topic, little research has been conducted on providing solutions to mitigate insider attacks. Objective This study aims to develop an organizational readiness model to assess an organization's readiness for insider attacks. Method We conducted a multivocal literature review to identify practices that can be used to assess organizations' readiness against insider attacks. These practices were grouped into different knowledge areas of insider attacks for organizations. The insider attack readiness model was developed using identified best practices and knowledge areas: compliance, top management, human resources, and technical. Results This model was evaluated at two levels—academic and real‐world environments. The evaluation results show that the proposed model can identify organizations' readiness against insider attacks. Conclusion The proposed model can guide organizations through a secure environment against insider attacks.

Software deployment is the last stage of the software development life cycle (SDLC). It includes the execution of software in a customer environment. Nowadays, security has been integrated with the SDLC stages to produce secure software, improve software quality, and increase customer satisfaction. However, the software has become complex in recent execution environments, putting more pressure on securely deploying the software in these environments. This work extends our previous study published in [11], in which we have identified a list of best practices to address the secure software deployment challenges.

Abstract The heart of the application's secure operation is its software code. If the code contains flaws, the entire program might be hacked. The issue with software vulnerabilities is that they reveal coding flaws that hackers could exploit. The prevention of cybersecurity issues begins with the program code itself. When writing software code, a software developer must consider expressing the application's architecture and design requirements, keeping the code streamlined and efficient, and ensuring the code is safe. Secure code helps save the system from various cyber‐attacks by eliminating the weaknesses that many hacks rely on. To assist the software organization in Secure Software Coding (SSC), this article proposes a readiness model for SSC, namely SSCRM. The proposed model has five levels; SSC challenges and best practices (BP) are mapped at each level. The proposed model will help the organizations better understand SSC challenges and BPs and provide a roadmap for developing secure software code. The proposed model was evaluated using three case studies. The findings demonstrate that the proposed approach helps determine an organization's SSC level.

Artificial intelligence (AI) solutions and technologies are being increasingly adopted in smart systems contexts; however, such technologies are concerned with ethical uncertainties. Various guidelines, principles, and regulatory frameworks are designed to ensure that AI technologies adhere to ethical well-being. However, the implications of AI ethics principles and guidelines are still being debated. To further explore the significance of AI ethics principles and relevant challenges, we conducted a survey of 99 randomly selected representative AI practitioners and lawmakers (e.g., AI engineers and lawyers) from 20 countries across five continents. To the best of our knowledge, this is the first empirical study that unveils the perceptions of two different types of population (AI practitioners and lawmakers) and the study findings confirm that transparency, accountability, and privacy are the most critical AI ethics principles. On the other hand, lack of ethical knowledge, no legal frameworks, and lacking monitoring bodies are found to be the most common AI ethics challenges. The impact analysis of the challenges across principles reveals that conflict in practice is a highly severe challenge. Moreover, the perceptions of practitioners and lawmakers are statistically correlated with significant differences for particular principles (e.g. fairness and freedom) and challenges (e.g. lacking monitoring bodies and machine distortion). Our findings stimulate further research, particularly empowering existing capability maturity models to support ethics-aware AI systems’ development and quality assessment.

