FUNCTIONAL ATTRIBUTES

2.1 FUNCTIONAL ATTRIBUTES

Functional attributes characterize the input/output behavior of software products. We distinguish between two broad categories of functional attributes: those that are of a Boolean nature (a software product has them or does not have them) and those that are of a statistical nature (a software product has them to a smaller or larger extent). The functional attributes of a software product depend on the existence of a specification, which describes a set of situations the product is intended to face, along with a prescription of correct program behaviors for each situation. We refer to the set of relevant situations as the domain of the specification.

2.1.1 Boolean Attributes

We recognize two attributes of a Boolean nature in a software product, which are as follows:

• Correctness, which is the property that the software product behaves according to its specification for all possible situations in the domain of the specification. • Robustness, which is the property that the software product behaves according to its specification for all possible situations in the domain of the specification and behaves reasonably for situations outside the domain of the specification. Of course, reasonable behavior is not a well-defined condition, hence robustness is only partially defined; but it generally refers to behavior that alerts the user to the anomaly of the situation and acts prudently and conservatively (avoiding irreversible operations, avoiding irretrievable losses of information, etc.).

As defined, robustness logically implies correctness: whereas correctness refers solely to the behavior of the software product within the domain of the specification, robustness also refers to the behavior of the product outside the domain of the specification. Conversely, we can argue that robustness is not distinguishable from correctness since it is merely correctness with respect to a stronger specification (one that specifies the behavior of candidate programs inside the original specifica- tion’s domain, as well as outside it); nevertheless, for a given specification, these are distinct properties.

2.1.2 Statistical Attributes

Correctness and a fortiori robustness are notoriously difficult to establish for software products of any realistic size; hence we introduce statistical attributes, which measure (over a continuum) how close a software product is to being correct or robust. We distinguish between two broad families of statistical attributes, depending on whether the obstacles to correctness and robustness are inadvertent (product complexity, pro- grammer incompetence, etc.) or voluntary (malicious attempts to cause product failure).

16 SOFTWARE QUALITY ATTRIBUTES

• Dependability: Dependability is the probability that the system behaves accord- ing to its specifications for a period of operation time. We recognize two attributes within dependability, namely, reliability and safety, that differ by the stakes attached to satisfying the specification. ○ Reliability reflects the probability that the software product operates for a

given amount of time without violating its specification. ○ Safety reflects the probability that the software product operates for a given amount of time without causing a catastrophic failure.

Both reliability and safety are related to the product’s ability to operate according to its specification; but whereas reliability reflects the product’s ability to adhere to all the clauses of its specification, safety focuses particularly on high-stakes clauses, whose violation causes a catastrophic loss, in terms of human lives, mis- sion success, high financial stakes, etc. Safe systems are sometimes referred as fail-safe, in the sense that it may fail to satisfy its specification but still satisfy the high-stakes requirements of its specification. A system may be reliable but unsafe (fails seldom but causes a catastrophic loss whenever it fails); and a sys- tem may be safe but unreliable (fails often, but causes low-stakes losses, and never causes catastrophic losses).

The most commonly used metric to quantify reliability is the mean time to failure, which is the mean of the random variable that represents the operation time until the next system failure; the same metric can be used to quantify safety, if we just replace failure by catastrophic failure. Older metrics include the mean time between failures, which is the mean of the random variable that represents the time between two successive failures. More recent metrics include the mean failure cost, which measures the mean of the random variable that measures the loss of a stakeholder as a result of possible system failures.

• Security: Whereas dependability refers to failures that result from system design flaws, security refers primarily to voluntary actions by malicious per- petrators, although one can argue that these actions are rendered possible by system vulnerabilities, which also stem from system design flaws. We find four attributes that can be considered as aspects of security, which are as follows: ○ Confidentiality: Confidentiality refers to a system’s ability to prevent unau-

thorized access to confidential data entrusted to its custody. ○ Integrity: Integrity refers to a system’s ability to prevent loss or damage to critical data entrusted to its custody. ○ Authentication: Authentication refers to a system’s ability to properly iden- tify each user that gains access to its resources and to grant users access privileges according to their rightful status.

○ Availability: Availability refers to a system’s ability to continue delivering service to its user community; it can be measured as a percentage. This

attribute is usually the casualty of denial of service attacks: when the system is under attack, its ability to deliver services to its legitimate users suffers.

2.2 OPERATIONAL ATTRIBUTES

There is no widely accepted measure of system security. To the extent that security attacks result from system vulnerabilities, it is possible to quantify all dimensions of security (including availability) by mean time to detection (MTTD), which is the mean of the random variable that measures the time it takes perpetrators to uncover system vulnerabilities, and by mean time to exploitation (MTTE), which is the mean of the random variable that represents the time it takes perpetrators to find

a way to exploit discovered system vulnerabilities.