Measuring software security from the design of software

The vast majority of our contemporary society owns a mobile phone, which has resulted in a dramatic rise in the amount of networked computers in recent years. Security issues in the computers have followed the same trend and nearly everyone is now affected by such issues. How could the situation be improved? For software engineers, an obvious answer is to build computer software with security in mind. A problem with building software with security is how to define secure software or how to measure security. This thesis divides the problem into three research questions. First, how can we measure the security of software? Second, what types of tools are available for measuring security? And finally, what do these tools reveal about the security of software? Measuring tools of these kind are commonly called metrics. This thesis is focused on the perspective of software engineers in the software design phase. Focus on the design phase means that code level semantics or programming language specifics are not discussed in this work. Organizational policy, management issues or software development process are also out of the scope. The first two research problems were studied using a literature review while the third was studied using a case study research. The target of the case study was a Java based email server called Apache James, which had details from its changelog and security issues available and the source code was accessible. The research revealed that there is a consensus in the terminology on software security. Security verification activities are commonly divided into evaluation and assurance. The focus of this work was in assurance, which means to verify one’s own work. There are 34 metrics available for security measurements, of which five are evaluation metrics and 29 are assurance metrics. We found, however, that the general quality of these metrics was not good. Only three metrics in the design category passed the inspection criteria and could be used in the case study. The metrics claim to give quantitative information on the security of the software, but in practice they were limited to evaluating different versions of the same software. Apart from being relative, the metrics were unable to detect security issues or point out problems in the design. Furthermore, interpreting the metrics’ results was difficult. In conclusion, the general state of the software security metrics leaves a lot to be desired. The metrics studied had both theoretical and practical issues, and are not suitable for daily engineering workflows. The metrics studied provided a basis for further research, since they pointed out areas where the security metrics were necessary to improve whether verification of security from the design was desired.

The functional fit between collaborative software and work systems:Qualification of work system needs to software functionality

The study develops an approach that tries to validate software functionality to work systems needs in SMEs. The formulated approach is constructed by using a SAAS based software i.e., work collaboration service (WCS), and SMEs as the elements of study. Where the WCS’s functionality is qualified to the collaboration needs that exist in operational and project work within SMEs. For this research constructivist approach and case study method is selected because the nature of the current study requires an in depth study of the work collaboration service as well as a detailed study of the work systems within different enterprises. Four different companies are selected in which fourteen interviews are conducted to gather data pertaining. The work systems method and framework are used as a central part of the approach to collect, analyze and interpret the enterprises work systems model and the underlying collaboration needs on operational and project work. On the other hand, the functional model of the WCS and its functionality is determined from functional model analysis, software testing, documentation and meetings with the service vendor. The enterprise work system model and the WCS model are compared to reveal how work progression differs between the two and make visible unaddressed stages of work progression. The WCS functionality is compared to work systems collaboration needs to ascertain if the service will suffice the needs of the project and operational work under study. The unaddressed needs provide opportunities to improve the functionality of the service for better conformity to the needs of enterprise and work. The results revealed that the functional models actually differed in how operational and project work progressed within the stages. WCS shared similar stages of work progression apart from the stages of identification and acceptance, and progress and completion stages were only partially addressed. Conclusion is that the identified unaddressed needs such as, single point of reference, SLA and OLA inclusion etc., should be implemented or improved within the WCS at appropriate stages of work to gain better compliance of the service to the needs of the enterprise an work itself. The developed approach can hence be used to carry out similar analysis for the conformance of pre-built software functionality to work system needs with SMEs.

Towards increased productivity and quality in software development using agile, lean and collaborative approaches

