Measuring software security from the design of software

The vast majority of our contemporary society owns a mobile phone, which has resulted in a dramatic rise in the amount of networked computers in recent years. Security issues in the computers have followed the same trend and nearly everyone is now affected by such issues. How could the situation be improved? For software engineers, an obvious answer is to build computer software with security in mind. A problem with building software with security is how to define secure software or how to measure security. This thesis divides the problem into three research questions. First, how can we measure the security of software? Second, what types of tools are available for measuring security? And finally, what do these tools reveal about the security of software? Measuring tools of these kind are commonly called metrics. This thesis is focused on the perspective of software engineers in the software design phase. Focus on the design phase means that code level semantics or programming language specifics are not discussed in this work. Organizational policy, management issues or software development process are also out of the scope. The first two research problems were studied using a literature review while the third was studied using a case study research. The target of the case study was a Java based email server called Apache James, which had details from its changelog and security issues available and the source code was accessible. The research revealed that there is a consensus in the terminology on software security. Security verification activities are commonly divided into evaluation and assurance. The focus of this work was in assurance, which means to verify one’s own work. There are 34 metrics available for security measurements, of which five are evaluation metrics and 29 are assurance metrics. We found, however, that the general quality of these metrics was not good. Only three metrics in the design category passed the inspection criteria and could be used in the case study. The metrics claim to give quantitative information on the security of the software, but in practice they were limited to evaluating different versions of the same software. Apart from being relative, the metrics were unable to detect security issues or point out problems in the design. Furthermore, interpreting the metrics’ results was difficult. In conclusion, the general state of the software security metrics leaves a lot to be desired. The metrics studied had both theoretical and practical issues, and are not suitable for daily engineering workflows. The metrics studied provided a basis for further research, since they pointed out areas where the security metrics were necessary to improve whether verification of security from the design was desired.

Tuotesuunnittelu direktiiviperustaisesti

Onnistuneen tuotekehitysprojektin läpivieminen vaatii huolellisen alkusuunnittelun ennen varsinaista tuotteen kehityksen aloitusta. Projektin läpiviemiseksi esitetään usein malleja joissa tuotekehitysprojektissa edetään yksi vaihe kerrallaan ja siirrytään seuraavaan vasta, kun edellinen on valmis. Tämän perinteisen mallin rinnalle on tullut DFMA-suunnittelu, jossa murretaan kommunikaatiomuuri suunnittelun ja valmistuksen väliltä ja useita vaiheita tehdään samanaikaisesta. Näin saadaan valmistus- ja kokoonpanoystävällisiä tuotteita, joilla tuotteesta saatava kate voidaan maksimoida samalla kun tuotteen laatua saadaan parannettua. Teknisen kehityksen lisäksi on tuotekehitysprosessissa erottamattomana osana direktiivien asettamien vaatimusten huomioon ottaminen. Jo lähes kaikissa tuotteissa on oltava CE-merkintä. CE-merkinnällä tuotteen valmistaja ottaa täyden vastuun siitä, että tuote täyttää sitä koskevien direktiivien asettamat vaatimukset vaatimustenmukaisuudesta. Direktiivien asettamat vaatimukset on hyvä tiedostaa jo tuotteen suunnittelun alkuvaiheista lähtien, jotta nämä osataan ottaa heti huomioon ja jälkikäteen tehtäviltä muutoksilta vältytään. Teknisten ratkaisujen lisäksi tuotteen dokumentoinnilla on suuri rooli vaatimustenmukaisuuden täyttämisessä. Tuotteesta tulee koota tekninen tiedosto, joka sisältää kaikki tarpeelliset dokumentit, joilla tuotteen vaatimustenmukaisuus voidaan todeta. Teknisen tiedoston vaatimukset on hyvä tiedostaa jo suunnittelun alusta lähtien, jotta tarvittavat dokumentit osataan kerätä projektin aikana tekniseen tiedostoon. Tässä työssä kehitettiin peltier-jäähdytin, jollaiselle asiakkailta saadun palautteen perusteella oli markkinoilla tarve. Jäähdyttimen suunnittelussa käytettiin DFMA:n keinoja yksinkertaistamaan kokoonpanoa. Jäähdyttimelle tehtiin vaatimustenmukaisuustarkastelu, missä tarkasteltiin peltier-jäähdytintä koskevien direktiivien asettamia vaatimuksia ja mitä asioita näiden vaatimusten täyttämiseksi tuli huomioida.

