Risks Identification in Embedded Software Development: Evidence ...

Available online at www.sciencedirect.com

ScienceDirect Procedia Computer Science 91 (2016) 798 – 806

,QIRUPDWLRQ7HFKQRORJ\DQG4XDQWLWDWLYH0DQDJHPHQW,740

5LVNV,GHQWLILFDWLRQLQ(PEHGGHG6RIWZDUH'HYHORSPHQW (YLGHQFHIURP09%&3URMHFW6XUYH\ +DR6RQJ-LURQJ-LDQJ 6KDQGRQJ8QLYHUVLW\RI)LQDQFHDQG(FRQRPLFV1R6KXQJHQJ5RDG-LQDQ&KLQD

$EVWUDFW

7KHULVNVRFFXUUHGLQGHYHORSPHQWSURFHVVSRVHJUHDWGDQJHUWRWKHTXDOLW\RIHPEHGGHGVRIWZDUH7KLVSDSHU FRQFHQWUDWHVRQWKHULVNSURILOHRI09%&SURMHFW4XHVWLRQQDLUHVZHUHFROOHFWHGIURPWKUHHGLIIHUHQWHPEHGGHG VRIWZDUHLQVWLWXWLRQV09%&$HURVSDFHDQG(QFU\SWLRQ7KHDQDO\VLVLQFOXGLQJWRSULVNVIUHTXHQF\ LPSDFWVWUHQJWKSHUFHSWLRQVGLVWULEXWLRQVDPRQJOLIHF\FOHZHUHFRQGXFWHG6RPHGLVWLQFWGLIIHUHQFHEHWZHHQ 09%&DQGRWKHUHPEHGGHGSURMHFWVZHUHUHYHDOHGDQGWKHILQDOFRQFOXVLRQVZRXOGEHKHOSIXOIRUIXWXUHULVN PDQDJHPHQWRI09%&GHYHORSPHQW

©7KH$XWKRUV3XEOLVKHGE\(OVHYLHU%9 2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). 6HOHFWLRQDQGRUSHHUUHYLHZXQGHUUHVSRQVLELOLW\RIWKHRUJDQL]HUVRI,740 Peer-review under responsibility of the Organizing Committee of ITQM 2016

.H\ZRUGV5LVN,GHQWLILFDWLRQ(PEHGGHG6RIWZDUH09%&3URMHFW5LVN3HUFHSWLRQ

,QWURGXFWLRQ &RQWLQXRXVULVNVHPHUJLQJLQVRIWZDUHGHYHORSPHQWFDXVHKXJHORVVWRVRIWZDUHSURMHFWVLQFHWKHELUWKRI VRIWZDUHHQJLQHHULQJ>@$VRQHRIWKHPRVWLPSRUWDQWW\SHRIVRIWZDUH(PEHGGHG6RIWZDUHSOD\DQLPSRUWDQW UROH LQ PRGHUQ VRFLHW\ ZKHUH NLQGV RI YHKLFOH PRELOH DLUFUDIW WUDLQ FDQ EH IRXQG HYHU\ZKHUH 6R LW LV DQ LPSRUWDQWLVVXHIRUUHVHDUFKHUVDQGSURJUDPPHUVWRLGHQWLI\WKHULVNVLQVRIWZDUHGHYHORSPHQWOLIHF\FOHDQG PDNHWKHPXQGHUFRQWUROLQWKHHDUO\VWDJH>@ 5LVNLGHQWLILFDWLRQDQGPHDVXUHPHQWDUHVLJQLILFDQWO\LPSRUWDQWIRUUHODWLYHUHVHDUFKOLNHEDQNLQJLQGXVWU\>@ FRXQWU\ ULVN>@ VRIWZDUH ULVN>@ HWF (PEHGGHG V\VWHPV DUH RI FULWLFDO LPSRUWDQFH EHFDXVH RI WKHLU XQLTXH DSSOLFDWLRQV 09%& PXOWLSXUSRVH YHKLFOH EXV FRQWUROOHU LV WKH 09% EXV RQ D QHZ JHQHUDWLRQ RI FRUH SURFHVVRUV ZKLFK SURYLGHV FRPPXQLFDWLRQV HTXLSPHQW DQG FRPPXQLFDWLRQV VHUYLFHV IRU WKH YDULRXV EXV LQWHUIDFHV ,W LV DQ VR LPSRUWDQW FRUH IRU KLJKVSHHG WUDLQV WKDW WUDLQV ZLOO WRWDOO\ IDOO LQWR GLVRUGHU LI 09%&

