The RISCOSS project, initiated in November 2012 with a budget of €3.2 million, aims to improve risk management in the adoption of open-source software (OSS) by developing methodologies and tools to identify, manage, and mitigate risks associated with OSS integration. The project has engaged various academic and industry partners to enhance decision-making processes and support the effective use of OSS, with an emphasis on community involvement and feedback from volunteers on its implementation. Evaluation results indicate that the RISCOSS platform is perceived as useful for increasing productivity and decision-making efficiency, although challenges remain in terms of ease of use and the potential for full automation in risk assessment.

1. The RISCOSS project and
results
Angelo Susi (FBK)
and the RISCOSS team
susi@fbk.eu

2. Agenda
 Fondazione Bruno Kessler (FBK) at a glance
 RISCOSS project
– Objectives, Methodology, Techniques
 FBK and PMI - NIC
 The experience:
– Preparation, Execution, Results

3. FBK ?
Fondazione Bruno Kessler was established on March 1° 2007.
It is a non-profit organization with public interest.
Its main mission is:
 To promote, implement and develop research.
 To promote and disseminate innovation.
 Internationalization.
 Technology transfer.
1962
Birth of the Istituto
Trentino di Cultura
(ITC)
1972
Free University
of Trento
becomes public
1973
ITC founds the
«Istituto storico italo-
germanico»
1975
Birth of the
«Istituto di
Scienze
Religiose»
1976
Establishment of
the «Istituto per la
Ricerca Scientifica e
Tecnologica»
2007
Birth of
«Fondazione
Bruno
Kessler»

4. FBK some numbers
• 620 people
• 2 hubs, one on science and technology, the
other on social science and humanities
• 7 research centers
• More than 380 researchers
• 220 undergrad and grad students, post-doctoral
researchers and visiting professors.
• 30 controlled spin-off and start-up
• More than 200 partnership e strategic
collaboration with local and international
companies

5. FBK – Research Centers
Humanities Area

6. Center for Information and Communication
Technology
Founded in the second half of 1980s, the FBK-ICT Center is an international
research center that focuses on key areas of information technology
Staff:
> 200 people
Profile:
- 90 researchers
- 50 technologists
- 60 PhD students
- 5 project managers ( 4 PMP)
Excellence – H-index:
> 30: 12 researchers
> 20: 16 researchers
> 15: 16 researchers
Self-financing capability greater than 53% over 2008-14
• more than 11.3 M€ funds acquired on competitive basis in 2013-2015
• 31 active EU projects
• 16 Projects with Private Companies

7. Research Structure
ICT-irst is organized into three Research Lines (RL) and
three High Impact Initiatives (HII)
The Research Lines group units and
research projects with different
expertise but having common
themes and challenges, in order to
create a shared direction,
language, approach, infrastructure
and technologies.
High Impact Initiatives aim at
impacting on territory, market and
society in a systematic and
proactive way, integrating research
with business and impact on
territory.

8. Our Software Engineering group
Researchers:
Paolo Tonella (head)
Anna Perini
Angelo Susi
Mariano Ceccato
Roberto Tiella
PhD Students:
Gunel Jahangirova
Matteo Biagiola
Biniam Fisseha Demissie
Jacek Dabrowski
• Collaborations
University College London, UK; Queen’s University, Kingston, Canada; Wayne State University, Detroit, USA;
University of Trento; MIS, University of Haifa, Israel; University of Namur, Belgium; UPC Spain; UZH, Switzerland;
UFES, Brazil; …
Postdocs:
Andrea Avancini
Denisse Munante
Alberto Siena
Fitsum Meshesha Kifetew
Itzel Morales Ramirez

9. Risks and Open Source Software
Insufficient risk management has been reported (see
Gartner report in 2016) as one of the topmost mistakes
to avoid when implementing OSS-based solutions
 Great opportunity
 Possible risks
– Licenses of the components and integration
– Quality of the software components
– Intgration of the components in existing sofware
– Maintenance and evolution of the software

10. Il progetto RISCOSSRISCOSS project
Acronim Risks and Costs in Open Source Software Adoption
Start 01/11/2012
Duration 36 months
Call FP7‐ICT‐2011‐8, Objective 1.2
Keywords Open‐Source Software, Decision‐making Techniques, Risk Management
Budget 3.2 Million EU
@RiscossProjecthttp://www.riscoss.eu

