Experimenting with Realism in Software Engineering Team Projects: An Experience Report

Over Several years, we observed that our students were sceptical of Software Engineering practices, because we did not convey the experience and demands of production quality software development. Assessment focused on features delivered, rather than imposing responsibility for longer term `technical debt'. Academics acting as 'uncertain' customers were rejected as malevolent and implausible. Student teams composed of novices lacked the benefits of leadership provided by more experienced engineers. To address these shortcomings, real customers were introduced, exposing students to real requirements uncertainty. Flipped classroom teaching was adopted, giving teams one day each week to work on their project in a redesigned laboratory. Software process and quality were emphasised in the course assessment, imposing technical debt. Finally, we introduced a leadership course for senior students, who acted as mentors to the project team students. This paper reports on the experience of these changes, from the perspective of different stakeholders

Formalising responsibility modelling for automatic analysis

Modelling the structure of social-technical systems as a basis for informing software system design is a difficult compromise. Formal methods struggle to capture the scale and complexity of the heterogeneous organisations that use technical systems. Conversely, informal approaches lack the rigour needed to inform the software design and construction process or enable automated analysis. We revisit the concept of responsibility modelling, which models social technical systems as a collection of actors who discharge their responsibilities, whilst using and producing resources in the process. Responsibility modelling is formalised as a structured approach for socio-technical system requirements specification and modelling, with well-defined semantics and support for automated structure and validity analysis. The effectiveness of the approach is demonstrated by two case studies of software engineering methodologies

A defence of predicativism as a philosophy of mathematics

A specification of a mathematical object is impredicative if it essentially involves quantification over a domain which includes the object being specified (or sets which contain that object, or similar). The basic worry is that we have no non-circular way of understanding such a specification. Predicativism is the view that mathematics should be limited to the study of objects which can be specified predicatively. There are two parts to predicativism. One is the criticism of the impredicative aspects of classical mathematics. The other is the positive project, begun by Weyl in Das Kontinuum (1918), to reconstruct as much as possible of classical mathematics on the basis of a predicatively acceptable set theory, which accepts only countably infinite objects. This is a revisionary project, and certain parts of mathematics will not be saved. Chapter 2 contains an account of the historical background to the predicativist project. The rigorization of analysis led to Dedekind's and Cantor's theories of the real numbers, which relied on the new notion of abitrary infinite sets; this became a central part of modern classical set theory. Criticism began with Kronecker; continued in the debate about the acceptability of Zermelo's Axiom of Choice; and was somewhat clarified by Poincaré and Russell. In the light of this, chapter 3 examines the formulation of, and motivations behind the predicativist position. Chapter 4 begins the critical task by detailing the epistemological problems with the classical account of the continuum. Explanations of classicism which appeal to second-order logic, set theory, and primitive intuition are examined and are found wanting. Chapter 5 aims to dispell the worry that predicativism might collapses into mathematical intuitionism. I assess some of the arguments for intuitionism, especially the Dummettian argument from indefinite extensibility. I argue that the natural numbers are not indefinitely extensible, and that, although the continuum is, we can nonetheless make some sense of classical quantification over it. We need not reject the Law of Excluded Middle. Chapter 6 begins the positive work by outlining a predicatively acceptable account of mathematical objects which justifies the Vicious Circle Principle. Chapter 7 explores the appropriate shape of formalized predicative mathematics, and the question of just how much mathematics is predicatively acceptable. My conclusion is that all of the mathematics which we need can be predicativistically justified, and that such mathematics is particularly transparent to reason. This calls into question one currently prevalent view of the nature of mathematics, on which mathematics is justified by quasi-empirical means.Supported by the Arts and Humanities Research Council [grant number 111315]

Enhancing security incident response follow-up efforts with lightweight agile retrospectives

