(1) a user-oriented
quality
requirement specifying the degree to which an application
or component shall not directly or indirectly (e.g., via
inactivity) cause
accidental harm to either life (e.g., injury,
loss of life) or property (e.g., loss of money or corruption
of valuable data).
(2) a quality factor measuring the degree to which an
application or component actually does not directly or
indirectly (e.g., via inactivity) cause accidental harm to
either life or property.
a categorization of hazards based on a combination of
their severity and probability level.
Safety risk is used to prioritize the production of
controls to eliminate or mitigate the associated hazard.
(1) a developer-oriented
quality
requirement specifying the degree to which an application
or component shall be able to be modified to expand its
existing capacities (e.g., to handle more simultaneous users
or interactions, or to store more information in its
databases).
(2) a quality factor measuring the degree to which an
application or component actually be able to be modified to
expand its existing capacities.
The continual informal increase of scope (addition of
requirements) without adequate scope management to control
the impact of these additional requirements on the
endeavor’s cost or schedule.
the management
task that ensures that all changes in scope have been
properly analyzed (based on their estimated impact on the
endeavor’s cost, schedule, and success), formally
authorized, and adequately documented.
Note that this ensures the scope of the endeavor
(measured in terms of requirements to be implemented) is not
permitted to inadvertently creep.
(1) a user-oriented
securityquality
requirement specifying the extent to which an application
or component shall collect, analyze, and report information
about the status and use of its security mechanisms.
(2) a quality factor measuring the extent to which an
application or component actually collects, analyzes, and
reports information about the status and use of its security
mechanisms.
a
server
computer (a.k.a., authentication proxy, directory server,
LDAP server) that increases performance by offloading
process-intensive security mechanisms (such as
identification, authentication, encryption, and decryption)
from web or application servers.
For example, a security server converts between
secure HTTPS (using SSL) into HTTP.
Note that a security server may provide single
sign-on across multiple web or application servers.
Note that a security server typically lies between
the first firewall and the web servers or between the second
firewall and the application servers.
the testing of a system, application, or component against its security
requirements and the implementation of its security mechanisms
Examples include testing to determine if the system:
Fails to identify and authenticate a user.
Allows a user to perform an unauthorized function.
Fails to protect itself or its content against unauthorized usage.
Allows the integrity of data or messages to be violated.
Allows undetected intrusion.
Fails to ensure privacy by using an inadequate encryption technique.
Note that security tests may be either automated
using a security tool or performed manually (e.g., tests of physical security).
a defect that causes catastrophic failure of the system
or one of its essential components. A severity one defect
prevents effective exception handling, preventing further
system responses to at least one user.
a defect that causes the system to violate a business
rule, a primary use case path, or a quality requirement
affecting users.
Example: a defect that causes incorrect results to be
returned to a user in response to a query.
a defect that causes the system to violate a secondary
use case path or causes an inconvenience to the users.
Example: data returned to a user that is correct but
incorrectly formatted on the webpage.
the integration activity of integrating software
components before integrating the system by deploying
software components to their eventual production hardware
components.
a formally identified period or point in time that
provides organization to the work units of a delivery
process.
See alsobuild,
cycle,
phase, and
milestone.
a
role that has a legitimate
material or vested interest in an
application or
reusable
component sometime
during its lifecycle and thus should be allowed to influence
it (e.g., by providing
requirements). The
following roles are typically stakeholders:
is the management work product that models a narrative
description of the work products and services to be delivered
by the development organization to the customer organization
under the contract.
a a technique that analyzes an executable work product
without executing it.
for example, compiling a program to identify
compilation defects or running an HTML validator to identify
syntax defects.
the document that formally captures the customer’s
e-strategy including (but not limited to) customer analysis,
user analysis, market analysis, business case, and
recommended applications.
testing that attempts to
cause failures involving how the system behaves under
extreme but valid conditions (e.g., extreme
utilization, insufficient memory inadequate hardware, and
dependency on over-utilized shared resources).
Note that a stress test determines how the system
degrades and eventually fails as conditions become extreme
(e.g., the number of simultaneous users increases, queries
that return the entire contents of a database, queries with
an extreme number of restrictions, and an entry at the
maximum amount of data in a field).
Contrast withload testing and
robustness
testing
an application consisting of data components, hardware
components, software components, human role components (i.e.,
wetware or personnel), and document components (i.e.,
paperware).
the
architecture
document that formally formally documents the architecture
of the system in terms of its major blackbox components,
their responsibilities, and the relationships between them.
The system architecture document also documents how these
system components collaborate to implement the
architecturally significant requirements.
Contrast withsoftware
architecture document.
the testing of integrated system components.
Specifically, system integration testing is the testing of
software components that have been distributed across
multiple platforms (e.g., client, web server, application
server, and database server) to produce failures caused by
system integration defects (i.e., defects involving
distribution and back-office integration).
(1) a user-oriented
securityquality
requirement specifying the degree to which an
application or
component shall prevent
authorized modifications from accidentally defeating its
security mechanisms.
(2) a quality factor measuring the degree to which an
application or component actually prevents authorized
modifications from accidentally defeating its security
mechanisms.
the requirements work product that formally specifies the
operational, data, and quality requirements of a system as
well as any major design constraints on the system.
Contrast with
application vision statement.
