While microservice architectures have become a widespread option for designing distributed applications, designing secure microservice systems remains challenging. Although various security-related guidelines and practices exist, these systems' sheer size, complex communication structures, and polyglot tech stacks make it difficult to manually validate whether adequate security tactics are applied throughout their architecture. To address these challenges, we have devised a novel solution that involves the automatic generation of security-annotated software decomposition models and the utilization of security-based metrics to guide software architectures through the assessment of security tactics employed within microservice systems. To evaluate the effectiveness of our artifacts, we conducted a controlled experiment where we asked 60 students from two universities and ten experts from the industry to identify and assess the security features of two microservice reference systems. During the experiment, we tracked the correctness of their answers and the time they needed to solve the given tasks to measure how well they could understand the security tactics applied in the reference systems. Our results indicate that the supplemental material significantly improved the correctness of the participants' answers without requiring them to consult the documentation more. Most participants also stated in a self-assessment that their understanding of the security tactics used in the systems improved significantly because of the provided material, with the additional diagrams considered very helpful. In contrast, the perception of architectural metrics varied widely. We could also show that novice developers benefited most from the supplementary diagrams. In contrast, senior developers could rely on their experience to compensate for the lack of additional help. Contrary to our expectations, we found no significant correlation between the time spent solving the tasks and the overall correctness score achieved, meaning that participants who took more time to read the documentation did not automatically achieve better results. As far as we know, this empirical study is the first analysis that explores the influence of security annotations in component diagrams to guide software developers when assessing microservice system security.

Software portfolios of today’s companies are comprised of a variety of heterogeneous, modular, and often polyglot software solutions. Ensuring high-quality standards across these entire portfolios raises additional challenges for quality engineers and requires new strategies and visualization approaches to support software quality management decisions. In this paper, we study the information needs of software quality engineers that drive these decisions on portfolio-level and propose Portfoliotrix -an expert visualization prototype for a portfolio-wide analysis and comparison of software quality metric trends. For this, we first introduce our four-phase fully automated data-mining process for gathering and aggregating quality metric data from the underlying software repositories. We then present our application frontend that implements different visualization and filtering concepts to satisfy eight specific information needs derived from our prior qualitative semi-structured expert interviews. A final scenario-based expert evaluation confirms the practical relevance of our prototype. Experts took less time to complete quality-related management tasks with our tool than they had estimated when relying only upon existing toolsets. Moreover, our visualization system reached the System Usability Scale (SUS) score of "good" with 76.7 points.