Security incidents detected by organizations are escalating in both scale and complexity. As a result, security incident response has become a critical mechanism for organizations in an effort to minimize the damage from security incidents. The final phase within many security incident response approaches is the feedback/follow-up phase. It is within this phase that an organization is expected to use information collected during an investigation in order to learn from an incident, improve its security incident response process and positively impact the wider security environment. However, recent research and security incident reports argue that organizations find it difficult to learn from incidents. A contributing factor to this learning deficiency is that industry focused security incident response approaches, typically, provide very little practical information about tools or techniques that can be used to extract lessons learned from an investigation. As a result, organizations focus on improving technical security controls and not examining or reassessing the effectiveness or efficiency of internal policies and procedures. An additional hindrance, to encouraging improvement assessments, is the absence of tools and/or techniques that organizations can implement to evaluate the impact of implemented enhancements in the wider organization. Hence, this research investigates the integration of lightweight agile retrospectives and meta-retrospectives, in a security incident response process, to enhance feedback and/or follow-up efforts. The research contribution of this paper is twofold. First, it presents an approach based on lightweight retrospectives as a means of enhancing security incident response follow-up efforts. Second, it presents an empirical evaluation of this lightweight approach in a Fortune 500 Financial organization's security incident response team

Rethinking Security Incident Response: The Integration of Agile Principles

In today's globally networked environment, information security incidents can inflict staggering financial losses on organizations. Industry reports indicate that fundamental problems exist with the application of current linear plan-driven security incident response approaches being applied in many organizations. Researchers argue that traditional approaches value containment and eradication over incident learning. While previous security incident response research focused on best practice development, linear plan-driven approaches and the technical aspects of security incident response, very little research investigates the integration of agile principles and practices into the security incident response process. This paper proposes that the integration of disciplined agile principles and practices into the security incident response process is a practical solution to strengthening an organization's security incident response posture.Comment: Paper presented at the 20th Americas Conference on Information Systems (AMCIS 2014), Savannah, Georgi

Behave Nicely! Automatic Generation of Code for Behaviour Driven Development Test Suites

Behaviour driven development (BDD) has gained widespread use in the software industry. System specifications can be expressed as test scenarios, describing the circumstances, actions and expected outcomes. These scenarios are written in a structured natural language (Gherkin), with each step in the scenario associated with a corresponding step implementation function in the underlying programming language. A challenge recognised by industry is ensuring that the natural language scenarios, step implementation functions and underlying system implementation remain consistent with one another, requiring on-going maintenance effort as changes are made to a system. To address this, we have developed behave_nicely, a tool, for automatically generating step implementation functions from structured natural language steps, with the intention of eliminating the need for maintaining step implementation functions. We evaluated our approach on a sample of 20 white box and 50 black box projects using behaviour driven development, drawn from GitHub. Our results show that behave_nicely can generate step implementation functions for 80% of the white box and 17% of black box projects. We conclude that (a) there is significant potential for automating the process of code generation for BDD tests and (b) that the development of guidelines for writing tests in Gherkin would significantly improve the results

Estimating Software Task Effort in Crowds

A key task during software maintenance is the refinement and elaboration of emerging software issues, such as feature implementations and bug resolution. It includes the annotation of software tasks with additional information, such as criticality, assignee and estimated cost of resolution. This paper reports on a first study to investigate the feasibility of using crowd workers supplied with limited information about an issue and project to provide comparably accurate estimates using planning poker. The paper describes our adaptation of planning poker to crowdsourcing and our initial trials. The results demonstrate the feasibility and potential efficiency of using crowds to deliver estimates. We also review the additional benefit that asking crowds for an estimate brings, in terms of further elaboration of the details of an issue. Finally, we outline our plans for a more extensive evaluation of planning poker in crowds

Third-party verifiable voting systems: addressing motivation and incentives in e-voting

Voter-verifiable voting systems place significant demands of both effort and knowledge onto ordinary voters who have only limited incentives to participate. We suggest the use of third-party verifiable voting systems, harnessing the very strong incentives for candidates and observers to verify that votes are correctly counted. A generic modification enabling this via the use of pre-filled ballots and secure depositing is outlined and we demonstrate this modification by applying it to two major voter-verifiable voting systems. Additionally, potential vulnerabilities of this approach are discussed

In-the-wild residual data research and privacy

As the world becomes increasingly dependent on technology, researchers endeavor to understand how technology is used, the impact it has on everyday life and the life-cycle and span of digital information. In doing so, researchers are increasingly gathering `real-world' or `in the wild' residual data, obtained from a variety of sources without the explicit consent of the original owners. This data gathering raises significant concerns regarding privacy, ethics and legislation, as well as practical considerations concerning investigator training, data storage, overall security and disposal. This paper surveys recent studies of residual data gathered in the wild and analyses the challenges that were faced. Taking these insights, the paper presents a compendium of practices for addressing the issues that arise in in the wild residual data research. The practices presented in this paper can be used to critique current projects and assess the feasibility of proposed future research