Empirical and face validity of software maintenance defect models used at the jet propulsion laboratory

Abstract

Context: At the Mission Design and Navigation Software Group at the Jet Propulsion Laboratory we make use of finite exponential based defect models to aid in maintenance planning and management for our widely used critical systems. However a number of pragmatic issues arise when applying defect models for a post-release system in continuous use. These include: how to utilize information from problem reports rather than testing to drive defect discovery and removal effort, practical model calibration, and alignment of model assumptions with our environment. Goal: To show how we can develop confidence in the practical applicability of our models for obtaining stable maintenance funding. Method: We describe the strong empirical and face validity we have investigated for our maintenance defect discovery and introduction models. We discuss the practical details of calibration and application within a functioning maintenance environment. Results: We find that our models, despite their simplicity, appear quite valid. Conclusions: The models are useful in justifying and obtaining stable maintenance funding.

A Decision-Theoretic Approach to Measuring Security

“…That is, we may not know all potential causes of failure -hazards (in the case of safety) or vulnerabilities (in the case of security) -along with their impacts. For both safety and security, the likelihood of a defect becoming a failure and impact of that failure tends to follow a distribution with large variability and generally be positively skewed [19]. But unlike a failure from a safety hazard, when a security vulnerability is exploited, one must assume the impact will reach its maximum potential due to the presence of a persistent intelligent agent.…”