Dagens programvaruindustri står inför alltmer komplicerade utmaningar i en värld där programvara är nästan allstädes närvarande i våra dagliga liv. Konsumenten vill ha produkter som är pålitliga, innovativa och rika i funktionalitet, men samtidigt också förmånliga. Utmaningen för oss inom IT-industrin är att skapa mer komplexa, innovativa lösningar till en lägre kostnad. Detta är en av orsakerna till att processförbättring som forskningsområde inte har minskat i betydelse. IT-proffs ställer sig frågan: “Hur håller vi våra löften till våra kunder, samtidigt som vi minimerar vår risk och ökar vår kvalitet och produktivitet?” Inom processförbättringsområdet finns det olika tillvägagångssätt. Traditionella processförbättringsmetoder för programvara som CMMI och SPICE fokuserar på kvalitets- och riskaspekten hos förbättringsprocessen. Mer lättviktiga metoder som t.ex. lättrörliga metoder (agile methods) och Lean-metoder fokuserar på att hålla löften och förbättra produktiviteten genom att minimera slöseri inom utvecklingsprocessen. Forskningen som presenteras i denna avhandling utfördes med ett specifikt mål framför ögonen: att förbättra kostnadseffektiviteten i arbetsmetoderna utan att kompromissa med kvaliteten. Den utmaningen attackerades från tre olika vinklar. För det första förbättras arbetsmetoderna genom att man introducerar lättrörliga metoder. För det andra bibehålls kvaliteten genom att man använder mätmetoder på produktnivå. För det tredje förbättras kunskapsspridningen inom stora företag genom metoder som sätter samarbete i centrum. Rörelsen bakom lättrörliga arbetsmetoder växte fram under 90-talet som en reaktion på de orealistiska krav som den tidigare förhärskande vattenfallsmetoden ställde på IT-branschen. Programutveckling är en kreativ process och skiljer sig från annan industri i det att den största delen av det dagliga arbetet går ut på att skapa något nytt som inte har funnits tidigare. Varje programutvecklare måste vara expert på sitt område och använder en stor del av sin arbetsdag till att skapa lösningar på problem som hon aldrig tidigare har löst. Trots att detta har varit ett välkänt faktum redan i många decennier, styrs ändå många programvaruprojekt som om de vore produktionslinjer i fabriker. Ett av målen för rörelsen bakom lättrörliga metoder är att lyfta fram just denna diskrepans mellan programutvecklingens innersta natur och sättet på vilket programvaruprojekt styrs. Lättrörliga arbetsmetoder har visat sig fungera väl i de sammanhang de skapades för, dvs. små, samlokaliserade team som jobbar i nära samarbete med en engagerad kund. I andra sammanhang, och speciellt i stora, geografiskt utspridda företag, är det mera utmanande att införa lättrörliga metoder. Vi har nalkats utmaningen genom att införa lättrörliga metoder med hjälp av pilotprojekt. Detta har två klara fördelar. För det första kan man inkrementellt samla kunskap om metoderna och deras samverkan med sammanhanget i fråga. På så sätt kan man lättare utveckla och anpassa metoderna till de specifika krav som sammanhanget ställer. För det andra kan man lättare överbrygga motstånd mot förändring genom att introducera kulturella förändringar varsamt och genom att målgruppen får direkt förstahandskontakt med de nya metoderna. Relevanta mätmetoder för produkter kan hjälpa programvaruutvecklingsteam att förbättra sina arbetsmetoder. När det gäller team som jobbar med lättrörliga och Lean-metoder kan en bra uppsättning mätmetoder vara avgörande för beslutsfattandet när man prioriterar listan över uppgifter som ska göras. Vårt fokus har legat på att stöda lättrörliga och Lean-team med interna produktmätmetoder för beslutsstöd gällande så kallad omfaktorering, dvs. kontinuerlig kvalitetsförbättring av programmets kod och design. Det kan vara svårt att ta ett beslut att omfaktorera, speciellt för lättrörliga och Lean-team, eftersom de förväntas kunna rättfärdiga sina prioriteter i termer av affärsvärde. Vi föreslår ett sätt att mäta designkvaliteten hos system som har utvecklats med hjälp av det så kallade modelldrivna paradigmet. Vi konstruerar även ett sätt att integrera denna mätmetod i lättrörliga och Lean-arbetsmetoder. En viktig del av alla processförbättringsinitiativ är att sprida kunskap om den nya programvaruprocessen. Detta gäller oavsett hurdan process man försöker introducera – vare sig processen är plandriven eller lättrörlig. Vi föreslår att metoder som baserar sig på samarbete när processen skapas och vidareutvecklas är ett bra sätt att stöda kunskapsspridning på. Vi ger en översikt över författarverktyg för processer på marknaden med det förslaget i åtanke.

