Nowadays, the use of agile software development methods like Scrum is common in industry and academia. Considering the current attacking landscape, it is clear that developing secure software should be a main concern in all software development projects. In traditional software projects, security issues require detailed planning in an initial planning phase, typically resulting in a detailed security analysis (e.g., threat and risk analysis), a security architecture, and instructions for security implementation (e.g., specification of key sizes and cryptographic algorithms to use). Agile software development methods like Scrum are known for reducing the initial planning phases (e.g., sprint 0 in Scrum) and for focusing more on producing running code. Scrum is also known for allowing fast adaption of the emerging software to changes of customer wishes. For security, this means that it is likely that there are no detailed security architecture or security implementation instructions from the start of the project. It also means that a lot of design decisions will be made during the runtime of the project. Hence, to address security in Scrum, it is necessary to consider security issues throughout the whole software development process. Secure Scrum is a variation of the Scrum framework with special focus on the development of secure software throughout the whole software development process. It puts emphasis on implementation of security related issues without the need of changing the underlying Scrum process or influencing team dynamics. Secure Scrum allows even non- security experts to spot security issues, to implement security features, and to verify implementations. A field test of Secure Scrum shows that the security level of software developed using Secure Scrum is higher then the security level of software developed using standard Scrum.
There are several methods for achieving software security, e.g., Clean Room @cite_5 , Construction by Correctness @cite_11 , CMMI-DEV @cite_14 @cite_12 , etc. However, these methods cannot be used in Scrum as they clash with the characteristics of agile software development and specifically Scrum. Construction by Correctness @cite_11 for example, advocate formal development in planning, verification and testing. This is completely different to agility and flexible approaches like agile methodologies. Other models like CMMI-DEV @cite_14 @cite_12 can deal with agile methods, but they are process models. The main difference is that CMMI focuses on processes and agile development on the developers @cite_12 . This means that Scrum and other agile methodologies are developer centric, while CMMI is more process oriented. Concepts like Microsoft SDL @cite_0 are designed to integrate agile methodologies, but is also self-contained. It can not be plugged into Scrum or any other agile methodology. Scrum focuses on rich communication, self-organisation, and collaboration between the involved project members. This conflicts with formalistic and rigid concepts.
@cite_14 @cite_0 @cite_5 @cite_12 @cite_11
2087542257 2127623179 2157209130 1614607847
The rapid development of software nowadays requires the high speed software product delivery by development teams. In order to deliver the product faster, the development teams make a transformation to their conventional software development lifecycle to agile development method which can enable them towards speedy delivery of software coping with the requirements-change phenomenon. In this scenario, one of the most popular techniques in Agile development is the Scrum methodology which has been criticised in term of its security aspect cycle that ignores the security risk management activity. However, the current practices suggest that security should be considered during all stages of the software development life cycle. In order to address the aforementioned issue, this paper proposes the integration of security principles in development phases using scrum and suggests the element of security backlog that can be used as security features analysis and implementation in scrum phases. There are lots of different software metrics discovered and used for defect prediction in the literature. Instead of dealing with so many metrics, it would be practical and easy if we could determine the set of metrics that are most important and focus on them more to predict defectiveness. We use Bayesian networks to determine the probabilistic influential relationships among software metrics and defect proneness. In addition to the metrics used in Promise data repository, we define two more metrics, i.e. NOD for the number of developers and LOCQ for the source code quality. We extract these metrics by inspecting the source code repositories of the selected Promise data repository data sets. At the end of our modeling, we learn the marginal defect proneness probability of the whole software system, the set of most effective metrics, and the influential relationships among metrics and defectiveness. Our experiments on nine open source Promise data repository data sets show that response for class (RFC), lines of code (LOC), and lack of coding quality (LOCQ) are the most effective metrics whereas coupling between objects (CBO), weighted method per class (WMC), and lack of cohesion of methods (LCOM) are less effective metrics on defect proneness. Furthermore, number of children (NOC) and depth of inheritance tree (DIT) have very limited effect and are untrustworthy. On the other hand, based on the experiments on Poi, Tomcat, and Xalan data sets, we observe that there is a positive correlation between the number of developers (NOD) and the level of defectiveness. However, further investigation involving a greater number of projects is needed to confirm our findings. Under the studies of general core activities including software inspection, review and testing to achieve quality objectives in small-medium size enterprises (SMEs), the paper presents a contemporary view of such companies against quality measures. The results from a local empirical investigation of quality standards in the Turkish software industry are reported. Around 150 software companies have been approached from which 17 detailed feedback inform that in order to ensure software quality, standards including internationally recognized International Standards Organization (ISO) and Capability Maturity Model Integration (CMMI) are given credit. However the substantial workload and resources required to obtain them are also reported as serious; downscaled frameworks of such large models proposed in the literature are not well known by the SMEs either. The paper also discusses "work around" that bypasses such standards to ease delivery of products while keeping certificates as labels just to acquire new jobs for the business. Ward Cunningham in his experience report presented at the OOPSLA'92 conference introduced the metaphor of technical debt. This metaphor is related to immature, incomplete or inadequate artifacts in the software development cycle that cause higher costs and lower quality. A strategy for the technical debt management is still a challenge because its definition is not yet part of the software development process. Carolyn Seaman and Yuepu Guo proposed a technical debt management framework based on three stages. First, debts are identified and listed. After that, debts are measured by their payment efforts and then debts are selected to be considered in the software development cycle. This study evaluates the application of this framework in the real context of software projects adopting Scrum. Action research is conducted in two companies where their projects have significant technical debt. We performed three action research cycles based on the three stages of the framework for both companies. The main contribution of this paper is to provide real experiences and improvements for projects using Scrum and that may adopt the technical debt management framework proposed by Seaman and Guo. Both teams recognized that the proposed approach is feasible for being considered in the software development process after some modifications. Because of projects time constraints and ease of use, we reduced the use of the proposed metrics to two: Principal and the Current Amount of Interest. In consequence, decision-making was benefitted by the early consideration of the debts that really need to be paid. Instead of using probabilities to find the interest, these are registered every time the technical debt occurs. During the first phase, the debts identification was improved when all Scrum roles participated, while measurement and decision-making were improved when the team was responsible for these phases. The Product Owner role in both companies understood the importance of Technical Debt monitoring and prioritization during a development cycle. With these changes, the two teams mentioned they would remain using the resulting approach.