&RUUHVSRQGLQJDXWKRU7HOID[ E-mail address:VRQJKDRPRXVH#FRP

1877-0509 © 2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). Peer-review under responsibility of the Organizing Committee of ITQM 2016 doi:10.1016/j.procs.2016.07.082

Hao Song and Jirong Jiang / Procedia Computer Science 91 (2016) 798 – 806

799

HQFRXQWHUHUURUV&RPLQJDORQJZLWKWKHXQLTXHQHVVRI09%&GHYHORSPHQWVRPHGLVWLQFWLYHIHDWXUHVVKRZXS LQ09%&SURMHFWFRPSDUHGZLWKJHQHUDOVRIWZDUHGHYHORSPHQW 7KLVSDSHUSURSRVHGDULVNLGHQWLILFDWLRQIUDPHZRUNWRH[SORUHWKHGLIIHUHQFHRI09%&IURPRWKHUJHQHUDO HPEHGGHGVRIWZDUHSURMHFWV$TXHVWLRQQDLUHZDVIRUPHGDIWHUDFDUHIXOYLHZRIWKHILOHVRIGHYHORSPHQWILOHV WKHQ WKH VXUYH\V ZHUH FRQGXFWHG LQ WKUHH HPEHGGHG VRIWZDUH SURMHFWV 09%& $HURVSDFH DQG (QFU\SWLRQ $IWHUNLQGVRI DQDO\VLV RQ WKH TXHVWLRQQDLUH VRPH XQXVXDO DQGUHPDUNDEOH FRQFOXVLRQV FDQ EHGUDZQE\ WKH FRPSDUDWLYHDQDO\VLV 5LVNV3UHLGHQWLILFDWLRQ 3RSXODUULVN FKHFNOLVWVZRXOG OLNH WR WUHDWWKH FDWHJRULHVDV DYLHZ RI WRS PDQDJHUV OLNH WKH OLVW RI /LQGD :DOODFHLVFRPSRVHGRI7HDPULVN2UJDQL]DWLRQDO(QYLURQPHQWULVN5HTXLUHPHQWVULVN3ODQQLQJDQG&RQWURO ULVN 8VHU ULVN &RPSOH[LW\ ULVN>@ 7KH VKRUWFRPLQJ RI WKLV FDWHJRU\ LV WKDW LW SUHVHQWV PRUH SHUVSHFWLYH RI PDQDJHPHQWEXWQRWWHFKQRORJ\ZKLFKLVPD\EHWKHPRVWLPSRUWDQWIDFWRULQHPEHGGHGVRIWZDUHGHYHORSPHQW $IWHU D FDUHIXO FKHFN RI WKH 09%& SURMHFW ILOHV LQFOXGLQJ FRQIHUHQFH PDWHULDOV IDXOW GDWDEDVH SURMHFW UHFRUGVZHIRXQGGR]HQVRIUHFRUGVFRQFHUQLQJDERXWKDUGZDUHWHVWLQJDQGWHDPZKLFKLVWKHQRWDEOHIHDWXUHV RIHPEHGGHGVRIWZDUH6RZHH[SDQGHGWKHFDWHJRULHVRIFKHFNOLVWDVHLJKWLWHPV5HTXLUHPHQWV'HVLJQ8VHUV 7HFKQRORJ\ 7HVWLQJ +DUGZDUH 7HDP DQG 3URMHFW 7KH IRXU VXSSOHPHQWDO FDWHJRULHV +DUGZDUH 7HVWLQJ 7HFKQRORJ\DQG7HDPFDQEULQJIRUZDUGVRPHFKDQJHVRI(PEHGGHGVRIWZDUHGHYHORSPHQW 7KH TXHVWLRQQDLUHV ZHUH FROOHFWHG LQ WKUHH LQVWLWXWLRQV 7VLQJKXD 8QLYHUVLW\ $HURVSDFH ,QVWLWXWLRQ DQG (QFU\SWLRQ VRIWZDUH FRPSDQ\ 7KH LQYHVWLJDWRUV ZHUH DVNHG WR LGHQWLI\ DOO ULVNV KDSSHQHG LQ WKHLU UHFHQW HPEHGGHGVRIWZDUHGHYHORSPHQW(LJKW\FRPSOHWHTXHVWLRQQDLUHVZHUHUHWXUQHGIRUIXUWKHUDQDO\VLV 4XHVWLRQQDLUH$QDO\VLV 3.1. Top 10 Risks 7RS ULVNV 7DEOH DUH SXW IRUZDUG E\ WKH IUHTXHQF\ 7KH ILUVW LWHP LV GHSHQGLQJ RQ D IHZ NH\ VWDII ZKLFKVKRZVWKHQHHGHGGHYHORSHULVVWLOORIWKHXWPRVWLPSRUWDQFH7KHVHFRQGLWHPDQGWKLUGLWHPDUHERWK DERXW+DUGZDUHLQGLFDWLQJWKHLPSRUWDQFHRIKDUGZDUHLQ09%&GHYHORSPHQW7KHUHDUHWZRULVNVFRQFHUQLQJ DERXW 5HTXLUHPHQWV UDQNLQJ LQ WKH WK DQG WK LQ WKH OLVW ZKLFK LV DOVR GLIIHUHQW IURP JHQHUDO VRIWZDUH GHYHORSPHQWZKRVH5HTXLUHPHQWVULVNVXVXDOO\UDQNLQWKHWRSRIWKHOLVW>@ 7DEOH7RS5LVNV 5DQNLQJ

