This presentation will report on the progresses of the RISCOSS methods and software. Supported by the FP7 program, RISCOSS develops a risk management-based methodology to facilitate the adoption of open source code into mainstream products and services. RISCOSS develops a method and a software platform that integrate the whole decision-making chain, from technology criteria to strategic concerns. Using advanced software engineering techniques and risk management methodologies, RISCOSS develops innovative tools and methods to identify, manage and mitigate risks of integrating third-party open source software. RISCOSS not only enables users to collect informed intelligence on open source components, but goes one step further by offering risk analysies that adapts to individual business situations. RISCOSS delivers a complete solution rather than a piecemeal approach to enable mainstream product developers to safely integrate open source software in their developments. Itself an open source project, RISCOSS is open to thirdparty contributions to help the platform grow in functionalities and make the transition to a fully marketable product or service.

1. Managing
risks
in
OSS
adop/on:
the
RISCOSS
approach
Xavier
Franch,
GESSI
–
UPC
OW2Con’14
Paris
(France),
6-­‐Nov-­‐2014

2. Risks
and
OSS
!
Insufficient
risk
management
has
been
reported
as
one
of
the
topmost
mistakes
to
avoid
when
implemen/ng
OSS-­‐based
solu/ons
!
Such
risks
can
be
manifold:
– evalua/on,
integra/on,
context,
process,
quality
and
evolu/on
!
The
RISCOSS
project
aims
at
the
specifica/on
of
risk
iden/fica/on,
management
and
mi/ga/on
methods
in
OSS
adop8on

3. RISCOSS
use
cases
Five
use
cases
in
public
and
private
sectors
§ ERICSSON
(large
company)
§ CENATIC
(public
administra/on)
§ OW2
(large
community)
§ XWiki
(medium
community
and
SME)
§ Moodbile
(small
community
and
organiza/on)

4. 3-­‐layered
approach
to
risks
Goal
analysis
Risk
analysis
Measurement
Business
goals
Quan8ta8ve
Indicators
Measures
Project
Comm-­‐
unity
Goal
analysis
Sta8s8cal
analysis
Focus
groups
Contextual
Indicators
Scenario-­‐based
assessment
Expert
Decision
maker

5. The
RISCOSS
pla[orm
Risk data
collector
Risk data
collector
manager
Risk data
repository
manager
Business
analysis
manager
Business
analysis
engine
Risk manager
Business
repor6ng
tool
Risk data
Business manager
Business
data

6. Key
points
§ Risk
ontology
§ Flexible
data
model
§ Mul/ple
data
sources
§ OSS
adop/on
pa]erns
§ Risk
models
§ Linking
to
business

7. Ontology
of
risks
Actor
Goal
Task
Resource
Organisa6on
Element
impacts-­‐on
Risk Event
realised-­‐by
Risk
is-­‐a
Business
Risk
is-­‐a
OSS
measure
is-­‐a
Risk
Indicator
evaluates
Risk Driver
aggrega6on-­‐of

8. Flexible
data
model
super
Scope
Unit
sub
Product
Process
Project
Componen
t
OSS
Componen
t
OSS
Community
belongs-­‐to

9. Mul/ple
data
sources
Risk
data
collector
manage
r
Risk data
collector
Risk data
collector
Risk data
collector
Risk data
collector

10. OSS
adop/on
models

11. Risk
models

12. Linking
to
business
(i)

13. Linking
to
business
(ii)

14. Pu_ng
all
together

15. Current
state
§ Emphasis
on
building
good
risk
models
— currently,
licensing
and
quality
factors
— analysis
of
impact
on
business
goals
§ Pla[orm
scenario:
adop/on
of
single
component
§ Future
steps
— composi/on
of
risk
models
— new
scenarios
§ Struggling
to
open
asap!

16. For
more
informa/on:
Xavier
Franch,
franch@essi.upc.edu
RISCOSS
project
coordinator
www.riscoss.eu
#RiscossProject