Currently, security is frequently considered late in software life cycle. It is often bolted on late in development, or even during deployment or maintenance, through activities such as add-on security software and penetration-and-patch maintenance. Even if software developers aim to incorporate security into their products from the beginning of the software life cycle, they face an exhaustive amount of ad hoc unstructured information without any practical guidance on how and why this information should be used and what the costs and benefits of using it are. This is due to a lack of structured methods. In this thesis we present a model for secure software development and implementation of a security plug-in that deploys this model in software life cycle. The model is a structured unified process, named S3P (Sustainable Software Security Process) and is designed to be easily adaptable to any software development process. S3P provides the formalism required to identify the causes of vulnerabilities and the mitigation techniques that address these causes to prevent vulnerabilities. We present a prototype of the security plug-in implemented for the OpenUP/Basic development process in Eclipse Process Framework. We also present the results of the evaluation of this plug-in. The work in this thesis is a first step towards a general framework for introducing security into the software life cycle and to support software process improvements to prevent recurrence of software vulnerabilities. / <p>Report code: LiU-Tek-Lic-2008:11.</p>

Software development is a growing part of many businesses today. The software development approach that is used to develop new software may have a positive or negative impact on the efficiency and quality of the final software product. The objective of this thesis was to propose a refined software development approach and to test it empirically. The software development approach is comprised of three main subcomponents: development style, development architecture, and technical documentation. The software development approach was applied in a case study in cooperation with Ericsson. At the completion of the case study, questionnaires were administered to Ericsson employees to evaluate the success of the software development approach. The results showed that the quality of the software product was high and Ericsson was pleased with the result. The results indicated that the development approach helped the case study be successful in some of the researched areas. The end results suggest that the proposed software process has the potential to be successful in other projects of a similar type and structure.

In vielen Bereichen des täglichen Lebens, angefangen vom Online-Banking bis hin zur Steuerung im Flugzeug, kommt Software mit laufzeitkritischen nicht-funktionalen Eigenschaften (NFE) zum Einsatz. Die Erfüllung der NFE spielt in diesen Anwendungen eine zentrale Rolle. Um dies zu erreichen, ist eine systematische und zielorientierte Behandlung dieser Anforderungen während der Entwicklung zwingend erforderlich. NFE zeichnen sich im Gegensatz zu funktionalen Eigenschaften durch besondere Merkmale aus, die ein adaptives Vorgehen zur Definition des Entwicklungsprozesses erzwingen. In der Arbeit wird eine Methodik zur kontextbasierten Anpassung von Vorgehensmodellen an laufzeitkritische NFE auf der Basis von Prozessmustern sowie das PROKRIS-Framework als unterstützende Umgebung vorgestellt.

Software development is an iterative process which is based on teamwork and information exchange. In order to keep this process running, proper informational flow control techniques in a software development company have to be applied. As number of employees grows, manual control of this process becomes inaffective and automated solutions takes over this task. The most common informational units in the software development process are defects, new features and requirements. This paper addresses problems that occur during software development process and intents to create techniques and methodologies for software defect, feature and requirement management. Following tasks are performed while automating mentioned process: a) Analysis of software development company workflow; b) Design and documentation of software defect, feature and requirement management method, which would ease information exchange in design, implementation and quality assurance stages of software development process; c) Analysis and comparision of existing similar solutions. Identification of most attaractive and useful features; d) Design and implementation of software defect, feature and requirement management system which covers newly designed information flow control method. Practical task includes designing, programming, installing and testing newly created system. Design and development is based on reusable component approach which results in several layers of reusable code.

I denna uppsats analyseras fem mjukvaruverksamheter om hur de tolkar och hur de skapar värde i sina mjukvaruprocesser. Analysen tar upp hur modellen Software Value Map kan användas som hjälpmedel för olika besluttaganden vid värdeskapande. Syftet är att förstå hur olika beslutstagande påverkar värde utfallet i varje leverans och produkt. I uppsatsen söks svaret på hur de lokala företagen tolkar och levererar värde idag. Genom att studera ekonomi- och beslutsteorier förstår vi vilken betydelse och påverkan dessa har i värdeskapandet när produkter utvecklas. Resultatet av denna studie visar att de lokala företagen prioriterar kundbaserade värdeaspekter för att generera värde. Det visar sig även finnas likheter och skillnader om företagens personal och hur företagen värdesätter olika aspekter som genererar värde. / This thesis searches for the answer of how five companies interpret and deliver value in their software processes. The analysis uses the Software Value Map model that can be used as a tool for decision making in value creation. The purpose is to understand how different decisions affect the value of each delivery and product. By studying economics and decision theories, we understand the importance and impact they have in value creation when products are developed. The result of this study shows that local businesses prioritize customer-based value aspects to generate value. There are also similarities and differences in staff and how companies value different aspects that generate value.

