InfoQ Homepage Risk Management Content on InfoQ
-
/articles/developer-driven-threat-modeling/en/smallimage/article icon.jpg)
Developer-Driven Threat Modeling
Threat modeling is critical for assessing and mitigating the security risks in software systems. In this IEEE article, author Danny Dhillon discusses a developer-driven threat modeling approach to identify threats using the dataflow diagrams.
-
/articles/agile-scale-fail-risk/en/smallimage/red rose.jpg)
Agile is at a crossroad: Scale or fail?
Risk management is the hottest topic in IT. Processes for effective risk management and investment decision making will allow Agile techniques to scale beyond projects to the enterprise. Without them, Agile will be confined to the ghetto of development. In this article Chris and Olav present some tools and techniques to identify and manage risks on Agile projects.
-
/articles/resilient-security-architecture/en/smallimage/small image.jpg)
Resilient Security Architecture
In this IEEE article, author John Diamant talks about how to improve security quality of software applications using a proactive approach with techniques like Security requirements gap analysis and Architectural threat analysis in the early phases of software development life cycle.
-
/articles/caralli-risk-management-model/en/smallimage/small image.jpg)
Interview and Book Excerpt: CERT Resilience Management Model
CERT Resilience Management Model (CERT-RMM), developed at Software Engineering Institute (SEI), defines the processes for managing operational resilience in complex risk-evolving environments. InfoQ spoke with Rich Caralli, Technical Manager of the CERT Resilient Enterprise Management Team, about RMM framework and the book he co-authored.
-
/articles/managing-risks-dist-teams/en/smallimage/small image.jpg)
A Process for Managing Risks in Distributed Teams
In this IEEE article, John Stouby Persson and Lars Mathiassen discuss a process for managing risks associated in managing the distributed software projects. The process includes identifying and analyzing distributed-team risks in the areas of task distribution, geographical and cultural distribution, stakeholder relations and communication infrastructure.
-
/articles/chess-secureprog/en/smallimage/static-analysis-logo.jpg)
Brian Chess on Static Code Analysis
Building security into software applications from the initial phases of development process is critical. Static code analysis gives developers the ability to review their code without actually executing it to uncover potential security vulnerabilities. InfoQ spoke with Brian Chess about static analysis and how it compares with other security assessment techniques like penetration testing.
-
/articles/real-options-enhance-agility/en/smallimage/rose.jpg)
"Real Options" Underlie Agile Practices
Whether we realise it or not, "freedom to choose" is a principle underlying many Agile practices. By avoiding early commitments, we gain flexibility in the choices we make later. In this article, Chris Matts and Olav Maassen propose that an understanding of "Real Options" allows us to develop and refine new agile practices and take agile in directions it hasn't gone before.
-
/articles/From-Java-to-Ruby--Risk/en/smallimage/image_risk_fromjavatoruby.jpg)
From Java to Ruby: Risk
"Ruby is risky" is a common perception. As Ruby on Rails moves closer to the mainstream, that risk will decrease. In this article, Bruce Tate examines the changing risk profiles for Java and Ruby from a managers perspective, examining Java's initial adoption and also common risk myths about Rails.