5LVN

5LVN&DWHJRU\

'HSHQGRQDIHZNH\VWDII

7HDP

1HHGHGKDUGZDUHQRWRQSRVLWLRQ

+DUGZDUH

%DGKDUGZDUHTXDOLW\

+DUGZDUH

1RWHQRXJKWHVWLQJVFHQDULRV

7HVWLQJ

,QFRUUHFWUHTXLUHPHQWV

5HTXLUHPHQWV

1RWHQRXJKWHVWLQJWLPH

7HVWLQJ

8QUHDOLVWLFVFKHGXOHV

3URMHFW

3HUVRQQHOVKRUWIDOOV

7HDP

'HYHORSHUVDUHQRWIDPLOLDUZLWKUHTXLUHPHQWV

5HTXLUHPHQWV

800


1HZKDUGZDUH

+DUGZDUH

3.2. Frequency and Impact Strength 5LVNFRQVHTXHQFHVDUHPHDVXUHGE\WZRLQGH[HVIUHTXHQF\DQGLPSDFWVWUHQJWK)UHTXHQF\LVWKHWLPHVWKDW WKHULVNVKDSSHQHGLQ09%&GHYHORSPHQW,PSDFWVWUHQJWKLVWKHFRQVHTXHQFHVRQFHWKHULVNVKDSSHQHGLQWKH VRIWZDUH GHYHORSPHQW 7KHVH WZR LQGH[HV PHDVXUH WKH ULVNV LQ WZR GLIIHUHQW YLHZV 7R SXW IRUZDUG D FRPSUHKHQVLYHUDQNLQJRIWKHFRQVHTXHQFHVRIGLIIHUHQWFDWHJRULHVRIULVNVLQ09%&SURMHFWZHFRPELQHGWKH UDQNLQJRIWKHVHWZRYLHZVE\WR ,Q 7DEOH +DUGZDUH UDQN WKH ILUVW LQ DOO FDWHJRULHV PDLQO\ EHFDXVH RI WKH KLJKHVW LPSDFW VWUHQJWK 5HTXLUHPHQWVUDQNWKHWKLUGPDLQO\EHFDXVHRIWKHKLJKHVWIUHTXHQF\DQGWKHPRVWVLJQLILFDQWGLIIHUHQFHLVWKH UDWKHUORZLPSDFWVWUHQJWKFRPSDUHGZLWKWKHSHUIRUPDQFHRIUHTXLUHPHQWVLQJHQHUDOVRIWZDUHGHYHORSPHQW $QRWKHUQRWDEOHGLIIHUHQFHLVWKDW8VHUVUDQNWKHODVWLQWKHOLVWZKLFKVKRZWKDWWKHXVHUVDUHQRWSOD\LQJYHU\ LPSRUWDQWUROHVLQ09%&GHYHORSPHQW 7DEOH&RPSUHKHQVLYH5DQNLQJ