In vielen Bereichen des täglichen Lebens, angefangen vom Online-Banking bis hin zur Steuerung im Flugzeug, kommt Software mit laufzeitkritischen nicht-funktionalen Eigenschaften (NFE) zum Einsatz. Die Erfüllung der NFE spielt in diesen Anwendungen eine zentrale Rolle. Um dies zu erreichen, ist eine systematische und zielorientierte Behandlung dieser Anforderungen während der Entwicklung zwingend erforderlich. NFE zeichnen sich im Gegensatz zu funktionalen Eigenschaften durch besondere Merkmale aus, die ein adaptives Vorgehen zur Definition des Entwicklungsprozesses erzwingen. In der Arbeit wird eine Methodik zur kontextbasierten Anpassung von Vorgehensmodellen an laufzeitkritische NFE auf der Basis von Prozessmustern sowie das PROKRIS-Framework als unterstützende Umgebung vorgestellt.

Baigiamajame magistro darbe analizuojami rolinio modeliavimo aspektai įvairių programų sistemų kūrimo metodų ir procesų rėžiuose. Modeliavimo aspektai analizuojami objektinio programavimo evoliucijos kontekste. Apžvelgiamos įvairios prielaidos leidžiančios visuose programų sistemų kūrimo etapuose atskirti sistemos elgseną ir išreikštinai sistemą modeliuoti rolėmis. Darbe identifikuojamos programų sistemų kūrimo procesų dalys, kurios stokoja rolinio modeliavimo instrumentų. Pasiūlomi programų sistemų konstravimo etapo problemų susijusių su elgsenos modeliavimu klasikiniame objektiniame programavime sprendimo būdai. Taip pat pateikiamos programų sistemų kūrimo proceso modifikavimo rekomendacijos dėl rolinio modeliavimo panaudojimo visuose sistemos kūrimo etapuose. / Final master thesis comprises role modeling aspects in various software development processes and methods. The analysis is made in the context of object-oriented programming evolution. The survey is made on miscellaneous assumptions related to explicit role modeling and separation of system state and behaviour concerns in software development. The parts of software development process which have a lack of role modeling techniques are identified in this thesis. The suggestions of solutions to classic object-oriented programming behaviour modeling problems for software construction phase are made. Finally, the recommendations related to role modeling for software development process modification are made to support all the development phases.

As melhores práticas de engenharia de software indicam que a atividade de verificação é fundamental para se alcançar o mínimo de qualidade na construção de um software. Nos processos de desenvolvimento baseados na UML, um dos seus focos principais é detectar inconsistências nos diagramas representativos do software. No entanto, a maioria desses processos, como o Iconix, aplica apenas técnicas informais (ex: inspeções visuais nos modelos), fazendo com que muitas vezes essa atividade seja negligenciada pelos desenvolvedores. Por outro lado, com o avanço das ferramentas automatizadas de verificação, os métodos formais, tais como o Event-B, estão atraindo cada vez mais a atenção das empresas de software. Porém, ainda é difícil convencer os desenvolvedores a adotá-los, pois não estão acostumados com os conceitos matemáticos envolvidos. Assim, este trabalho apresenta uma proposta de inclusão do Event-B no Iconix, dando origem ao BIconix, um processo de desenvolvimento orientado a objetos com suporte à verificação formal de inconsistências. Mais especificamente, esta tese aborda a tradução automática dos quatro diagramas existentes no Iconix (classes, casos de uso, robustez e sequência) para o Event-B, além de mostrar como esta formalização pode auxiliar na atividade de verificação em pontos específicos e bem definidos no processo proposto. / The best practices of software engineering indicate that the verification activity is essential to achieve some quality during the software construction. In UML-based development processes, one of its main focuses is the detection of inconsistencies in diagrams that represent the software. However, most of these processes, such as Iconix, apply only informal techniques (eg. visual model inspections), often implying the negligence of that activity by developers. Moreover, with the advance of automated verification tools, formal methods, such as Event-B, are increasingly attracting the attention of software companies. However, it is still difficult to convince developers to adopt them, because they are not acquainted with some mathematical concepts. Thus, this paper presents a proposal for the inclusion of Event-B within Iconix, giving rise to BIconix, an object-oriented development process that supports automatic inconsistencies formal verification. More specifically, this thesis addresses the translation of the four existing diagrams in Iconix (classes, use cases, robustness and sequence) to Event- B, and show how this formalization can assist the verification activity in well-defined check points of the proposed process.