research-article Share on Challenges of Secure Software Deployment: An Empirical Study Authors: Azzah A. Alghamdi King Fahd University of Petroleum and Minerals, SA and Imam Abdulrahman Bin Faisal University, Saudi Arabia King Fahd University of Petroleum and Minerals, SA and Imam Abdulrahman Bin Faisal University, Saudi ArabiaView Profile , Mahmood Niazi King Fahd University of Petroleum and Minerals, SA King Fahd University of Petroleum and Minerals, SAView Profile Authors Info & Claims EASE '22: Proceedings of the International Conference on Evaluation and Assessment in Software Engineering 2022June 2022 Pages 440–445https://doi.org/10.1145/3530019.3531337Online:13 June 2022Publication History 0citation39DownloadsMetricsTotal Citations0Total Downloads39Last 12 Months39Last 6 weeks7 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my Alerts New Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Ethics in AI becomes a global topic of interest for both policymakers and academic researchers. In the last few years, various research organizations, lawyers, think tankers, and regulatory bodies get involved in developing AI ethics guidelines and principles. However, there is still debate about the implications of these principles. We conducted a systematic literature review (SLR) study to investigate the agreement on the significance of AI principles and identify the challenging factors that could negatively impact the adoption of AI ethics principles. The results reveal that the global convergence set consists of 22 ethical principles and 15 challenges. Transparency, privacy, accountability and fairness are identified as the most common AI ethics principles. Similarly, lack of ethical knowledge and vague principles are reported as the significant challenges for considering ethics in AI. The findings of this study are the preliminary inputs for proposing a maturity model that assesses the ethical capabilities of AI systems and provides best practices for further improvements.

There is a significant need to give careful consideration to the Capability Maturity Model Integration (CMMI) level 2 specific practices (i.e. SP 1.1 ‘understand requirements’ and SP 1.2 ‘obtain commitment to requirements’), especially in the context of small‐ and medium‐sized software development organisations, in order to assist such organisations in effectively managing their requirements engineering processes. In this study, the authors propose an abstract‐level model for each of these two specific practices as well as cover the initial evaluation of the models. In addition, necessary templates and checklists are also provided for each proposed model. The proposed models are based on a significant amount of research in software process improvement, CMMI and requirements engineering. The initial evaluation of the proposed models was executed using an expert panel review process. The results showed that the proposed models provide ease of learning and ease of use, provide stakeholder satisfaction and can be applied to small‐and medium‐sized software development organisations. It is important to highlight that this study contributes not only to the implementation of SP 1.1 and SP 1.2 of REQM process area in the context of small‐ and medium‐sized software development organisations but also to the body of knowledge on REQM.

Abstract In global software development (GSD), software is developed by a team of geographically dispersed people. Many organizations that develop projects globally do not evaluate their project management readiness to undertake such projects. The objective of this paper is to propose a global project management readiness framework (GLOB) to help organizations in evaluating and assessing their GSD project management readiness to improve their capabilities in managing GSD projects. To develop GLOB, three systematic literature reviews (SLRs) were conducted. For each SLR, an empirical study was conducted with GSD practitioners to validate the SLR results in a real‐world environment. We identified 45 factors that can play a positive or negative role in global project management readiness. In total, 305 best practices were identified for global project management. Based on the findings of the SLRs and empirical studies, GLOB was developed. Two case studies were conducted to evaluate GLOB in a real‐world context. The case study results show that GLOB has the potential to measure an organization's project management readiness for global projects. It is hoped that GLOB will provide GSD practitioners with the ability to understand the strengths and weaknesses of current project management processes and to address weak areas.

Abstract The need to ensure the quality of software is growing in importance on a daily basis due to the growing role of software in critical products and application areas, such as defense, aerospace, aviation, and medicine. To meet this need, many organizations use the Capability Maturity Model Integration process model to assess and improve software development processes. This paper proposes a framework for measuring software product maturity as an indicator of product quality. The proposed framework consists of two parts: a reference model and an assessment method. The reference model provides a platform for gathering product quality indicators as evidence of product capability, which reflects the product's maturity. The quality indicators are then used to assess the product maturity level. The assessment method utilizes standard steps for assessing product maturity that are reflected in the degree of the product's conformance with the relevant quality attributes defined and agreed upon by the product's stakeholders. The proposed framework enables measuring the quality of the product from the developers' and the users' perspective. The proposed maturity model and the assessment method can help software organizations and software clients ensure that software products meet the appropriate quality levels.

