How to build more secure and reliable software

Innovative software continues to disrupt society as we know it, solving big problems, creating new efficiencies, and creating better quality of life.

From movies to agriculture to national defense, more and more major businesses and industries run on software. health care It also benefits from software-powered mobile and AI technologies to accelerate innovation and address the growing shortage of physicians and other healthcare talent.

But bad software can cause irreparable damage to entire industries and infrastructures it is transforming. McKinsey estimate Software issues are reported to be the cause of 70% of medical device recalls.

The cost of software recalls can be significant in terms of financial loss and damage to a company’s reputation, and can result in bodily harm or even death. Recent examples include:

• Ann car manufacturer recall A problem with the company’s self-driving software was responsible for the more than 360,000 vehicles in February.
• airline’s Meltdown December 2022 Tens of thousands of travelers were stranded, largely due to legacy enterprise software systems from the 1990s.
• In 2020 alone, medical device recalls ranged from insulin pumps to software-operated devices that monitor heart and brain activity.

How can businesses reduce risk and ensure software is safe and reliable? The answer can be found in a strong Application Lifecycle Management (ALM) system that includes continuous testing and change management. I believe. Let’s start by looking at some of the most common software problems.

Read more about software engineeringWhat are code smells? (examples with solutions).

connection problem

According to the US Food and Drug Administration, connectivity or interoperability between different systems is one of the biggest problems. The ability to easily exchange information between applications, databases, and other computer systems is critical to modern economies. However, systems are often developed by different teams and face challenges when communicating information and having to validate the entire system.

A recent infusion pump recall illustrates this point. Patients in the ICU are connected intravenously to an infusion pump. Insulin pumps have a companion app that doctors use on their desktop or tablet to control the timely delivery of prescription medications. However, in one recent case, a manufacturer updated a companion app without making a similar update to the device software itself. As a result, patients were at risk of overdosing, underdosing, or mixed dosing.

Using incompatible units

Other common problems arise from the unintentional use of different metrics or units combined with poor communication between teams. Built in 1998 at a cost of $125 million, the Mars Climate Rover unit of measurement. One manufacturer’s navigation team involved in building the orbiter used the metric system of millimeters and meters in its calculations, while another provided the critical acceleration data in inches, feet, and pounds. The spacecraft was effectively lost in transit.

This happened many years ago and time has not fixed the problem. Different teams own different software, so if you accidentally use different metrics, poor communication can turn a simple disconnect into a fatal flaw.

security vulnerabilities

The FDA is increasingly concerned about security vulnerabilities and the potential for hackers to use insulin pumps and pacemakers as attack vectors to launch attacks against individuals, hospitals, or entire networks. Vulnerabilities include unpatched backdoors, dead code It still exists in the system for historical reasons and causes vulnerabilities.

Poor change management

Many software problems arise as a result of system changes. One issue is the access levels that need to be coordinated across groups and the potential for someone in that group to make an error. With modern web-based, mobile, and AI/ML software, changes become more frequent during the software lifecycle, increasing the risk of error.

A second security vulnerability or performance issue can be caused by the use of SOUP (Software of Unknown Origin) that includes open source code dependencies. To accelerate product time-to-market, many software teams use off-the-shelf software or SOUP so they don’t have to reinvent the wheel and can focus on their core competencies. In some cases, SOUP switches because a team of software developers was able to identify a vulnerability, or another team started using a newer version.

If the developer doesn’t test the entire process and push the code to production, a scenario can occur where the response time is 0.01 seconds when it’s actually 0.015 seconds, causing the device to fail. can wreak havoc on Change is good for identifying and solving problems, but it needs to change. effectively managed Consistently applied across different systems.

Further Perspectives on Software EngineeringWill Low-Code and No-Code Platforms Kill Developers?

How to reduce the risk of recalls and defects

Building safer software starts with relying on better systems, including the use of robust, connected ALMs that enable:

work from source

Today’s manufacturers spend more time documenting their work than building quality products.they work there ZillaFor example, record evidence in another system and approve work in yet another third-party quality system. Not only is this process inefficient, it can pose problems in post-market surveillance of products. When complaints occur, someone must go through each system to identify the source of the complaint and isolate it. These steps take time, but that time is better spent protecting you from the problems that lead to the recall in the first place.

Working from a source system to generate evidence creates a single source of truth that your entire team can collaborate on and reference. This approach breaks down silos and shortens project timelines.

For example, you can generate a software bill of materials directly from your source code and perform risk analysis based on the actual code in your application. When someone changes your code, you’ll automatically be notified and you can assess whether the risk should be revisited.

Shifting design, testing and verification to the left

Shift left refers to the practice of shifting testing, quality, and performance evaluation early in the development process, often before code is even written. Similarly, model-based systems engineering is also a hot idea. In this approach, we create models that test the computational behavior of the system through numerical simulations before actually building and deploying the system.

This method is not applicable to all manufacturers, but some of the basic principles apply, especially when one software solution uses many moving parts and components. Test as early as possible, test faster, and simulate as much as practically possible before putting the system into production.

Aim for rapid change

It is important to be able to quickly update the system to address issues as they are discovered. For example, identifying and immediately mitigating cybersecurity issues is key to making software more secure. Ensuring you have the right systems in place to support the rapid change management required to leverage cloud systems and AI and ML is also essential.

Use existing work to maintain software updates

It may seem strange to lecture, but software company Regarding the importance of maintenance, it’s important to stay abreast of software updates such as security patches and other maintenance releases.

Over the last 10-15 years, a huge amount of automation has been done to simplify certain kinds of work, such as cloud-based development tools and code that connects infrastructure to the internet. This existing work allows engineers to focus on writing unique and differentiated code in the form of life-saving new products. Modern software systems cannot run quickly and reliably without relying on third-party software.

As our reliance on software grows, we need to build trust in it by ensuring that it is safe and works as expected. The products and services we offer are becoming more complex every day. With population growth outpacing new employee training in all facets of the economy, building safer software not only helps automate certain repetitive and dangerous human jobs. , can also save lives.