# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 4 The Experimental Results
### Results of Historical Data Collected Using Follow-Up Questionnaire  
Following the evaluation of the risk variables' validity, we observed that they are required to assess the security risk assessment of the different phases of the system development life cycle (SDLC). The follow-up questionnaires distributed across 309 software developers selected from various IT establishments and with varying specialties and age groups are presented. Table 9 shows the distribution of the follow-up questionnaires across the respondents selected based on the establishments they belonged to. Following the collection of the questionnaire distributed for this study, it was observed that the majority were distributed among respondents selected from a number of sources who refused to be disclosed and were referred to as general, with a proportion of 64.7%. This was followed by respondents selected from PyCOM-NG and SIDMACH with a proportion of 9.1% each, APTECH with a proportion of 4.9%, TASUED with a proportion of 4.5%, CC-HUB with a proportion of 3.6%, NCS with a proportion of 3.2% and IFE with a \begin{table}
\begin{tabular}{c c c} \hline \hline
**The Phase of SDLC Cycle** & **Selected Risk Factors** & **Number of Rules** \\ \hline Requirement Analysis and Definition Phase & 11 & 2048 \\ Design Phase & 8 & 256 \\ Implementation and Unit Testing Phase & 9 & 512 \\ Integration and System Testing Phase & 4 & 16 \\ Operation and Maintenance Phase & 6 & 64 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Distribution of the number of inferred rules. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Establishments** & **Frequency** & **Percentage (\%)** \\ \hline General & 200 & 64.72 \\ Nigerian Computer Society (NCS) & 10 & 3.24 \\ APTECH & 15 & 4.85 \\ Tai Solarin University of Education (TASUED) & 14 & 4.53 \\ CC-HUB & 11 & 3.56 \\ Obafemi Awolow University (IFE) & 3 & 0.97 \\ PyCOM-NG & 28 & 9.06 \\ SIDMACH & 28 & 9.06 \\ Total & 309 & 100.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Distribution of respondents based on their IT establishments. proportion of 0.97%. Following the respondents' responses regarding each set of risk factors that were used to assess the SRA of each phase of the SDLC process, some observations were made about the responses of the respondents selected from each establishment. Also, the responses made were used to assess the level of security risk based on the number of responses for Yes and No provided by the respondents. It was observed in the requirements phase results that the majority of the assessments of the responses from APTECH, NCS, PyCOM-NG, and TASUED had no security risk while the majority of the assessments of the responses from CCHUB, IFE, General, and SIDMACH had low-security risk. However, some of the assessments of the responses from CC-HUB, General, IFE, PyCOM-NG, and SIDMACH had a moderate security risk. The results of the design phase showed that the majority of the assessment of the responses from APTECH, NCS, PyCOM-NG, and TASUED had no security risk, while the majority of the assessments of the responses from CC-HUB, General, IFE, and SIDMACH had a low-security risk. However, some of the assessments of the responses from General, PyCOM-NG, and SIDMACH had a moderate security risk. Also, high risk was assessed from a respondent each among General, PyCOM-NG, and SIDMACH respondents. The results of the implementation phase revealed that the majority of the assessment of the responses from APTECH, NCS, PyCOM-NG, and TASUED had no security risk, while the majority of the assessments of the responses from CCHUB, General, IFE, and SIDMACH had a low-security risk. However, some of the assessments of CC-HUB, General, IFE, PyCOM-NG, and SIDMACH had moderate security risk, while the high-security risk was assessed from a respondent in PyCOM-NG. The results of the integration phase revealed majority of the assessment of the responses from APTECH, CC-HUB, General, NCS, PyCOM-NG, SIDMACH, and TASUED had no security risk.