Abstract Software development firms have begun adopting the practice of global software development (GSD). The main reason for the shift toward globalization is the various benefits received by software development firms. However, there are several issues faced by GSD organizations, particularly those associated with software process improvement (SPI). It has been noticed that a formal process improvement approach could assist in successfully executing development activities in GSD. The core objective of this research work is to develop a global software engineering process improvement model (GSEPIM) to assess and improve software process activities in a GSD environment. The proposed model will be developed based on existing models in other domains, an empirical study conducted with GSD practitioners, and an understanding of critical success factors and challenges of SPI. In this study, the first step in the development of GSEPIM is completed by identifying the challenges of SPI in GSD and presenting a solution in the form of a robust framework.

Abstract Bad smells tend to have a negative impact on software by degrading its quality. It is beneficial to detect model smells to avoid their propagation to later stages of software development. The objective of this paper is to present the state‐of‐the‐art research on techniques for detecting UML model bad smells. The detection techniques are compared and evaluated using a proposed evaluation framework. The framework consists of two parts. The first part of the framework compares the techniques in terms of the implemented approach, the investigated model, and the explored model smells, while the experimental design is explored in the second part of the framework. We found that the detection of bad smells in class and sequence diagrams is accomplished via design patterns, software metrics, and predefined rules, while model smells in use cases are detected using metrics and predefined rules. We also found that the class diagram is the most investigated UML model in the context of model smell detection, whereas there is a lack of work on other UML models. In addition, there is a scarcity of independent studies on sequence diagrams. Furthermore, the studies investigating class diagrams are mostly validated, whereas use case diagrams and sequence diagrams are rarely validated.

Managing communication in collaborative global software development (GSD) projects is both critical and challenging. While social computing has received much attention from practitioners, social computing adoption is still an emerging research area in GSD. This research paper provides a review of the academic research in social computing and identifies motivators for adopting social computing in the GSD context. We applied the systematic literature review (SLR) and questionnaire survey with 35 software industry experts to address the research objective. Firstly, we implemented a formal SLR approach and identified an initial set of social computing adoption motivators. Secondly, a questionnaire survey was developed based on the SLR and was tested by means of a pilot study. The findings of this combined SLR and questionnaire survey indicate that real-time communication and coordination, knowledge acquisition, expert feedback, and information sharing are the key factors that motivate social computing adoption in GSD projects. The results of t test (ie, t = .558, P = .589) show that there is no significant difference between the findings of SLR and questionnaire. The results of this study suggest the need for developing social computing strategies and policies to guide the strategic adoption of social computing tools in GSD projects.

Over the last decade, an increasing number of organizations have started software development in a globally distributed environment. One of the major challenges is that many organizations endorse the process of global software development without testing their management readiness for the globally distributed development activity. This includes work distribution through task allocation in the globally distributed development environment. The objective of this research paper is to identify factors that influence task allocation in global software development through carrying out a systematic literature review. We used customized search terms, derived from our research question, to identify literature on work distribution and task allocation in a global context. We identified criteria such as site technical expertise, time zone difference, resource cost, task dependency, vendor reliability, task size and vendor maturity level as key task allocation factors in globally distributed software projects. Based on the systematic literature review results, we suggest that there is a need to develop work distribution strategies and standards through global task allocation to help software development organizations in achieving the true potential of global software development at lower development costs and shorter time-to-market.

Context: The use of Systematic Literature Review (SLR) requires expertise and poses many challenges for novice researchers. The experiences of those who have used this research methodology can benefit novice researchers in effectively dealing with these challenges. Objective: The aim of this study is to record the reported experiences of conducting Systematic Literature Reviews, for the benefit of new researchers. Such a review will greatly benefit the researchers wanting to conduct SLR for the very first time. Method: We conducted a tertiary study to gather the experiences published by researchers. Studies that have used the SLR research methodology in software engineering and have implicitly or explicitly reported their experiences are included in this review. Results: Our research has revealed 116 studies relevant to the theme. The data has been extracted by two researchers working independently and conflicts resolved after discussion with third researcher. Findings from these studies highlight Search Strategy, Online Databases, Planning and Data Extraction as the most challenging phases of SLR. Lack of standard terminology in software engineering papers, poor quality of abstracts and problems with search engines are some of the most cited challenges. Conclusion: Further research and guidelines is required to facilitate novice researchers in conducting these phases properly.

