Формування витрат від дії негативних наслідків сценаріїв використання програмного забезпечення

Abstract

Розглянуто основні класи втрат від дії негативних сценаріїв використання програмного забезпечення, а також витрати, повязані із ліквідацією наслідків. Стосовно кожного класу надані метрики, що можуть допомогти оцінити втрати за кожним класом. Запропоновано методику розрахування економічних наслідків згідно з переліченими класами. Ця методика покликана ефективно оцінювати втрати від настання негативних сценаріїв використання програмного забезпеченя не залежно від галузі сучасного бізнесу, в якій розглядається можливий інцидент або той, що відбувся. Методика також ефективно працює з різними масштабами подій і різними сценаріями їх розвитку.

The modern software development uses ‘use cases’ as a core tool of applications’ business logic description. Their core aim is to describe a scenario leading to the delivery of the application’s business value. Aside from positive use cases intended to describe an aim of this application or it’s core features negative use cases are describing acts of software misuse able to cause undesirable consequences. At some circumstances, such misuse may cause significant losses for business and society. But on the other hand mitigation of negative scenarios may raise project costs. So the typical task for product managers and business analysts is to define is it efficient from the cost perspective to manage certain negative scenarios or to invest in studies aimed to define these scenarios. In such case the understanding of possible losses is crucial. A unified evaluation tool applicable for different cases might provide valuable assistance to the product management team in such type of situations. Such an instrument should be flexible, but still giving a clear numeric definition of possible losses. This paper presents a flexible methodic able to be used for the calculation of possible losses from negative use cases. The method defines main loss classes and the metrics able to be used for loss evaluation. Each class is provided with multiple metrics. It allows evaluating cases from different domains and with different scenarios of implementation of losses. This fact makes this methodic applicable to a wide range of areas of business where software is used. The classes are selected to describe the most significant possible losses. The study covers irrecoverable losses, information losses, reputational losses and others. Each of classes may be ignored if it is not applicable for a taken case. The practical result of this methodic’s implementation is numeric values of possible losses or evaluation of losses in similar cases. This data allows proving the necessity of negative scenarios mitigation during software development. It may be used for the initiation of negative scenarious’ investigation at the very beginning of a project. At further steps, it may be also used as a decision making criteria for forming a scope of negative scenarios mitigation. The value of losses able to be caused by any negative scenario may be compared with estimated costs for it’s mitigation. Considering all these facts, the study gives effective evaluation tool for risk managers, project managers and all risk assessment professionals. This tool should help software development specialists to take a proper decision regarding negative scenarios risks arising. The tool may be used at different project stages to cover multiple tasks of risks evaluation.