Using software metrics to increase efficiency in product creation

Opinnäytetyö etsii korrelaatiota ohjelmistomittauksella saavutettujen tulosten ja ohjelmasta löytyneiden virheiden väliltä. Työssä käytetään koeryhmänä jo olemassaolevia ohjelmistoja. Työ tutkii olisiko ohjelmistomittareita käyttämällä ollut mahdollista paikallistaa ohjelmistojen ongelmakohdat ja näin saada arvokasta tietoa ohjelmistokehitykseen. Mittausta voitaisiin käyttää resurssien parempaan kohdentamiseen koodikatselmuksissa, koodi-integraatiossa, systeemitestauksessa ja aikataulutuksessa. Mittaamisen avulla nämä tehtävät saisivat enemmän tietoa resurssien kohdistamiseen. Koeryhmänä käytetään erilaisia ohjelmistotuotteita. Yhteistä näille kaikille tuotteille on niiden peräkkäiset julkaisut. Uutta julkaisua tehtäessä, edellistä julkaisua käytetään pohjana, jonka päällekehitetään uutta lähdekoodia. Tämän takia ohjelmistomittauksessa pitää pystyä erottelemaan edellisen julkaisun lähdekoodi uudesta lähdekoodista. Työssä käytettävät ohjelmistomittarit ovat yleisiä ja ohjelmistotekniikassalaajasti käytettyjä mittaamaan erilaisia lähdekoodin ominaisuuksia, joiden arvellaan vaikuttavan virhealttiuteen. Tämän työn tarkoitus on tutkia näiden ohjelmistomittareiden käytettävyyttä koeryhmänä toimivissa ohjelmistoympäristöissä. Käytännön osuus työstä onnistui löytämään korrelaation joidenkinohjelmistomittareiden ja virheiden väliltä, samalla kuin toiset ohjelmistomittarit eivät antaneet vakuuttavia tuloksia. Ohjelmistomittareita käyttämällä näyttää olevan mahdollista tunnistaa virhealttiit kohdat ohjelmasta ja siten parantaa ohjelmistokehityksen tehokkuutta. Ohjelmistomittareiden käyttö tuotekehityksessäon perusteltavaa ja niiden avulla mahdollisesti pystyttäisiin vaikuttamaan ohjelmiston laatuun tulevissa julkaisuissa.

On Effort Estimation in Software Projects

Software engineering is criticized as not being engineering or 'well-developed' science at all. Software engineers seem not to know exactly how long their projects will last, what they will cost, and will the software work properly after release. Measurements have to be taken in software projects to improve this situation. It is of limited use to only collect metrics afterwards. The values of the relevant metrics have to be predicted, too. The predictions (i.e. estimates) form the basis for proper project management. One of the most painful problems in software projects is effort estimation. It has a clear and central effect on other project attributes like cost and schedule, and to product attributes like size and quality. Effort estimation can be used for several purposes. In this thesis only the effort estimation in software projects for project management purposes is discussed. There is a short introduction to the measurement issues, and some metrics relevantin estimation context are presented. Effort estimation methods are covered quite broadly. The main new contribution in this thesis is the new estimation model that has been created. It takes use of the basic concepts of Function Point Analysis, but avoids the problems and pitfalls found in the method. It is relativelyeasy to use and learn. Effort estimation accuracy has significantly improved after taking this model into use. A major innovation related to the new estimationmodel is the identified need for hierarchical software size measurement. The author of this thesis has developed a three level solution for the estimation model. All currently used size metrics are static in nature, but this new proposed metric is dynamic. It takes use of the increased understanding of the nature of the work as specification and design work proceeds. It thus 'grows up' along with software projects. The effort estimation model development is not possible without gathering and analyzing history data. However, there are many problems with data in software engineering. A major roadblock is the amount and quality of data available. This thesis shows some useful techniques that have been successful in gathering and analyzing the data needed. An estimation process is needed to ensure that methods are used in a proper way, estimates are stored, reported and analyzed properly, and they are used for project management activities. A higher mechanism called measurement framework is also introduced shortly. The purpose of the framework is to define and maintain a measurement or estimationprocess. Without a proper framework, the estimation capability of an organization declines. It requires effort even to maintain an achieved level of estimationaccuracy. Estimation results in several successive releases are analyzed. It isclearly seen that the new estimation model works and the estimation improvementactions have been successful. The calibration of the hierarchical model is a critical activity. An example is shown to shed more light on the calibration and the model itself. There are also remarks about the sensitivity of the model. Finally, an example of usage is shown.