11. Project Mission
Specification of risk identification, management and
mitigation methods
community-based and industry-supported Open
Source Software (OSS) development, composition
and life cycle management
individually and collaboratively manage OSS
adoption risks
for
to

12. … in particular
The RISCOSS framework will enable industrial stakeholders to:
 practicing an effective management of OSS integration related
risks
 controlling and reducing the costs derived from the adoption
of OSS
 pushing for innovation to take the best of this strategic
movement

13. Project vision
Decisional level (risks, costs, …)
observations requests
requestssuggestions
OSS projects
and
components
produce
OSS projects and
components
information
Technical levels (software ecosystem)
OSS ECOSYSTEM
ADOPTER
COMMUNITY

14. Project Approach
 Identification of foundational organisational and risk
domain concepts
 Modelling of OSS ecosystems
 Support the OSS adoption risk management and
mitigation strategies
 Development of guidelines for the design and
implementation of a continuous improvement plan
 Evaluation of the approach

15. 3-layer approach for risk assessment
Software and Business Model
Measurements
OSS project
indicators
OSS community
indicators
Contextual
indicators
Adopter
Analyst
Layer 3
Business analysis
Layer 2
Risk indicators
Layer 1
Data Gathering
Context
OSS projects
Community

16. Techniques
 Statistics, Bayesian
networks
 Logic based
 Multi-criteria decision
making techniques
lives(community) v disappear(community) :- low_active(community). RULES
low_active(community) v high_active(community). FACTS
Model 1: disappear(community), low_active(community)
Model 2: lives(community), low_active(community)
Model 3: high_active(community)

17. The supporting tool

18. PMI-NIC and FBK for RISCOSS
 Common interest in the problem of risk management
 RISCOSS has a focused topic on OSS
 Exploring two directions:
– Risk in OSS in IT companies where PMI members are active
– Use of the RISCOSS method for other risk related problems

19. Preparing the evaluation
 Agreement between PMI-NIC and FBK to start the
research activity
 Then a call for volunteers:
– We had 6 volunteers that participated in the experience
– Volunteers are not new to the risk evaluation
– But are new in risk analysis with automated tools
 Identification of a project manager from Project
Management Office of PMI-NIC for the RISCOSS
evaluation activity
 A meeting to:
– explain the methodology
– make a demo of some of the functionalities of the platform
 The evaluation

20. Steps for the evaluation
 The volunteers are trained to use the platform
 Evaluate risks on:
– predefined scenarios
– scenarios from their daily experience
 Report the evaluation of the experience via a
questionnaire
– Replying to closed questions (in a [1,5] scale, 3 is neutral)
– Adding comments especially related to the actual
possibility of using the platform in the PM activity

21. Evaluation results 1/3
 Usefulness of the method and supporting platform
– Using RISCOSS would enable to make decisions more
quickly, efficiently and effectively (on average 3.66, 4 and
3.83)
– Using the system it would increase the productivity (on
average 3.3)
– In general having a tool that supports in making decisions
is useful (on average 4.16)

22. Evaluation results 2/3
 Interaction with the RISCOSS functionalities
– The objective of the risk management process in the
platform was clear (on average 3.66)
– Learning to operate the RISCOSS would be NOT so easy (on
average 2.66)

23. Evaluation results 3/3
 Comments
– Appreciated the method and the possibility to have a level
of automation in risk assessment
– Appreciated the possibility to specify new risk models
– Some scepticism on the possibility to have a completely
automated risk assessment
– Possibility to exploit it in other fields (e.g., mechanical
engineering, logistic) where it is possible to specify new
risk models

24. Conclusion
 Great human experience
 Allowed the RISCOSS team to enter in contact with a
different environment with respect to the typical IT
area
 About the questions
– Allowed to get an important feedback on the real
usefulness and problems of the RISCOSS methodology and
platform
 About the comments
– New ideas
– New possible risk models
– New contexts for the application

25. Thanks to
 The volunteers: Paolo Belleri, Andrea Centofante,
Massimo Cilloni, Silvio di Pasquale, Eustachio
Nicoletti, Cinzia Pellegrino
 PMI-NIC and Branch Trentino Alto Adige/Südtirol:
Armando Beffani, Chiara Canavera, Andrea Cattani,
Silvia Valentini

26. Contact info
Angelo Susi
e-mail: susi@fbk.eu
phone: +39 0461 314344
Unit web page: https://se.fbk.eu/
ICT center web page: https://ict.fbk.eu/
 To try RISCOSS:
– Write / Call us