Causes of requirement change - A systematic literature review

CONTEXT: Previous work suggests that half of the companies that have tried global software development (GSD) have failed to realise the anticipated outcomes, the root cause of which is often related to requirements problems. Despite the importance of this problem, little research has been carried out to improving requirements engineering process in the GSD projects. OBJECTIVE: In this paper an ongoing project is discussed which will bring together the work of researchers and software development experts to develop a framework for the requirements engineering process of global software development projects (GlobReq). Managers of GSD projects will be able to use GlobReq to plan a requirements engineering process suitable for a specific GSD project. In this paper the need for such a framework along with the proposed methodology, novelty and the preliminary results are discussed. METHODOLOGY: The basis of the GlobReq framework is Sommerville et al's framework of 66 requirements best practices as well as our empirical study with GSD organisations. INITIAL RESULTS: The initial findings from 5 organisations are interesting to observe that not all 66 RE best practices are perceived as high value practices for GSD projects.

Context: There has been an increase in research into global software development (GSD) and in the number of systematic literature reviews (SLRs) addressing this topic. Objective: The aim of this research is to catalogue GSD SLRs in order to identify the topics covered, the active researchers, the publication vehicles, and to assess the quality of the SLRs identified. Method: We performed a broad automated search to find SLRs dealing with GSD. We differentiate between SLR studies and papers reporting those studies. Data relating to each of the following was extracted and synthesized from each study: authors and their affiliation at the time of publication, the journal or conference in which the paper was published, the quality of each study and the main GSD study topic. Results: Twenty-four GSD SLR studies and 37 papers reporting those studies were identified. Major GSD topics covered include: (1) organizational environment, (2) project execution, and (3) project planning and control. The main research groups are based in Brazil (17), Ireland (8), and Sweden (7). Conclusions: GSD SLR studies are most frequently reported in the International Conference on Global Software Engineering and IEEE Software; the two most popular topics for research are risk factors due to the organizational environment and the development process. The most active researchers are based in Brazil. The quality of the SLR studies has not changed over time.

SUMMARY Software process improvement (SPI) initiatives have been around for many years, yet many companies are still facing SPI implementation problems. The objective of this exploratory research is to gain an in‐depth understanding of risks that can undermine SPI implementation from the perspective of software development practitioners. Interviews were conducted as the main approach of data collection from 34 SPI practitioners. Interviews were recorded and subsequently transcribed. The interview transcripts were systematically scrutinised to identify the major themes for SPI implementation. The identified themes were noted down and compared with the notes made during the interviews to ascertain that the former are indeed a true reflection of the discussion in the interviews. This two‐step process also verified that the transcription process had not changed the original data generated in the interviews. Five SPI risks were identified from the interview data: organisational politics, lack of support, lack of defined SPI implementation methodology, lack of awareness and lack of resources that are generally considered critical by Australian practitioners. The results also reveal the similarities and the differences in the risks identified by different group of practitioners (i.e. developers, managers and senior managers), different type of organisations (i.e. small–medium and large) and organisations with mature and immature software development processes. Practitioners identify SPI risks based on previous SPI implementation experience. Copyright © 2011 John Wiley & Sons, Ltd.

Software development outsourcing is a contract-based relationship between client and vendor organisations in which a client(s) contracts out all or part of its software development activities to a vendor(s), who provides agreed services for remuneration. The objective of this paper is to identify various barriers that have a negative impact on software outsourcing clients in the selection process of offshore software development outsourcing vendors. We have performed a Systematic Literature Review process for the identification of barriers. We have identified barriers `language and cultural barriers', `country instability', `lack of project management', `lack of protection for intellectual property rights' and `lack of technical capability' that are generally have a negative impact on outsourcing clients. The results also reveal the similarities and differences in the barriers identified in different continents. We suggest vendors have to address different barriers in order to compete in the offshore outsourcing business.

