@conference {12105,
	title = {A case study of measuring process risk for early insights into software safety},
	booktitle = {Software Engineering (ICSE), 2011 33rd International Conference on},
	year = {2011},
	month = {2011/05//},
	pages = {623 - 632},
	abstract = {In this case study, we examine software safety risk in three flight hardware systems in NASA{\textquoteright}s Constellation spaceflight program. We applied our Technical and Process Risk Measurement (TPRM) methodology to the Constellation hazard analysis process to quantify the technical and process risks involving software safety in the early design phase of these projects. We analyzed 154 hazard reports and collected metrics to measure the prevalence of software in hazards and the specificity of descriptions of software causes of hazardous conditions. We found that 49-70\% of 154 hazardous conditions could be caused by software or software was involved in the prevention of the hazardous condition. We also found that 12-17\% of the 2013 hazard causes involved software, and that 23-29\% of all causes had a software control. The application of the TRPM methodology identified process risks in the application of the hazard analysis process itself that may lead to software safety risk.},
	keywords = {analysis;software, and, computing;risk, constellation, control;software, Hardware, maintenance;, measurement;aerospace, measurement;software, NASA, process, program;TPRM;flight, risk, safety;technical, spaceflight, systems;process},
	doi = {10.1145/1985793.1985881},
	author = {Layman,L. and Basili, Victor R. and Zelkowitz, Marvin V and Fisher,K.L.}
}
@article {12129,
	title = {Eight lessons learned during COTS-based systems maintenance},
	journal = {Software, IEEE},
	volume = {20},
	year = {2003},
	month = {2003/10//sept},
	pages = {94 - 96},
	abstract = {To make better decisions relative to CBSs, we need empirical knowledge. To gain this knowledge, we must more fully understand the lifecycle processes people use when harnessing COTS packages. The initial findings reported here are but the first step in our attempts to capture this empirical knowledge. We plan to continue collecting data and investigating the phenomenology of COTS-based systems.},
	keywords = {COTS, COTS-based, cycle, life, lifecycle, Maintenance, maintenance;, object-oriented, packages;, phase;, processes;, programming;, reusability;, software, systems},
	isbn = {0740-7459},
	doi = {10.1109/MS.2003.1231161},
	author = {Reifer,D.J. and Basili, Victor R. and Boehm,B.W. and Clark,B.}
}
@conference {18400,
	title = {Maintaining software with a security perspective},
	booktitle = {Software Maintenance, 2002. Proceedings. International Conference on},
	year = {2002},
	month = {2002///},
	pages = {194 - 203},
	abstract = {Testing for software security is a lengthy, complex and costly process. Currently, security testing is done using penetration analysis and formal verification of security kernels. These methods are not complete and are difficult to use. Hence it is essential to focus testing effort in areas that have a greater number of security vulnerabilities to develop secure software as well as meet budget and time constraints. We propose a testing strategy based on a classification of vulnerabilities to develop secure and stable systems. This taxonomy will enable a system testing and maintenance group to understand the distribution of security vulnerabilities and prioritize their testing effort according to the impact the vulnerabilities have on the system. This is based on Landwehr{\textquoteright}s (1994) classification scheme for security flaws and we evaluated it using a database of 1360 operating system vulnerabilities. This analysis indicates vulnerabilities tend to be focused in relatively few areas and associated with a small number of software engineering issues.},
	keywords = {(computers);, budget, classification, classification;, constraints;, data;, engineering;, flaw, maintenance;, of, operating, program, scheme;, Security, software, stable, system, systems, systems;, testing;, TIME, vulnerabilities;, vulnerability},
	doi = {10.1109/ICSM.2002.1167766},
	author = {Jiwnani,K. and Zelkowitz, Marvin V}
}