5HTXLUHPHQWV

'HVLJQ

8VHUV

7HFKQRORJ\

7HVWLQJ

+DUGZDUH

7HDP

3URMHFW

)UHTXHQF\

,PSDFW6WUHQJWK

5DQNLQJ

(LJKWFDWHJRULHVDUHGLYLGHGLQWRIRXUSDUWVE\WZRGLPHQVLRQVRI)UHTXHQF\DQG,PSDFW6WUHQJWK)LJXUH 3DUW,KLJKIUHTXHQF\DQGKLJKLPSDFWVWUHQJWKLVKLJKO\GDQJHURXVLQFOXGLQJWKUHHFDWHJRULHV+DUGZDUH 7HDP DQG 7HVWLQJ3DUW,,KLJKIUHTXHQF\DQG ORZ LPSDFW VWUHQJWK LVPHGLXP LPSRUWDQW LQFOXGLQJ MXVWRQH FDWHJRU\ 5HTXLUHPHQWV 3DUW ,,, ORZ IUHTXHQF\ DQG ORZ LPSDFW VWUHQJWK LV VOLJKWO\ LPSRUWDQW LQFOXGLQJ WKH RWKHUIRXUFDWHJRULHV'HVLJQ3URMHFW7HFKQRORJ\DQG8VHUV &RPSDUHGZLWKRWKHUJHQHUDOVRIWZDUHTXHVWLRQQDLUHDQDO\VLV5HTXLUHPHQWVDQG8VHUVDUHIDUIURPWKHNH\ UROHVLQJHQHUDOVRIWZDUHGHYHORSPHQW,QVWHDG+DUGZDUH7HVWLQJDQG7HDPSOD\WKHPRVWLPSRUWDQWUROHLQ 09%&SURMHFWZKLFKLVDGLVWLQJXLVKLQJIHDWXUH

801

)UHTXHQF\


)LJFODVVLILFDWLRQE\WZRGLPHQVLRQV

3.3. Risk Perceptions of Different Characters 7KH FKDUDFWHUV LQ VRIWZDUH GHYHORSPHQW DUH XVXDOO\ GLYLGHG LQWR PDQDJHUV DQG GHYHORSHUV 7KH PDQDJHUV XVXDOO\GHDOZLWKUHTXLUHPHQWVSODQVFKHGXOHEXGJHWSURMHFWPDQDJHPHQWDQGWHDPPDQDJHPHQWZKLOHWKH GHYHORSHUV PDLQO\ GHDO ZLWK WKH IXQGDPHQWDO FRGLQJ KDUGZDUH GHVLJQ DQG WHVWLQJ 7KH\ ZLOO KDYH GLIIHUHQW SHUFHSWLRQVRIGLIIHUHQWULVNVIRUWKHUHDVRQWKDWWKHLUVFRSHRIZRUNDUHGLVWLQFW>@ 7DEOHVKRZVWKHQXPEHUDQGLPSDFWVWUHQJWKLGHQWLILHGE\WKHVHWZRFKDUDFWHUV7KHPDQDJHUVLGHQWLILHG PRUH ULVNV WKDQ WKH GHYHORSHUV WR PHDQLQJ D PDQDJHU ZLOO EH IDFHG ZLWK WKUHH H[WUD ULVNV WKDQ D SURJUDPPHU+RZHYHUWKHGHYHORSHUZLOOWUHDWZLWKWKHULVNPRUHVHULRXVO\IRUWKHLULPSDFWVWUHQJWKLVPXFK KLJKHUWKDQWKDWRIPDQDJHUV 7DEOH1XPEHURI,GHQWLILHG5LVNVDQG,PSDFW6WUHQJWK &KDUDFWHU

1XPEHURI,GHQWLILHG5LVNV

,PSDFW6WUHQJWK

0DQDJHUV

'HYHORSHUV

)LJXUHVKRZVWKHGLIIHUHQWSHUFHSWLRQVEHWZHHQWKHVHWZRFKDUDFWHUVE\WKHQXPEHURILGHQWLILHGULVNV7KH PDQDJHUV FDQ WHOO PRUH ULVNV FRQFHUQLQJ DERXW 5HTXLUHPHQWV 8VHUV 7HVWLQJ 7HDP DQG 3URMHFW ZKDW DUH PDLQO\WKHZRUNUDQJHRIWKHPDQDJHUV'HVLJQDQG+DUGZDUHDUHLGHQWLILHGPRUHIUHTXHQWO\E\WKHGHYHORSHUV WKDQWKHPDQDJHUV