This study aims to compare the use of targeted manual searches with broad automated searches, and to assess the importance of grey literature and breadth of search on the outcomes of SLRs. We used a participant-observer multi-case embedded case study. Our two cases were a tertiary study of systematic literature reviews published between January 2004 and June 2007 based on a manual search of selected journals and conferences and a replication of that study based on a broad automated search. Broad searches find more papers than restricted searches, but the papers may be of poor quality. Researchers undertaking SLRs may be justified in using targeted manual searches if they intend to omit low quality papers; if publication bias is not an issue; or if they are assessing research trends in research methodologies.

CONTEXT - Offshore software development outsourcing is a modern business strategy for producing high quality software at low cost. OBJECTIVE - To identify various Critical Success Factors (CSFs) that have a positive impact on software outsourcing clients in the selection process of offshore software development outsourcing vendors. METHOD - We have performed a Systematic Literature Review process for the identification of factors in the selection process of offshore software development outsourcing vendors. RESULTS - We have identified factors dasiacost-savingpsila, dasiaskilled human resourcepsila, dasiaappropriate infrastructurepsila and dasiaquality of product and servicespsila that are generally considered important by the outsourcing clients. The results also reveal the similarities and differences in the factors identified in different continents. CONCLUSIONS - Cost-saving should not be considered as the only prime factor in the selection process of software development outsourcing vendors. Vendors should have to address other factors in order to compete in the offshore outsourcing business.

There is a vital need for gaining a solid understanding of different aspects of implementing SPI initiatives in organizations involved in software outsourcing and/or off-shoring, which are parts of Global Software Development (GSD) phenomenon. However, little attention has been paid to understand difficulties and challenges involved in implementing SPI programs in developing countries like Vietnam and Malaysia, which are emerging as key players in the context of GSD. This paper presents findings from an empirical study aimed at exploring practitioners' experiences and perceptions of different aspects of implementing SPI initiatives. Face-to-face meeting sessions were conducted with twenty-three software development practitioners from eight Vietnamese software development organisations, which were involved in software outsourcing contracts and had initiated SPI programs. The results provide interesting insights into different aspects of SPI initiatives. We expect that the findings can provide some advice to SPI practitioners on what needs to be addressed when developing SPI implementation initiatives in countries like Vietnam.

Software development outsourcing has been growing steadily. However significant outsourcing failure rates have also been reported. One of the major issues in outsourcing business is that many organisations undertake software outsourcing initiatives without knowing whether or not they are ready to undertake them. The objective of this project is to develop a readiness model in order to measure the organisationpsilas (vendor) readiness for software development outsourcing. Two types of data will be collected in this research project: firstly, factors that can have a positive or negative impact on software outsourcing clients in the selection of software development outsourcing vendors; and secondly, how one can implement these factors. The anticipated outcome of this project will be a software outsourcing readiness model to assist software practitioners in the design of effective software outsourcing strategies. This model should assist outsourcing vendors in measuring the strength or weakness of software outsourcing activities.

A systematic review is a defined and methodical way to identify, assess and analyse published primary studies in order to investigate a specific research question. Kitchenham has recently published guidelines for software engineering researchers performing systematic reviews. The objective of our paper is to critique Kitchenham’s guidelines and to comment on systematic review generally with respect to our experiences conducting our first systematic review. Our perspective as neophytes may be particularly illuminating for other software engineering researchers who are also considering conducting their first systematic review. Overall we can recommend Kitchenham’s guidelines to other researchers considering systematic reviews. We caution researchers to clearly and narrowly define the research questions they will investigate by systematic review, to reduce the overall effort and to improve the quality of the selection of papers and extraction of data. In particular we recommend defining complementary research questions that are not within the scope of the systematic review in order to clarify the boundaries of the specific research question of interest. An instance of this recommendation is that researchers should clearly define the unit of study for the systematic review.