Software Security and development experts have addressed the problem of building secure software systems. There are several processes and initiatives to achieve secure software systems. However, most of these lack empirical evidence of its application and impact in building secure software systems. Two systematic mapping studies (SM) have been conducted to cover the existent initiatives for identification and mitigation of security threats. The SMs created were executed in two steps, first in 2015 July, and complemented through a backward snowballing in 2016 July. Integrated results of these two SM studies show a total of 30 relevant sources were identified; 17 different initiatives covering threats identification and 14 covering the mitigation of threats were found. All the initiatives were associated to at least one activity of the Software Development Lifecycle (SDLC); while 6 showed signs of being applied in industrial settings, only 3 initiatives presented experimental evidence of its results through controlled experiments, some of the other selected studies presented case studies or proposals.

System-of-Systems (SoS) are composed by heterogeneous constituent systems that are autonomous, independently managed and operated, and geographically distributed. Architectural evaluation is a key activity of all systems design, construction and operation; unfortunately, the interrelationships among SoS constituent systems and quality attributes (QA) make hard to evaluate SoS. Several evaluation techniques have been proposed, but this corpus of knowledge has not yet been organized for easy access. This article describes the design, execution and results of a Systematic Literature Mapping (SLM) of architectural evaluation proposals, focusing on the QA's they address and the techniques they use. The SLM yield 1675 articles, of which 22 were selected for detailed analysis; most of them take a quantitative perspective (82\%) and the rest are hybrid quantitative/qualitative (18\%); most proposals offer no empirical validation at all (64\%); and the most addressed QA's are performance and robustness.

No abstract

No abstract