Mark Lambert discusses the critical role of APIs in enhancing interconnectivity and the shift of software quality from a process enabler to a business differentiator, emphasizing the importance of speed in the Software Development Lifecycle (SDLC). He highlights the need for continuous testing and various testing strategies to minimize defects and ensure compliance with standards, while also addressing the importance of automating key quality practices. Ultimately, the document underscores the significance of aligning technical findings with business expectations to improve software quality and reduce risks.

1. #
Mark Lambert
VP Product Management and Support

2. #
APIs drive
interconnectivity
across the
expanded internet
Compliance with
regulatory, industry
and internal
standards
SDLC Speed will be
the difference
between a first
mover vs follower

3. #
The Cost of Quality
associated with
software has shifted
dramatically
Software has shifted
from process
enabler to business
differentiator
Quality drives
brand loyalty

4. #
• After a rash of software
failures and security
breaches left Sony’s
gaming services down for
weeks, analysts called for
the ousting of the Sony
CEO.
• Cumulative Loss = $18B
Market Value
--1229% --1313% --1302%
Event 15d 30d

5. #
• Constant Trade-offs that have business impact
Time
Quality
Scope

6. #
• Continuous testing accelerates the SDLC by
managing quality expectations and actionable tasks
Policy Management
Expectations
Defect Prevention
Development
Development Testing
Development
Static Analysis
Unit/Component
Peer Review
Integration Testing
Automated Tests
API/Service Tests
Smoke Test
Security Tests
System Testing
Automated Tests
Functional Tests
Scenario Tests
Performance Tests
Continious
Build
Remediation Tasks
Go
Release
No Go
???
Service Virtualization – Test Environment Access

7. #
Pattern-Based
Static Analysis
Prevention
technique
Analyzes code
structure (parse
tree) to apply best
practices
Flow-Based
Static Analysis
Detection
technique
Analyzes code
flow to determine
“dangerous paths”
Metric Threshold
Analysis
Advisory
technique
Finds
complex/hard-to-test
code prone to
errors

8. #
• Well understood often under valued
• Define the goal of the analysis and the Policy for
compliance
• Focus on reduction of business risk not pursuit of
perfection
• Start small to promote adoption and monitor for areas of
improvement

9. #
• Highly valuable in
finding REAL bugs
– Algorithms/Design
• Use carefully
– Only apply after Static
Code Analysis
– Only apply where
there is Business
RISK
Image: http://www.jasonawesome.com/2010/06/01/executing-a-php-code-review/

10. #
• Unit Testing
– Developer focuses on the code
– Typically not true Unit Test
– Code needs to be built to be testable
• Where is the ROI?
– Did we design it properly
• How much is enough?
– Code Coverage + Peer Review

11. #
• Functional Testing
– QA focused on the user-story/function
• Where is the ROI?
– Does it function correctly
– Did we break functionality
• How much is enough?
– User-story coverage
• Assoc. code coverage provides additional insight

12. #
• Ad-hock/Unstructured Testing of
functional areas
• Important part of QA/feedback
process
• Requires traceability to user-stories
and code
• Should be ‘reinforced’ with automated
tests

13. #
• Limitations
– Often at the end of the cycle
• Wait until the whole system is ready
– Requires specialized skills and specialized tools
• Often not “real tests”
– Too late for cost effective remediation
• “Shift Left” Performance and Security
– Reuse automated functional tests and tooling
– Eliminated the system constraints … Service Virtualization …

14. #
• Complexity is a Barrier to Innovation
– Accessible
– Stable
– Controllable
• Constrained Testing
3rd Party System
Evolving Component
Mainframe
Scheduled Access

15. #
• Emulates dependencies for the Test Environment
– Reduces the complexity for early stage testing
– Increases predictability
• Enables “Test Anytime, Anywhere, Anyway”
– Automated Provisioning for different use-cases
– Automated Test Data Management/Simulation
• Does not eliminate the need for System/Integration
Testing

16. #
• Logically componentized
• Correlated with business
requirements
• Incremental, Repeatable
• Maintainable,
Deterministic
• Process is prescriptive
based on results
Continuous
Testing
Traceability
Policy
Analysis Risk
Assessment
Environment
Access
Optimization

17. #
• Centralize and Automated
“Quality Hub”
• Provide Controls and
visibility onto variable and
ad-hoc usage of quality tools
(incl. open source)
• Enables centralized policy to
drive consistent results of
the SDLC practices
Source
Control
Defects
Load
Testing
DTP
Require-ments
Code
Review
Static
Analysis
Metrics
Flow
Analysis
Functiona
l Testing
Coverage
Unit
Testing

18. #
• Aggregation of objective
SDLC data transformed
into actionable information
• Identify, and prevent,
potential defects to reduce
project risks
• Developer workflow driven
from the Developer
Code
Analysis
Data
Aggregation
Post Analysis
Analysis
(PIE)
Reporting
and
Prioritization
Source
Check-in
Download to
IDE
Developer
Remediation
DT
P

19. #
• Real-time feedback on compliance and certification with
industry, regulatory or standards initiatives during
active development.

20. #
• Bridge the gap between technical findings and
business impact
– Aggregation of deep SDLC data into informative dashboards that.

21. #

22. #
1. Define Business Expectations in a Policy
2. Automate Key Software Quality Practices
1. Code Analysis
2. Peer Review
3. Automated Testing with Traceability
3. Apply Continuously and with a Workflow for remediation
4. Translate to Business Impact and Monitor for
improvements

23. #
Mark Lambert
Mark.Lambert@parasoft.com
@mark_l_lambert