802


)LJ1XPEHURI,GHQWLILHG5LVNV

)LJ,PSDFW6WUHQJWK

)LJXUHVKRZVWKHGLIIHUHQFHRILPSDFWVWUHQJWKHYDOXDWHGE\GHYHORSHUVDQGPDQDJHUV7RWDOO\VSHDNLQJ WKHGHYHORSHUVWUHDWHDFKULVNPRUHVHULRXVO\WKDQWKHPDQDJHUVHVSHFLDOO\LQ7HFKQRORJ\8VHUV3URMHFWDQG GHVLJQ:HFDQFRQFOXGHWKDWWKHGHYHORSHUVDUHDOZD\VDOLWWOHH[DJJHUDWHGZKHQIDFLQJZLWKWKHSUREOHPVLQ WKHGHYHORSPHQWOLIHF\FOH

803


3.4. More Analysis Compared with Survey of Aerospace and Encryption :H FRQGXFWHG WKH VDPH VXUYH\ LQ WZR RWKHU (PEHGGHG VRIWZDUH GHYHORSPHQW $HURVSDFH VRIWZDUH DQG (QFU\SWLRQVRIWZDUH7KHUHDUHTXHVWLRQQDLUHVIRU$HURVSDFHDQGTXHVWLRQQDLUHVIRU(QFU\SWLRQFROOHFWHG IRUIXUWKHUFRPSDUDWLYHDQDO\VLV 7DEOHVKRZVWKHGLIIHUHQFHRIWKHULVNVUDQNLQJLQWKHVHWKUHHVXUYH\V5HTXLUHPHQWVDQG'HVLJQDUHRIWKH VDPH LPSRUWDQW SRVLWLRQ LQ $HURVSDFH VRIWZDUH DQG (QFU\SWLRQ VRIWZDUH ZKLOH +DUGZDUH DQG 7HDP DUH QRW WKDWLPSRUWDQW7KHVLJQLILFDQWGLIIHUHQFHFDQEHGLVFRYHUHGIURPWKLVOLVWHVSHFLDOO\IURPWKHWRSDQGERWWRP RIWKHOLVW 7DEOH5LVNV5DQNLQJDPRQJ7KUHH6XUYH\V 5LVN&DWHJRU\

09%&

$HURVSDFH6RIWZDUH

(QFU\SWLRQVRIWZDUH

5HTXLUHPHQWV

'HVLJQ

3URMHFW

7HVWLQJ

8VHUV

7HFKQRORJ\

7HDP

+DUGZDUH

7R H[SORUH IXUWKHU GLIIHUHQFH EHWZHHQ WKHVH WKUHH SURMHFWV WKH GLVWULEXWLRQV RI HDFK FDWHJRU\ RI ULVNV DUH EURXJKWIRUZDUGE\OLIHF\FOHFRPSRVLQJRIIRXUSKDVHVUHTXLUHPHQWVGHVLJQGHYHORSPHQWDQGWHVWLQJ )LJXUHD VKRZVWKHGLVWULEXWLRQRI5HTXLUHPHQWVLQWKHOLIHF\FOH7KHUHTXLUHPHQWVRI09%&LVORZHU WKDQ$HURVSDFHDQG(QFU\SWLRQVRIWZDUHDQGLWLVVLPLODUWR'HVLJQZKLFKLVVRIDUDZD\IURPWKHEURNHQOLQHV RI$HURVSDFHDQG(QFU\SWLRQ

)LJD 5HTXLUHPHQWVE 'HVLJQ

3URMHFWULVNVRI09%&LVVWLOOORZHUWKDQ$HURVSDFHDQG(QFU\SWLRQZKLOHLWLVFKDQJHGIRU7HVWLQJULVNV WKHILUVWWKUHHSKDVHVRI09%&ORFDWLQJKLJKHUWKDQ$HURVSDFHDQG(QFU\SWLRQVKRZQLQ)LJXUH

804


)LJD 3URMHFWE 7HVWLQJ

)LJD 8VHUVE 7HFKQRORJ\

)LJXUHD VKRZVWKHFRPSDULVRQRI8VHUVULVNVLQWKHVHWKUHHSURMHFWV%URNHQOLQHVRI09%&ORFDWHVR FORVHWR;D[LVVKRZLQJWKDW8VHUVULVNVRI09%&DOPRVWQHYHUKDSSHQ)LJXUHE VKRZV7HFKQRORJ\ULVNV RI09%&ORFDWHVLQWKHPLGGOHRIWKHRWKHUWZRSURMHFWVDQGLWLVWKHKLJKHVWLQGHYHORSPHQWSKDVH

