MSc Research Intern Software Quality Risk Estimation

MSc Research Intern Software Quality Risk Estimation

This MSc Research Internship focuses on estimating the risk and value of software qualities, addressing a critical gap in current software engineering economics.

Problem Statement

Decisions in software engineering are generally influenced by technology, people, process, and economics. Software quality is increasingly vital for software system success, yet development organizations often lack integrated methodologies to understand the potential risks, benefits, and costs associated with improving software quality across various characteristics.

While SIG's Cost Estimation Model [Nugroho 2011] effectively assesses maintainability's impact on development effort, a similar approach is needed for other software quality characteristics. The FAIR methodology [FAIR, Open-FAIR, Freund 2015], primarily used for cybersecurity risks, offers a structured approach for quantifying risk and impact by combining multiple factors and presenting results based on likely outcomes.

Research Question

The primary research question is: can the FAIR approach – or an alternative – be adapted and applied to multiple software quality models (such as maintainability, security, and architecture quality) to create an integrated cost estimation model for diverse software qualities?

If feasible, can these individual risk models for multiple qualities be combined into a single, comprehensive software economics model for software quality? If not, can the FAIR approach at least be applied to software security, leveraging software security analysis results from SIG's Sigrid platform?

Tentative Approach

Several stages are envisioned to achieve the overall goal, though not all may be completed within a single thesis project:

• Utilize the FAIR model to derive a quantitative security risk profile of a software system, using input from SIG’s software security analysis (part of the Sigrid platform).
• Explore the capacity to quantitatively determine the difference in risk when transitioning between security levels.
• Apply the FAIR model to other areas like maintainability and architecture quality of a software system.
• Develop a model to estimate the costs associated with improving a software system's security level.
• Define an overarching integrated approach for the software economics of multiple software qualities.

SIG colleagues will provide essential domain information to help construct the various risk assessment models.

Relevant Literature

• [FAIR] https://www.fairinstitute.org/what-is-fair
• [Open-FAIR] https://www.opengroup.org/open-fair
• [Freund 2015] Freund, J. & Jones, J. (2015). Measuring and managing information risk: A FAIR approach. Butterworth-Heinemann.
• [Nugroho 2011] Nugroho, A., Visser, J., & Kuipers, T. (2011). An empirical model of technical debt and interest. Proceedings - International Conference on Software Engineering, 1–8. https://doi.org/10.1145/1985362.1985364

About this proposal

Please note that all thesis proposals are preliminary suggestions; their scope, research questions, and approach may be adapted based on student interests, experience, and insights, in collaboration with supervisors from SIG and the university.

Working environment

You will be an integral part of the Research team at the Software Improvement Group, working closely with other stakeholders. A SIG researcher will serve as your daily supervisor. SIG has extensive experience hosting and supervising Master's thesis interns, with 5 to 10 interns completing projects annually and consistently achieving high grades.

SIG offers a dynamic and challenging environment that values autonomy and curiosity. Interns participate in a company onboarding program and have opportunities to observe various customer projects and activities within SIG.

MSc thesis interns receive remuneration and are provided a laptop for their research and access to SIG infrastructure during their internship.

Expectations

Students are expected to conduct rigorous scientific work that also holds practical relevance. You will receive extensive support and supervision, and in return, we expect you to learn quickly and take ownership of achieving excellent results. A proactive approach is anticipated in identifying opportunities and challenges, and in engaging SIG colleagues in your research to enhance outcomes.

Key skills/competency

• Software Quality
• Risk Assessment
• FAIR Methodology
• Cost Estimation
• Software Economics
• Maintainability
• Security Analysis
• Research Methodology
• Quantitative Analysis
• Data Modeling