# Improving the Safety and Security of Software Systems by Mediating SAP Verification
## 5 Proposed Methodology
Algorithm 1 describes the overall working of the proposed methodology. According to Algorithm 1, the organization first needs to choose the SSDLC. The choice of SSDLC depends on various factors, including the nature of the project, budget, and time constraints. Once the methodology is defined and the requirements for the SSDLC are established, the MFs for SAP need to be identified. The proposed methodology identified ten MFs from both the scientific and grey literature. Next, what actions are required to accomplish these MFs need to be determined. In our case, we extracted the MFs and their corresponding actions from the existing published literature to ensure their correctness and effectiveness [8,26,29,35]. Once the MFs and their corresponding actions are identified, the next step is to prioritize these actions according to the nature and complexity of the project. For prioritization, every action is assigned a numeric weightage based on its importance for the project. Next, the organization needs to evaluate each action's impact on MFs, as shown in Equation (5). If the impact of an action on the identified MF is high, it will be adapted; otherwise, it may be ignored. Below, we present the proposed methodology using mathematical modeling. The idea of mathematical modeling was taken from [37,38]. The objective function of this study was to optimize \(SPV\), as mentioned in Equation (2):  
\[\text{OF}=Max(SAP)\ \ \therefore\ Improving\ SPV \tag{2}\]  
\[\text{where}\ SPV=f(MF_{1},\ MF_{2},MF_{3}\dots\dots\ MF_{10}) \tag{3}\]  
\[MF_{i}=\sum_{j=1}^{n}A_{j}W_{j} \tag{4}\]  
where \(w_{j}\) is the weight assigned to each \(A_{j}\) and \(A_{j}\) represents the actions mentioned in Table 3  
To maximize the overall SAP, appropriate actions need to be taken for improving each MF; this can be accomplished by satisfying Equation (5):  
\[MF_{i}=\frac{1}{n}\sum_{j=1}^{n}A_{j}W_{j}\geq Tv\ (MF_{i}) \tag{5}\]  
where \(Tv\) is the threshold value corresponding to each \(MF_{i}\) depending on the nature of the project and other constraints, i.e., time, budget, team skills, etc. \(W_{j}\) represents the weight assigned to different actions based on the priority of that action for a particular \(MF\) and \(n\) represents the number of actions corresponding to each \(MF_{i}\). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**MFs** & **MFs Detail** & **Actions** & **Actions/Practices to Promote MFs** \\ \hline \multirow{6}{*}{MF10} & \multirow{6}{*}{Encourage reusability} & A1 & Keep track of prevalent faults and utilize test cases to discover their failures. \\  & & & \\ \cline{1-1}  & & A2 & Using other comparable systems’ expertise to define the needs \\ \cline{1-1}  & & A3 & Reusing functional test cases that reflect real-world use \\ \cline{1-1}  & & A4 & Adapting settings from related systems test scenarios \\ \cline{1-1}  & & A5 & Vulnerability mapping by domain to identify situation-specific vulnerabilities \\ \cline{1-1} \cline{2-4}  & & A6 & Design real-time scenarios \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Cont. The accumulative \(SPV\) can be computed as mentioned in Equation (6):  
\[ \begin{array}{l}Acc(SPV)=(\frac{1}{n}\sum\limits_{j=1}^{5}A_{j}W_{j}+\frac{1}{n }\sum\limits_{j=1}^{5}A_{j}W_{j}+\frac{1}{n}\sum\limits_{j=1}^{6}A_{j}W_{j}+ \frac{1}{n}\sum\limits_{j=1}^{4}A_{j}W_{j}+\frac{1}{n}\sum\limits_{j=1}^{3}A_{ j}W_{j}+\frac{1}{n}\sum\limits_{j=1}^{6}A_{j}W_{j}+\frac{1}{n}\sum\limits_{j=1}^{7}A_{ j}W_{j}\\ +\frac{1}{n}\sum\limits_{j=1}^{3}A_{j}W_{j}+\frac{1}{n}\sum\limits_{j=1}^{4}A_{ j}W_{j}\frac{1}{n}\sum\limits_{j=1}^{6}A_{j}W_{j}))\geq Acc(Tv)\end{array}  \tag{6}\]  
To evaluate the impact of a particular \(MF_{i}\) on \(SPV\), the partial derivatives can be found w.r.t. a particular \(MF_{i}\).