Agile Methods in Small Software Projects

Agile software development methods are attempting to provide an answer to the software development industry's need of lighter weight, more agile processes that offer the possibility to react to changes during the software development process. The objective of this thesis is to analyze and experiment the possibility of using agile methods or practices also in small software projects, even in projects containing only one developer. In the practical part of the thesis a small software project was executed with some agile methods and practices that in the theoretical part of the thesis were found possible to be applied to the project. In the project a Bluetooth proxy application that is run in the S60 smartphone platform and PC was developed further to contain some new features. As a result it was found that certain agile practices can be useful even in the very small projects. The selection of the suitable practices depends on the project and the size of the project team.

Using time and stochastic models for software reliability forecasting and analysis

Tämä työ luo katsauksen ajallisiin ja stokastisiin ohjelmien luotettavuus malleihin sekä tutkii muutamia malleja käytännössä. Työn teoriaosuus sisältää ohjelmien luotettavuuden kuvauksessa ja arvioinnissa käytetyt keskeiset määritelmät ja metriikan sekä varsinaiset mallien kuvaukset. Työssä esitellään kaksi ohjelmien luotettavuusryhmää. Ensimmäinen ryhmä ovat riskiin perustuvat mallit. Toinen ryhmä käsittää virheiden ”kylvöön” ja merkitsevyyteen perustuvat mallit. Työn empiirinen osa sisältää kokeiden kuvaukset ja tulokset. Kokeet suoritettiin käyttämällä kolmea ensimmäiseen ryhmään kuuluvaa mallia: Jelinski-Moranda mallia, ensimmäistä geometrista mallia sekä yksinkertaista eksponenttimallia. Kokeiden tarkoituksena oli tutkia, kuinka syötetyn datan distribuutio vaikuttaa mallien toimivuuteen sekä kuinka herkkiä mallit ovat syötetyn datan määrän muutoksille. Jelinski-Moranda malli osoittautui herkimmäksi distribuutiolle konvergaatio-ongelmien vuoksi, ensimmäinen geometrinen malli herkimmäksi datan määrän muutoksille.

Elicitation of Customer Requirements with Group Methods in Software Engineering

Vaatimusmäärittely on tärkeä vaihe ohjelmistotuotannossa, koska virheelliset ja puutteelliset asiakasvaatimukset vaikuttavat huomattavasti asiakkaan tyytymättömyyteen ohjelmistotuotteessa. Ohjelmistoinsinöörit käyttävät useita erilaisia menetelmiä ja tekniikoita asiakasvaatimusten kartoittamiseen. Erilaisia tekniikoita asiakasvaatimusten keräämiseen on olemassa valtava määrä.Diplomityön tavoitteena oli parantaa asiakasvaatimusten keräämisprosessia ohjelmistoprojekteissa. Asiakasvaatimusten kartoittamiseen käytettävien tekniikoiden arvioinnin perusteella kehitettiin parannettu asiakasvaatimusten keräämisprosessi. Kehitetyn prosessin testaamiseksi ja parantamiseksi järjestettiin ryhmätyöistuntoja liittyen todellisiin ohjelmistokehitysprojekteihin. Tuloksena vaatimusten kerääminen eri sidosryhmiltä nopeutui ja tehostui. Prosessi auttoi muodostamaan yleisen kuvan kehitettävästä ohjelmistosta, prosessin avulla löydettiin paljon ideoita ja prosessi tehosti ideoiden analysointia ja priorisointia. Prosessin suurin kehityskohde oli fasilitaattorin ja osallistujien valmistautumisessa ryhmätyöistuntoihin etukäteen.

