# Secure Global Software Development: A Practitioners' Perspective
## 4 Results and Analysis
\[\chi^{2}=\sum_{i=1}^{r}\sum_{j=1}^{c}\frac{\left(O_{i,j}-e_{i,j}\right)^{2}}{e_{ i,j}} \tag{1}\]  
where  
\[e_{i,j}=\frac{\sum_{k-1}^{c}O_{i,j}*\sum_{k-1}^{r}O_{k,j}}{N} \tag{2}\]  
where \(e_{i,j}\) shows expected values while \(\sum_{k-1}^{c}O_{i,j}\) and \(\sum_{k-1}^{r}O_{k,j}\) represent the sum of the \(i\)th column and the sum of the \(k\)th row, respectively, and \(N\) represents the total number. The observed and expected values are shown in Table 4.  
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**GSD Security Practices**} & \multicolumn{3}{c}{**Observed Values**} & \multicolumn{3}{c}{**Expected Values**} \\ \cline{2-7}  & **Small (\#)** & **Medium (27)** & **Large (23)** & **Small (\#)** & **Medium (27)** & **Large (23)** \\ \hline RE3 & 1 & 19 & 14 & 1.372922 & 17.12114 & 15.50594 \\ \hline RE4 & 1 & 9 & 13 & 0.928741 & 11.58195 & 10.48931 \\ \hline RE6 & 1 & 9 & 14 &  
When doing the Chi-square test, at least 80% of the cells must have an expected value of 5 or above. This assumption is not fulfilled in our case; therefore, we merged the first two columns of observed and expected values as mentioned in the papers [44; 45]. The merged observed and expected values are given in Table 5. The requirement that at least 80% of the cells have an anticipated value of 5 or above has now been met. Hence, we calculate the Chi-Sqr value based on the data from Table 5.  
Using the formula of Equation (1), \(\chi^{2}=0.07211\) where \(d.f=(r-1)*(c-1)=(16-1)*(2-1)=15\) and \(\alpha=0.05\). The calculated value for a chi-square is 0.07211 at 15 degrees of freedom. At the same time, the value of the chi-square corresponding to 15 d.f is 24.996 in the Chi-square table, which is much greater than the calculated value. Therefore, evidence supports the claim that there is a link between company size and identified security practices. RQ3: Is there a correlation between the practitioners' experience and identified security practices? We also used the Chi-Square test to find the link between practitioners' experience and identified security practices. Following null and alternate hypotheses were formulated to test this claim. \(H_{0}\) = There is a correlation between practitioners' experience and identified security practices. \(H_{1}\) = There is no correlation between practitioners' experience and identified security practices. The benefits of using the Chi-test in this situation are many including the fact that it is not sensitive to the shape of the distribution of the data, that it can be used in studies where parametric assumptions cannot be met, that it is easy to compute, that it provides useful and specific information, and that it can be easily adapted to data from studies involving two or more groups. The formula for calculating the Chi-square test is given in Equation (1). The observed and expected values used for the calculation of Chi-sqr are given in Table 6. \begin{table}
\begin{tabular}{l l l l l} \hline \hline \multirow{2}{*}{**GSD Security**} & \multicolumn{2}{c}{**Observed Values**} & \multicolumn{2}{c}{**Expected Values**} \\ \cline{2-5}  & **S + M (31)** & **Large (23)** & **S + M (31)** & **Large (23)** \\ \hline RE3 & 20 & 14 & 18.49406176 & 15.50594 \\ \hline RE4 & 10 & 13 & 12.51068884 & 10.48931 \\ \hline RE6 & 10 & 14 & 13.05463183 & 10.94537 \\ \hline RE7 & 15 & 12 & 14.68646081 & 12.31354 \\ \hline RE8 & 23 & 16 & 21.21377672 & 17.78622 \\ \hline D1 & 11 & 11 & 11.96674584 & 10.03325 \\ \hline D7 & 14 & 9 & 12.51068884 & 10.48931 \\ \hline D8 & 4 & 18 & 11.96674584 & 10.03325 \\ \hline C1 & 13 & 9 & 11.96674584 & 10.03325 \\ \hline C5 & 17 & 6 & 12.51068884 & 10.48931 \\ \hline C6 & 14 & 8 & 11.96674584 & 10.03325 \\ \hline T2 & 19 & 8 & 14.68646081 & 12.31354 \\ \hline T3 & 18 & 14 & 17.40617577 & 14.59382 \\ \hline T5 & 12 & 10 & 11.96674584 & 10.03325 \\ \hline DP1 & 12 & 14 & 14.14251781 & 11.85748 \\ \hline DP2 & 17 & 16 & 17.95011876 & 15.04988 \\ \hline \hline \end{tabular}
\end{table}