Työn osituksen kehittäminen kustannusten kirjaamisen ja seurannan tarkentamiseksi projekteissa

Työn päätavoite on selvittää kohdeyrityksen projektien tehtävien jakoon ja työn jäsentämiseen käytettävän työn osituksen rakenteen ongelmat projektikustannusten kirjaamisessa. Tämän lisäksi tavoitellaan kustannusläpi-näkyvyyden kasvua, mittaamisen helpottumista ja kustannusarvioinnin tarkentumista antamalla kehitys-ehdotuksia rakenteen tarkentamiseksi ja yksinkertaistamiseksi. Työ on laadullista ja toiminnallista tapaus-tutkimusta. Teoriaosuuden aineistona on tieteellisiä artikkeleita, kirjoja, lehtiä ja muita aiheeseen liittyviä julkaisuja. Empiirinen osa koostuu yrityksen sisäisistä haastatteluista sekä esikuva-analyysihaastatteluista. Kehitysehdotusten analysointiin ja valintaan käytetään GAP–analyysiä ja toteutettavuustarkastelua. Työn keskeisimpänä tuloksena on neljä kehitysehdotusta, jotka pohjautuvat teorioiden suosituksiin työn osituksen rakenteen sisällöstä. Tällä työllä pyritään myös tuomaan esille kehitystarvetta yrityksessä ja antamaan suunta sekä alkusysäys kehitysprosessille kohti toimivampaa projektien kustannusseurantaa.

Toimintamalli ympäristömyötäisen tuotesuunnittelun roolin kasvattamiseksi

Työn ensimmäisenä tavoitteena oli parantaa Abloy Oy:n tietämystä yrityksen tarjoamien mekaanisten ja mekatronisten tuotteiden ympäristönäkökohdista ja -vaikutuksista. Työn toisena tavoitteena oli selvittää, voidaanko Abloy Oy:n mekaanisten ja mekatronisten tuotteiden elinkaaren aikaisten ympäristönäkökohtien ja -vaikutusten arviointia kehittää osana nykyistä tuotekehitysprosessia. Tuotteiden ympäristönäkökohtia käsiteltiin kestävän kehityksen, yritysvastuun, ympäristöstrategian ja yksittäisen tuotteen osalta. Ympäristöstrategioiden pohjalta kehitettiin toimintamalleja. Toimintamalleilla kuvataan, mitä toimenpiteitä yrityksen tulisi tehdä, jotta tietty ympäristöstrategian taso saavutetaan. Työn tulos on, että kehitetyillä toimintamalleilla on potentiaalia kehittää Abloy Oy:n mekaanisten ja mekatronisten tuotteiden elinkaaren aikaisten ympäristönäkökohtien ja -vaikutusten arviointia osana nykyistä tuotekehitysprosessimallia.