TTCN testing of WCDMA base station operation and maintenance software

TTCN-kieltä käytetään testitapausten määrittelemiseen tietoliikennejärjestelmissä. Nykyään TTCN:stä on tullut yhä suositumpi tapa toteuttaa testitapauksia. TTCN tarjoaa hyvän ja yksinkertaisen tavan muuntaa käsin testattavat testitapaukset automatisoiduiksi. Tämän diplomityön yhteydessä toteutettiin TTCN testitapaukset WCDMA -tukiaseman käyttö- ja kunnossapito- (O&M) ohjelmistolle. Ohjelmistoa on käytetty myös toisen sukupolven tukiasemissa, mutta kolmannen sukupolven tukiasemissa sillä on huomattavasti isompi rooli. WCDMA -tukiasemassa O&M käsittelee muun muassa tukiaseman käynnistyksen, virhetilanteet ja valvoo tukiaseman komponentteja. Ensimmäisiä tehtäviä diplomityötä tehdessä oli valita ne testitapaukset, jotka olisivat mahdollisia ja hyödyllisiä toteuttaa TTCN:n avulla. Testitapaukset valittiin valmiina olleista testitapausten kuvauksista. Valitut testitapaukset toteutettiin käyttäen rinnakkaista ja modulaarista TTCN-kieltä ja testattiin WCDMA -tukiasemaa vasten käyttäen TTCN Tester ohjelmistoa. Tämän diplomityön yhteydessä toteutettuja testitapauksia käytetään varmistamaan, että tukiasema voi toipua erilaisista virhetilanteista O&M ohjelmiston avulla. Testitapauksia WCDMA -tukiasemaa vasten ajettaessa varmistetaan myös, että O&M ohjelmisto toimii määrittelyn mukaisesti eri tilanteissa. Toteutetut testi tapaukset korvaavat nykyään käsin testatut O&M testi tapaukset tukiaseman O&M ohjelmistoa testatessa. Automatisoidut testi tapaukset tekevät O&M ohjelmiston testaamisen merkittävästi nopeammaksi ja helpommaksi.

Benchmarked Quality Measurement Process in a Software Validation Process

Jatkuva laadunmittaus osana ohjelmistoprosessia on yleistynyt ohjelmistoyritysten keskuudessa viime vuosien aikana. ISO 9001:2000 -laatustandardi vaatii yrityksiltä tuotteiden ja prosessien laadun mittaamista ja seuraamista. Laadun mittareiden valinta on haastava tehtävä. Yritykset luulevat usein mittaavansa laatua, vaikka ne todellisuudessa mittaavatkin ohjelmistojen eri ominaisuuksia kuten kokoa tai monimutkaisuutta. Tässä diplomityössä kehitetään ohjelmistojen validointiprosessiin vertailuun perustuva laadunmittausprosessi ohjelmistotuotteiden laadun arviointiin, mittaamiseen ja seurantaan. Laatumittarit valitaan ennalta määriteltyjen kriteereiden mukaisesti, ja niille asetetaan tavoitearvot vertailuanalyysistä saatujen tulosten perusteella. Laadunmittausprosessin lisäksi työssä annetaan suositus prosessin käyttöönotosta ja käytöstä osana yrityksen toimintaa, mikä mahdollistaa jatkuvan seurannan sekä kehityksen tulevaisuudessa.

Offshore Sourcing in Software Development: Case Studies of Finnish-Russian Cooperation

The study examines international cooperation in product development in software development organisations. The software industry is known for its global nature and knowledge-intensity, which makes it an interesting setting to examine international cooperation in. Software development processes are increasingly distributed worldwide, but for small or even medium-sized enterprises, typical for the software industry, such distribution of operations is often possible only in association with crossing the company’s boundaries. The strategic decision-making of companies is likely to be affected by the characteristics of the industry, and this includes decisions about cooperation or sourcing. The objective of this thesis is to provide a holistic view on factors affecting decisions about offshore sourcing in software development. Offshore sourcing refers to a cooperative mode of offshoring, where a firm does not establish its own presence in a foreign country, but utilises a local supplier. The study examines product development activities that are distributed across organisational and geographical boundaries. The objective can be divided into two subtopics: general reasons for international cooperation in product development and particular reasons for cooperation between Finnish and Russian companies. The focus is on the strategic rationale at the company level, in particular in small and medium-sized enterprises. The theoretical discourse of the study builds upon the literature on international cooperation and networking, with particular focus on cooperation with foreign suppliers and within product development activities. The resource-based view is also discussed, as heterogeneity and interdependency of the resources possessed by different firms are seen as factors motivating international cooperation. Strategically, sourcing can be used to access resources possessed by an industrial network, to enhance the product development of a firm, or to optimise its cost structure. In order to investigate the issues raised by the theoretical review, two empirical studies on international cooperation in software product development have been conducted. The emphasis of the empirical part of the study is on cooperation between Finnish and Russian companies. The data has been gathered through four case studies on Finnish software development organisations and four case studies on Russian offshore suppliers. Based on the material from the case studies, a framework clarifying and grouping the factors that influence offshore sourcing decisions has been built. The findings indicate that decisions regarding offshore sourcing in software development are far more complex than generally assumed. The framework provides a holistic view on factors affecting decisions about offshore sourcing in software development, capturing the multidimensionality of motives for entering offshore cooperation. Four groups of factors emerged from the data: A) strategy-related aspects, B) aspects related to resources and capabilities, C) organisation-related aspects, and D) aspects related to the entrepreneur or management. By developing a holistic framework of decision factors, the research offers in-depth theoreticalunderstanding of offshore sourcing rationale in product development. From the managerial point of view, the proposed framework sums up the issues that a firm should pay attention to when contemplating product development cooperation with foreign suppliers. Understanding different components of sourcing decisions can lead to improved preconditions for strategising and engaging in offshore cooperation. A thorough decisionmaking process should consider all the possible benefits and risks of product development cooperation carefully.

