Quality Management in software development is a topic that has become very important. A lot of resources and effort has been invested in making formal routines and process descriptions, which have resulted in extensive systems, so-called Quality Management Systems(QMS). This thesis investigates attitudes towards such systems, seen from both software developers and quality managers points of view. During the fall of 2005, a student project in the subject Depth Study in Software Engineering TDT4735, in form of a qualitative empirical study was performed. Through interviews with developers and quality managers in different Norwegian software companies, it identified some interesting issues to further investigate. As an extension of that depth project, this Masters' Thesis goes further into the area of Quality Management Systems, by presenting a quantitative study. The main research questions for this thesis are: RQ1 Certification today, a must or just more work? RQ2 Developers vs Managers. A battle for quality? RQ3 How make a QMS work? In addition to the main empirical study, the thesis also consists of a brief field study towards two of the largest ICT organisations in Norway, and describes what they consider to be the most interesting and challenging aspects of quality assurance and process improvement in Norwegian software industry.

This thesis presents the results of an explorative survey of industrial involvement in open source. The survey is performed in collaboration with participants from the European ITEA project, COSI (Co-development using inner & Open source in Software Intensive products). The survey was performed to explore aspects of industrial involvement in open source, as industrial management of open source project, industrial use of open source components, related development, and communication processes, and industrial relationships to the open source community. The survey is based on a survey of open source literature, structured interviews of IT industry personnel, and a questionnaire. Three Norwegian companies participated in the interviews, which were used to explore interesting issues, and to provide input to the questionnaire. The questionnaire collected answers from industrial partners in the European COSI project. Our research has an explorative research goal, and five research questions. Each research question shed light on an interesting topic, and their answers will be presented accordingly. These answers are in form of both of qualitative and quantitative answers, but primarily descriptive information. It has been found that companies participate in open source related development with the roles open source owner, open source participant, inner source participant, and user of open source components. These roles will be explained further, together with the answers to the five research questions. We start with a presentation of the motivations behind use of open source components, and the selection processes used to find, and evaluate these components. Then, experiences from companies which have started their own open source projects will be discussed. Next, we describe the use of software development methodologies from open source, within companies. Furthermore, we present results related to the impact open source, have on company internal development processes. Finally, industrial participation in open source projects by companies will be analyzed. The answers to the research questions form part of the contribution of this thesis. Some of these results are used to create guidelines for open source management, and open source component selection. We have also proposed twelve hypotheses, based on our findings. These hypotheses will work as a basis for future studies, together with other results, and our research design. Future studies may include distribution of the questionnaire to a bigger sample, focus on fewer issues, and use of other research methods to shed light on these issues.

Open source is one of the more interesting trends in software engineering today. The goal of the software engineering discipline is to increase efficiency in the development process, and maximize quality of the product. Open source development processes offer the potential for reducing costs for commercial enterprises. This master's thesis addresses how open source documents architecture, and how it uses documentation in general. Open source has a reputation of creating high quality software, but documentation of process and product is weak. This may be a hurdle for wider adoption of open source processes, as a thorough understanding of a product's qualities is central to its success. The goal is to better understand documentation requirements in open source. The study is based on participation to the Apache Derby open source project. Action research is the research method. The findings show that the Apache Derby documents its artifacts in a number of ways, but fails to aggregate it in a meaningful way. A rich set of written communication mediums compensate for this by giving developers the ability to understand the product over time. The study suggests the popularity and diffusion of an open source project may affect requirements for documentation.

In this paper I present a case study of a Norwegian development project where the development team adopted practices from Scrum in the middle of the development effort. My study shows that the developers were happy with this new development method, and among other things thought it gave them a better focus and structure for their work. Since the team only adopted practices from the Scrum method, I look at the differences between their method and Scrum and suggest a few improvements to their method based on my knowledge of Scrum and development methods in general.