Examining human-centered design practice in the mobile apps era

Human-Centered Design (HCD) is a well-recognized approach to the design of interactive computing systems that supports everyday and professional lives of people. To that end, the HCD approach put central emphasis on the explicit understanding of users and context of use by involving users throughout the entire design and development process. With mobile computing, the diversity of users as well as the variety in the spatial, temporal, and social settings of the context of use has notably expanded, which affect the effort of interaction designers to understand users and context of use. The emergence of the mobile apps era in 2008 as a result of structural changes in the mobile industry and the profound enhanced capabilities of mobile devices, further intensify the embeddedness of technology in the daily life of people and the challenges that interaction designers face to cost-efficiently understand users and context of use. Supporting interaction designers in this challenge requires understanding of their existing practice, rationality, and work environment. The main objective of this dissertation is to contribute to interaction design theories by generating understanding on the HCD practice of mobile systems in the mobile apps era, as well as to explain the rationality of interaction designers in attending to users and context of use. To achieve that, a literature study is carried out, followed by a mixed-methods research that combines multiple qualitative interview studies and a quantitative questionnaire study. The dissertation contributes new insights regarding the evolving HCD practice at an important time of transition from stationary computing to mobile computing. Firstly, a gap is identified between interaction design as practiced in research and in the industry regarding the involvement of users in context; whereas the utilization of field evaluations, i.e. in real-life environments, has become more common in academic projects, interaction designers in the industry still rely, by large, on lab evaluations. Secondly, the findings indicate on new aspects that can explain this gap and the rationality of interaction designers in the industry in attending to users and context; essentially, the professional-client relationship was found to inhibit the involvement of users, while the mental distance between practitioners and users as well as the perceived innovativeness of the designed system are suggested in explaining the inclination to study users in situ. Thirdly, the research contributes the first explanatory model on the relation between the organizational context and HCD; essentially, innovation-focused organizational strategies greatly affect the cost-effective usage of data on users and context of use. Last, the findings suggest a change in the nature of HCD in the mobile apps era, at least with universal consumer systems; evidently, the central attention on the explicit understanding of users and context of use shifts from an early requirements phase and continual activities during design and development to follow-up activities. That is, the main effort to understand users is by collecting data on their actual usage of the system, either before or after the system is deployed. The findings inform both researchers and practitioners in interaction design. In particular, the dissertation suggest on action research as a useful approach to support interaction designers and further inform theories on interaction design. With regard to the interaction design practice, the dissertation highlights strategies that encourage a more cost-effective user- and context-informed interaction design process. With the continual embeddedness of computing into people’s life, e.g. with wearable devices and connected car systems, the dissertation provides a timely and valuable view on the evolving humancentered design.

Yhteisinnovointi – menestystekijät, haasteet ja onnistumisen edellytykset

Tässä diplomityössä käsitellään yhteisinnovoinnin hyödyntämistä organisaatiossa. Työn tavoitteena on luoda teoreettinen pohja yhteisinnovoinnille sekä havaita kirjallisuudesta yhteisinnovoinnin menestystekijät. Näitä analysoidaan SWOT -analyysin avulla. Näiden pohjalta tutkimuksen empiirisessä osassa toteutettiin case -yritykseen kysely, jossa pyrittiin havaitsemaan sisäisiä kyvykkyyksiä yhteisinnovointiin. Yhteisinnovoinnilla tarkoitetaan uusien palveluiden tai prosessien kehitystä, jossa mukaan on otettu ulkoisia sidosryhmiä. Pyrkimyksenä yhteisinnovoinnissa on saada uutta osaamista ja asiantuntijuutta ulkoisista lähteistä. Yhteisinnovoinnissa onnistumisen edellytykset ovat strategisia, kulttuurisia sekä valmiuksiin perustuvia. Digitaalisia palveluita voidaan kehittää ketterästi ja asiakaslähtöisesti hyödyntämällä yhteisinnovaatiota. Yhteisinnovoinnissa on kuitenkin haasteita esimerkiksi epävarmuuden hallinnassa. Menestymiseen vaikuttaa merkittävästi yritysten kyky kehittää vahvuuksiaan ja hallita haasteita. Myös yhteisinnovoinnin kokonaisvaltainen ymmärtäminen ja sisäinen oppimisprosessi vaikuttavat kriittisesti yhteisinnovointiprojektin potentiaalisten hyötyjen saamiseen.