Eliminating Software Failures - A Literature Survey

Software faults are expensive and cause serious damage, particularly if discovered late or not at all. Some software faults tend to be hidden. One goal of the thesis is to figure out the status quo in the field of software fault elimination since there are no recent surveys of the whole area. Basis for a structural framework is proposed for this unstructured field, paying attention to compatibility and how to find studies. Bug elimination means are surveyed, including bug knowhow, defect prevention and prediction, analysis, testing, and fault tolerance. The most common research issues for each area are identified and discussed, along with issues that do not get enough attention. Recommendations are presented for software developers, researchers, and teachers. Only the main lines of research are figured out. The main emphasis is on technical aspects. The survey was done by performing searches in IEEE, ACM, Elsevier, and Inspect databases. In addition, a systematic search was done for a few well-known related journals from recent time intervals. Some other journals, some conference proceedings and a few books, reports, and Internet articles have been investigated, too. The following problems were found and solutions for them discussed. Quality assurance is testing only is a common misunderstanding, and many checks are done and some methods applied only in the late testing phase. Many types of static review are almost forgotten even though they reveal faults that are hard to be detected by other means. Other forgotten areas are knowledge of bugs, knowing continuously repeated bugs, and lightweight means to increase reliability. Compatibility between studies is not always good, which also makes documents harder to understand. Some means, methods, and problems are considered method- or domain-specific when they are not. The field lacks cross-field research.

Challenges and Means for the Front End Activities of Software Development

The front end of innovation is regarded as one of the most important steps in building new software products or services, and the most significant benefits in software development can be achieved through improvements in the front end activities. Problems in the front end phase have an impact on customer dissatisfaction with delivered software, and on the effectiveness of the entire software development process. When these processes are improved, the likelihood of delivering high quality software and business success increases. This thesis highlights the challenges and problems related to the early phases of software development, and provides new methods and tools for improving performance in the front end activities of software development. The theoretical framework of this study comprises two fields of research. The first section belongs to the field of innovation management, and especially to the management of the early phases of the innovation process, i.e. the front end of innovation. The second section of the framework is closely linked to the processes of software engineering, especially to the early phases of the software development process, i.e. the practice of requirements engineering. Thus, this study extends the theoretical knowledge and discloses the differences and similarities in these two fields of research. In addition, this study opens up a new strand for academic discussion by connecting these research directions. Several qualitative business research methodologies have been utilized in the individual publications to solve the research questions. The theoretical and managerial contribution of the study can be divided into three areas: 1) processes and concepts, 2) challenges and development needs, and 3) means and methods for the front end activities of software development. First, the study discloses the difference and similarities between the concepts of the front end of innovation and requirements engineering, and proposes a new framework for managing the front end of the software innovation process, bringing business and innovation perspectives into software development. Furthermore, the study discloses managerial perceptions of the similarities and differences in the concept of the front end of innovation between the software industry and the traditional industrial sector. Second, the study highlights the challenges and development needs in the front end phase of software development, especially challenges in communication, such as linguistic problems, ineffective communication channels, a communication gap between users/customers and software developers, and participation of multiple persons in software development. Third, the study proposes new group methods for improving the front end activities of software development, especially customer need assessment, and the elicitation of software requirements.

A Survey and Classification of Software Testing Tools

Software testing is one of the essential parts in software engineering process. The objective of the study was to describe software testing tools and the corresponding use. The thesis contains examples of software testing tools usage. The study was conducted as a literature study, with focus on current software testing practices and quality assurance standards. In the paper a tool classifier was employed, and testing tools presented in study were classified according to it. We found that it is difficult to distinguish current available tools by certain testing activities as many of them contain functionality that exceeds scopes of a single testing type.