Continuous Requirements: An Example Using GDPR

Li, Ze Shi; Werner, Colin; Ernst, Neil A.

doi:10.1109/rew.2019.00031

Cited by 5 publications

(6 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, organizations also face difficulty when dealing with complicated NFRs, such as PRIVACY [56]. Our organizations are particularly concerned about PRIVACY as they are collecting and managing a lot of customer data.…”

Section: Discussionmentioning

confidence: 99%

“…The incentive for building a shared understanding of regulatory NFRs, such as PRIVACY and SECURITY, is to reduce the potential liability. These laws or regulations, such as the GDPR, are important and comprehensive, as non-compliance could result in crippling financial or legal penalties [56]. Explicit regulatory policies, such as PRIVACY, can be extracted, visualized, and re-published to ensure a higher quality of shared understanding between various stakeholders [65].…”

Section: A Shared Understanding and Csementioning

confidence: 99%

“…not only developers) in the organization has a shared understanding of the GDPR. For instance, third-party services and libraries must be verified for GDPR compliance [56]. Employees need to understand the risk of finding and using an external library without first vetting the library for PRIVACY considerations.…”

Section: A Shared Understanding and Csementioning

confidence: 99%

“…As part of their efforts for AUDITABILITY, our collaborating organizations actively add metrics to catch errors and increase insight on their system. We recognize that some NFRs are more difficult to verify than others; although even PRIVACY has been managed through custom tools that automatically tests for software deficiencies [56]. Once an NFR can be verified, the results should be publicly displayed throughout the organization, to continue and maintain a high level of awareness.…”

Section: Research Implicationmentioning

confidence: 99%

See 3 more Smart Citations

The Lack of Shared Understanding of Non-Functional Requirements in Continuous Software Engineering: Accidental or Essential?

Werner¹,

Li²,

Ernst³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

Building shared understanding of requirements is key to ensuring downstream software activities are efficient and effective. However, in continuous software engineering (CSE) some lack of shared understanding is an expected, and essential, part of a rapid feedback learning cycle. At the same time, there is a key trade-off with avoidable costs, such as rework, that come from accidental gaps in shared understanding. This tradeoff is even more challenging for non-functional requirements (NFRs), which have significant implications for product success. Comprehending and managing NFRs is especially difficult in small, agile organizations. How such organizations manage shared understanding of NFRs in CSE is understudied. We conducted a case study of three small organizations scaling up CSE to further understand and identify factors that contribute to lack of shared understanding of NFRs, and its relationship to rework. Our in-depth analysis identified 41 NFR-related software tasks as rework due to a lack of shared understanding of NFRs. Of these 41 tasks 78% were due to avoidable (accidental) lack of shared understanding of NFRs. Using a mixed-methods approach we identify factors that contribute to lack of shared understanding of NFRs, such as the lack of domain knowledge, rapid pace of change, and cross-organizational communication problems. We also identify recommended strategies to mitigate lack of shared understanding through more effective management of requirements knowledge in such organizations. We conclude by discussing the complex relationship between shared understanding of requirements, rework and, CSE.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: A Shared Understanding and Csementioning

confidence: 99%

Section: A Shared Understanding and Csementioning

confidence: 99%

Section: Research Implicationmentioning

confidence: 99%

See 2 more Smart Citations

The Lack of Shared Understanding of Non-Functional Requirements in Continuous Software Engineering: Accidental or Essential?

Werner¹,

Li²,

Ernst³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…GDPR's impact on databases [37] and how databases, by design, can comply with GDPR [34,22] are also analyzed. Recent work investigates how systems can violate GDPR [38], proposes benchmarks [37] and provides tools [26] that test GDPRcompliance, and that explore the benefits of Trusted hardware to prove GDPR-compliance [28].…”

Section: Implications Of Gdpr In the Cloud And On Storagementioning

confidence: 99%

Towards Software-Defined Data Protection: GDPR Compliance at the Storage Layer is Within Reach

István¹,

Ponnapalli²,

Chidambaram³

2020

Preprint

View full text Add to dashboard Cite

Enforcing data protection and privacy rules within large data processing applications is becoming increasingly important, especially in the light of GDPR and similar regulatory frameworks. Most modern data processing happens on top of a distributed storage layer, and securing this layer against accidental or malicious misuse is crucial to ensuring global privacy guarantees. However, the performance overhead and the additional complexity for this is often assumed to be significant -in this work we describe a path forward that tackles both challenges. We propose "Software-Defined Data Protection" (SDP), an adoption of the "Software-Defined Storage" approach to non-performance aspects: a trusted controller translates company and application-specific policies to a set of rules deployed on the storage nodes. These, in turn, apply the rules at line-rate but do not take any decisions on their own. Such an approach decouples often changing policies from request-level enforcement and allows storage nodes to implement the latter more efficiently.Even though in-storage processing brings challenges, mainly because it can jeopardize line-rate processing, we argue that today's Smart Storage solutions can already implement the required functionality, thanks to the separation of concerns introduced by SDP. We highlight the challenges that remain, especially that of trusting the storage nodes. These need to be tackled before we can reach widespread adoption in cloud environments.

show abstract

Translating Privacy Design Principles Into Human-Centered Software Lifecycle: A Literature Review

Saltarella

Desolda

Lanzilotti

et al. 2023

International Journal of Human–Computer Interaction

View full text Add to dashboard Cite

Continuous Requirements: An Example Using GDPR

Cited by 5 publications

References 21 publications

The Lack of Shared Understanding of Non-Functional Requirements in Continuous Software Engineering: Accidental or Essential?

The Lack of Shared Understanding of Non-Functional Requirements in Continuous Software Engineering: Accidental or Essential?

Towards Software-Defined Data Protection: GDPR Compliance at the Storage Layer is Within Reach

Translating Privacy Design Principles Into Human-Centered Software Lifecycle: A Literature Review

Contact Info

Product

Resources

About