Os Sistemas Distribuídos (SDs) tem apresentado uma crescente complexidade no seu gerenciamento, além de possuir a necessidade de garantir Qualidade de Serviço (QoS) aos seus usuários. A Computação Autonômica (CA) surge como uma forma de transformar os SDs em Sistemas Distribuídos Autonômicos (SDAs), com capacidade de auto-gerenciamento. Entretanto, não foi encontrado um processo de desenvolvimento de software, focado na criação de SDAs. Na grande maioria dos trabalhos relacionados, simplesmente é apresentado um SD, juntamente com qual aspecto da CA deseja-se implementar, a técnica usada e os resultados obtidos. Isso é apenas uma parte do desenvolvimento de um SDA, não abordando desde a definição dos requisitos até a manutenção do software. Mais importante, não mostra como tais requisitos podem ser formalizados e posteriormente solucionados por meio do auto-gerenciamento fornecido pela CA. Esta tese foca na proposta de um processo de desenvolvimento de software voltado para SDAs. Com esse objetivo, foram integradas diferentes áreas de conhecimento, compreendendo: Processo Unificado de Desenvolvimento de Software (PU), SDs, CA, Pesquisa Operacional (PO) e Avaliação de Desempenho de Sistemas Computacionais (ADSC). A prova de conceito foi feita por meio de três estudos de caso, todos focando-se em problemas NP-Difícil, são eles: (i) otimização off-line (problema da mochila com múltiplas escolhas), (ii) otimização online (problema da mochila com múltiplas escolhas) e (iii) criação do módulo planejador de um gerenciador autonômico, visando realizar o escalonamento de requisições (problema de atribuição generalizado). Os resultados do primeiro estudo de caso, mostram que é possível usar PO e ADSC para definir uma arquitetura de base para o SDA em questão, bem como reduzir o tamanho do espaço de busca quando o SDA estiver em execução. O segundo, prova que é possível garantir a QoS do SDA durante sua execução, usando a formalização fornecida pela PO e sua respectiva solução. O terceiro, prova que é possível usar a PO para formalizar o problema de auto-gerenciamento, bem como a ADSC para avaliar diferentes algoritmos ou modelos de arquitetura para o SDA. / Distributed Systems (DSs) have an increasing complexity and do not have their management, besides having a quality of service (QoS) to its users. Autonomic Computing (AC) emerges as a way of transforming the SDs into Autonomous Distributed Systems (ADSs), with a capacity for self-management. However, your software development process is focused on creating SDAs. In the vast majority of related works, simply an SD model, along with what aspect of the AC implement, a technique used and the results obtained. This is only a part of the development of an ADS, not approaching from an definition of requirements for a maintenance of software. More importantly, it does not show how such requirements can be formalized and subsequently solved through the self-management provided by AC. This proposal aims at a software development process for the DASs. To this end, different areas of knowledge were integrated, including: Unified Software Development Process (PU), SDs, CA, Operations Research (OR) and Computer Systems Performance Evaluation (CSPE). The proof of concept was made through three case studies, all focusing on NP-Hard problems, namely: (i) off-line optimization (problem of the backpack with multiple choices), (ii) (Problem of the backpack with multiple choices) and (iii) creation of the scheduling module of an autonomic manager, aiming to carry out the scheduling of requests (problem of generalized assignment). The results of the first case study show that it is possible to use OR and CSPE to define a base architecture for the DAS in question, as well as reduce the size of the search space when SDA is running. The second, proves that it is possible to guarantee the QoS of the DAS during its execution, using the formalization provided by the OR and its respective solution. The third, proves that it is possible to use the PO to formalize the self-management problem, as well as the ADSC to evaluate different algorithms or architecture models for the ADS.

As melhores práticas de engenharia de software indicam que a atividade de verificação é fundamental para se alcançar o mínimo de qualidade na construção de um software. Nos processos de desenvolvimento baseados na UML, um dos seus focos principais é detectar inconsistências nos diagramas representativos do software. No entanto, a maioria desses processos, como o Iconix, aplica apenas técnicas informais (ex: inspeções visuais nos modelos), fazendo com que muitas vezes essa atividade seja negligenciada pelos desenvolvedores. Por outro lado, com o avanço das ferramentas automatizadas de verificação, os métodos formais, tais como o Event-B, estão atraindo cada vez mais a atenção das empresas de software. Porém, ainda é difícil convencer os desenvolvedores a adotá-los, pois não estão acostumados com os conceitos matemáticos envolvidos. Assim, este trabalho apresenta uma proposta de inclusão do Event-B no Iconix, dando origem ao BIconix, um processo de desenvolvimento orientado a objetos com suporte à verificação formal de inconsistências. Mais especificamente, esta tese aborda a tradução automática dos quatro diagramas existentes no Iconix (classes, casos de uso, robustez e sequência) para o Event-B, além de mostrar como esta formalização pode auxiliar na atividade de verificação em pontos específicos e bem definidos no processo proposto. / The best practices of software engineering indicate that the verification activity is essential to achieve some quality during the software construction. In UML-based development processes, one of its main focuses is the detection of inconsistencies in diagrams that represent the software. However, most of these processes, such as Iconix, apply only informal techniques (eg. visual model inspections), often implying the negligence of that activity by developers. Moreover, with the advance of automated verification tools, formal methods, such as Event-B, are increasingly attracting the attention of software companies. However, it is still difficult to convince developers to adopt them, because they are not acquainted with some mathematical concepts. Thus, this paper presents a proposal for the inclusion of Event-B within Iconix, giving rise to BIconix, an object-oriented development process that supports automatic inconsistencies formal verification. More specifically, this thesis addresses the translation of the four existing diagrams in Iconix (classes, use cases, robustness and sequence) to Event- B, and show how this formalization can assist the verification activity in well-defined check points of the proposed process.