Human-Oriented Software Engineering Experiments: The Large Gap in Experiment Reports

Falcão, Larissa; Soares, Sérgio

doi:10.1145/3474624.3474649

Cited by 2 publications

(1 citation statement)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although [25], [46] agree that students are well suited to perform empirical studies, [11] argues that the low proportion of professionals used in SE experiments may reduce experiments realism by inhibiting the understanding of industrial software processes. Fourth, many studies do not report important information (such as participant reward, target population, hypothesis, and conclusion and construct validity), as also observed in [12].…”

Section: Replicationsmentioning

confidence: 99%

A replication of a controlled experiment with two STRIDE variants

Mbaka¹,

Tuma²

2022

Preprint

View full text Add to dashboard Cite

To avoid costly security patching after software deployment, securityby-design techniques (e.g., STRIDE threat analysis) are adopted in organizations to root out security issues before the system is ever implemented. Despite the global gap in cybersecurity workforce and the high manual effort required for performing threat analysis, organizations are ramping up threat analysis activities. However, past experimental results were inconclusive regarding some performance indicators of threat analysis techniques thus practitioners have little evidence for choosing the technique to adopt. To address this issue, we replicated a controlled experiment with STRIDE. Our study was aimed at measuring and comparing the performance indicators (productivity and precision) of two STRIDE variants (element and interaction). We conclude the paper by comparing our results to the original study. CCS CONCEPTS• Software and its engineering; • General and reference → Empirical studies;

show abstract

Section: Replicationsmentioning

confidence: 99%

A replication of a controlled experiment with two STRIDE variants

Mbaka¹,

Tuma²

2022

Preprint

View full text Add to dashboard Cite

show abstract

On the Measures of Success in Replication of Controlled Experiments with STRIDE

Mbaka,

Tuma

2024

Int. J. Soft. Eng. Knowl. Eng.

View full text Add to dashboard Cite

To avoid costly security patching after software deployment, security-by-design techniques (e.g. threat analysis) are adopted in organizations to find and mitigate security issues before the system is ever implemented. Organizations are ramping up such (heavily manual) activities, but there is a global gap in the security workforce. Favorable performance indicators would result in cost savings for organizations with scarce security experts. However, past empirical studies were inconclusive regarding some performance indicators of threat analysis techniques, thus practitioners have little evidence for choosing the technique to adopt. To address this issue, we replicated a controlled experiment with STRIDE. Our study aimed to measure and compare the performance indicators (productivity and precision) of two STRIDE variants (per-element and per-interaction). Since we made some similar observations to the original study, we conclude that the two approaches are not different enough to make a practical impact. To this end, the choice of which variant to adopt should be informed by the needs of the organization performing threat analysis. We conclude by discussing some of the unexplored yet relevant topic domains in the context of STRIDE that will be considered in future work.

show abstract

Human-Oriented Software Engineering Experiments: The Large Gap in Experiment Reports

Cited by 2 publications

References 4 publications

A replication of a controlled experiment with two STRIDE variants

A replication of a controlled experiment with two STRIDE variants

On the Measures of Success in Replication of Controlled Experiments with STRIDE

Contact Info

Product

Resources

About