805


)LJD 7HDPE +DUGZDUH

)LJXUHD VKRZVWKH7HDPRI09%&LVWKHKLJKHVWLQWKHWKUHHSURMHFWVDQG)LJXUHE VKRZVWKH +DUGZDUHRI09%&LVKLJKHUWKDQRWKHUWZRSURMHFWVLQWKHILUVWWZRDQGWKHODVWSKDVHVLQOLIHF\FOH &RQFOXVLRQV 7KHFRPSDUDWLYHDQDO\VLVIURPWKUHHHPEHGGHGLQVWLWXWLRQVUHYHDOHGVRPHLPSRUWDQWIHDWXUHVLQ09%& SURMHFWV 7KHULVNVRI+DUGZDUH7HVWLQJDQG7HDPUDQNWRSLQWKHOLVW5HTXLUHPHQWVDQG8VHUVULVNVDUHQRW WKDWLPSRUWDQWDVJHQHUDOVRIWZDUHGHYHORSPHQW 3URMHFWPDQDJHUVFDQLGHQWLI\PRUHULVNVWKDQGHYHORSHUV ZKLOHGHYHORSHUVWUHDWULVNVPRUHVHULRXVO\ 5HTXLUHPHQWV'HVLJQ3URMHFWDQG8VHUVLQWKHZKROH GHYHORSPHQWOLIHF\FOHLQ09%&DUHQRWWKDWQRWLFHDEOHFRPSDUHGZLWKWKHRWKHUWZRSURMHFWV

$FNQRZOHGJHPHQWV 7KLVUHVHDUFKKDVEHHQVXSSRUWHGE\JUDQWVIURPWKH1DWLRQDO1DWXUDO6FLHQFH)RXQGDWLRQRI&KLQD WKH&KLQD3RVWGRFWRUDO6FLHQFH)RXQGDWLRQ0 DQGWKH@%RHKP%:6RIWZDUH5LVN0DQDJHPHQW3ULQFLSOHVDQG3UDFWLFHVIEEE Software >@/L-0/L':XDQG+6RQJ$QLQWHJUDWHGULVNPHDVXUHPHQWDQGRSWLPL]DWLRQPRGHOIRUWUXVWZRUWK\VRIWZDUHSURFHVV PDQDJHPHQWInformation Sciences >@:X'/L-6XQ;6RQJ+0XOWLREMHFWULVNFRQWUROPRGHOIRUVRIWZDUHSURMHFWFRQVLGHULQJULVNFRUUHODWLRQSystems Engineering Theory & Practice >@/L-3-&)HQJHWDO5LVNLQWHJUDWLRQPHFKDQLVPVDQGDSSURDFKHVLQEDQNLQJLQGXVWU\ International Journal of Information Technology & Decision Making >@/LX&;/6XQHWDO6WDWLVWLFDOSURSHUWLHVRIFRXQWU\ULVNUDWLQJVXQGHURLOSULFHYRODWLOLW\(YLGHQFHIURPVHOHFWHGRLOH[SRUWLQJ FRXQWULHVEnergy Policy >@:X'6-3/LHWDO/LQHDUFRPELQDWLRQRIPXOWLSOHFDVHEDVHGUHDVRQLQJZLWKRSWLPL]HGZHLJKWIRUVRIWZDUHHIIRUWHVWLPDWLRQ Journal of Supercomputing

806


>@:DOODFH/.HLO05DL$8QGHUVWDQGLQJVRIWZDUHSURMHFWULVNDFOXVWHUDQDO\VLVInformation & Management ± >@6FKPLGW5/\\WLQHQ..HLO0HWDO,GHQWLI\LQJVRIWZDUHSURMHFWULVNVDQLQWHUQDWLRQDO'HOSKLVWXG\Journal of Management Information Systems >@.HLO0:DOODFH/7XUN'HWDO$QLQYHVWLJDWLRQRIULVNSHUFHSWLRQDQGULVNSURSHQVLW\RQWKHGHFLVLRQWRFRQWLQXHDVRIWZDUH GHYHORSPHQWSURMHFWJournal of Systems and Software