Exchange and sharing of sensitive health information have to happen according to prevailing external conditions established by laws, regulations and liable authorities. These external conditions create various limitations, making requests for adaptative health information systems. Especially, when developing new solutions, defining the balance between protection of personal privacy and availability of information, is a great challenge. Several projects are working on possible solutions to the problem of sharing health information in a distributed way. Based on two different pilot projects in each of the countries Denmark, Norway and Sweden, and seen from an information security perspective, this thesis does a comparison of external conditions and various approaches to these conditions. Main focus is on the Scandinavian health legislation, but organisation of health services will also be considered briefly. The objective is to acquire new knowledge about and to contribute to the debate concerning exchange and sharing of health information. The results of this project are founded on an inductive multiple case study, and empirical data have been collected through semi-structured interviews. Through this thesis, it has become evident that health care in the Scandinavian countries is upon the whole equally organised and struggles with many of the same technological challenges. All three countries' health legislation promotes personal integrity, with Sweden as the most expressive. Nevertheless, there is a tendency towards enhancement of the patient's autonomy and a request for more united health care processes, leading to needs for new types of technological tools to ensure information security. In order to meet these requests, common national technological standards, concepts and infrastructure have become more important. In addition, the systems made have to be in accordance with Acts and regulations. Parts of the prevailing legislation are to a hindrance for exchange and sharing of information across organisational borders. The technological solutions chosen within the scope of the limiting external conditions are generally well-defined, high quality systems which have information security in focus. Still, there has become evident that some weak points exist, and there is room for improvements. In order to make health care of higher quality and ensure information security to an even larger degree, legal amendments and a more extensive national co-operation will arrange for the possibility of developing better information security solutions.

The complexity of medical work, the amount of heterogenous user groups, and the large amount of both paper-based and computer-based information systems existing at hospitals, indicate the difficulty of implementing computer-based hospital information systems. Our work is a case study of a system that handles this challenge by integrating a set of source systems in a service oriented architecture. The services and data implemented by its source systems and its architectural service layer is presented through one single portal application system. We have investigated the impact the chosen approach may have on the system's ability to provide efficient user support. Our results pointed to two main challenges; an excessive information load in the user interface, and a general scepticism to paperless information systems among the users. On the basis of our case and literature study we have tried to assess how customization of user interface components and system services, possibly could improve the user support. Our analysis suggests that extended customization should be postponed until the users are accustomed to, and have accepted the usage of, computer-based information systems in relation to the relevant activities.

Introduction The aim of this Master Thesis is to develop a software security guideline that will be used for evaluating methods and measuring security in open source projects with a high security implication such as healthcare applications for example, where the privacy and security is a crucial factor. Background Theory First section of thesis is focused on presenting the appropriate background theory that will be needed for a good understanding of the rest of the thesis, like vulnerabilities, common security attacks, definition of the client-server technology, risk analysis and specific theory about Indivo and the healthcare field. Methods The method chosen to develop the guideline was the waterfall model as time was quite limited and only one iteration could be done. That’s why no other methods like the spiral model were used, as they require several iterations until achieving functionality. Results After applying the guideline, several vulnerabilities were found, like session hijacking or capturing login information on real time. The guideline proved to be useful in revealing serious security issues that should be fixed, and into describing the purpose and the logic of decisions made in early stages like organizational or design stage. Conclusion Both the development of the Security Guideline and the posterior testing of the guideline were considered successful, as a working methodology was established and several security issues were revealed in Indivo.

This report presents an approach to product family management using semantic technologies. There is a need for more flexible configuration management and pricing, explicitly representing domain knowledge and configuration rules. The thesis investigates requirements, needs and current issues to support product family in order to figure out the best candidate technologies. Ontology and rules are chosen to carry out the project. Our approach is applied to a case study provided by Det Norske Veritas Software, a company offering solutions for maritime, offshore and process industries. The contacts with the company have strengthened our work as the client helped us to clarify the problem and validate the suggested method. The report discusses pros and cons of semantic technologies applied in this context. Semantic technologies and rules help to create highly flexible system that allows supporting product family engineering. Our work highlights consistency improvements and redundancy diminution in features models.

This thesis presents the results of a survey of Open Source Licensing literature. It aims to assist the reader in choosing the best license for his/her business. For this reason, the content of this thesis can be divided into: (i) an open source licensing overview, (ii) the explication of the main features of the most popular open source licenses, (iii) the consequences of using one or another and (iv) the critical or controversial issues related to Open Source Licensing. Furthermore, at the end of the thesis, the reader can ¯nd the method we followed to collect, classify and analyze the relevant information for the purpose of the survey.

Empirical research is performed to verify theories, develop new theories, or extend the existing ones, and improve practice. This study is mainly used to gain understanding about the selection of OSS components with the ultimate goal to improve the software development practice in industry, particularly to improve the practice of selection of OSS components. This study does can not be used directly to improve the practice of selection and evaluation of OSS components, because further and larger studies needs to be performed in the future to support our results. It is anyway a good step toward the final goal. We have used the role: integrator of open source, because this is the most appropriate for the research we have performed. More and more companies integrate open source components in their products because the benefits are large. Therefore, improving the practice about the selection of OSS components may help software companies to decrease the time spent. If the time spent is too large, this can offset the advantages of integrating OSS components. The results of the interview are presented, 16 descriptive findings are formulated based on this. The literature study was very useful to gain understanding about the state-off-the-art but also to define the research questions.