Fostering product innovation by learning through exporting in Eastern Europe

This study discusses the importance of learning through the process of exporting, and more specifically how such a process can enhance the product innovativeness of a company. The purpose of this study is to investigate the appropriate sources of learning and to suggest an interactive framework for how new knowledge from exporting markets can materialize itself into product innovation. The theoretical background of the study was constructed from academic literature, which is related to concepts of learning by exporting, along with sources for learning in the market and new product development. The empirical research in the form of a qualitative case study was based on four semi-structured interviews and secondary data from the case company official site. The interview data was collected between March and April 2015 from case company employees who directly work in the department of exporting and product development. The method of thematic analysis was used to categorize and interpret the collected data. What was conclusively discovered, was that the knowledge from an exporting market can be an incentive for product innovation, especially an incremental one. Foreign customers and competitors as important sources for new knowledge contribute to the innovative process. Foreign market competitors’ influence on product improvements was high only when the competitor was a market leader or held a colossal market share, while the customers’ influence is always high. Therefore, involving a foreign customer in the development of a new product is vital to a company that is interested in benefiting from what is learned through exporting. The interactive framework, which is based on the theoretical background and findings of the study, suggests that exporting companies can raise their product innovativeness by utilizing newly gained knowledge from exporting markets. Except for input, in the form of sources of learning, and product innovation as an output, the framework contains a process of knowledge transfer, the absorptive capacity of a firm and a new product development process. In addition, the framework and the findings enhance the understanding of the disputed relationship between an exporting experience and product innovation. However, future research is needed in order to fully understand all the elements of the framework, such as the absorptive capacity of a firm as well as more case companies to be processed in order to increase the generalization of the framework

Earning logics of a portal solution for a medical device manufacturer

The need behind this thesis was in the development of a more modern earning logic for a pelvic floor muscle home training device to which a portal solution is going to be introduced as a part of new upgraded version of the device. The goal is to offer useful guidelines and recommendations for the medical device manufacturer to use in the process of creating the new business model around the new product version. In the theoretical part of this thesis, the used theoretical frameworks for business model generation and pricing models are presented. The special characteristics of healthcare technology industry are also introduced as initial data for the empirical part. The empirical data is collected via interviews and meetings from both inside and outside of the company to gain a comprehensive picture of the issue at hand. The needed changes in the business model as well as possible pricing options are gone through in the empirical chapters with the main focus being on the incoming revenue streams and pricing. As results of the thesis recommendations are presented for the changes that are needed in the business model after the introduction of the portal solution. The results of this thesis can be used for finishing the development process of the new version of the device and especially the earning logic of it.

Performance Degradation Modelling and Techno-Economic Analysis of Lithium-Ion Battery Energy Storage Systems

Transmission system operators and distribution system operators are experiencing new challenges in terms of reliability, power quality, and cost efficiency. Although the potential of energy storages to face those challenges is recognized, the economic implications are still obscure, which introduce the risk into the business models. This thesis aims to investigate the technical and economic value indicators of lithium-ion battery energy storage systems (BESS) in grid-scale applications. In order to do that, a comprehensive performance lithium-ion BESS model with degradation effects estimation is developed. The model development process implies literature review on lifetime modelling, use, and modification of previous study progress, building the additional system parts and integrating it into a complete tool. The constructed model is capable of describing the dynamic behavior of the BESS voltage, state of charge, temperature and capacity loss. Five control strategies for BESS unit providing primary frequency regulation are implemented, in addition to the model. The questions related to BESS dimensioning and the end of life (EoL) criterion are addressed. Simulations are performed with one-month real frequency data acquired from Fingrid. The lifetime and cost-benefit analysis of the simulation results allow to compare and determine the preferable control strategy. Finally, the study performs the sensitivity analysis of economic profitability with variable size, EoL and system price. The research reports that BESS can be profitable in certain cases and presents the recommendations.