![](bg5.png)
and ensures quality (see Sect. 4.2). At the end of this
phase, the result is a sound CBK content base pro-
viding a complete, up-to-date, and validated state-of-
the-art of this interdisciplinary research field. A high
benefit of this work is expected for researchers from
service, security, and software engineering. But also
practitioners will find it interesting to get a glimpse
on what current research has to offer.
The run phase is marked by the launch of the CBK
for the general public in terms of reading and writ-
ing. At this point in time, the CBK should provide
a complete overview of the research field of secure
software development. To launch the CBK with a
sound content base, which has mostly been created by
the community itself, increases the attraction of the
CBK for other people that we considered in the use
cases (see Sect. 2). Especially for practitioners and
for stakeholders other than researchers, learning trails
will guide through the vast amount of research results,
with respect to their expert level (see Sect. 3.3).
4.2 Quality Assurance
The SMW+ supports quality assurance tasks in dif-
ferent ways. Authors are notified via e-mail, when
other people have modified their KO. In the case of
vandalism or wrong information, it is possible to re-
vert the changes back to a previous state, making use
of the versioning functionality of SMW+. If provided
information is controversial, the system allows users
to have discussions for each knowledge object on the
same page. If new attributes are introduced into the
ontology, it is usually the case that these attributes
lack of values for existing individuals. SMW+ pro-
vides a mechanism to gather information about miss-
ing attribute values and allows us to notify the respec-
tive author. Furthermore, SMW+ provides an elabo-
rate access control mechanism, which makes it possi-
ble to define groups and assign read and write access
rights. We make use of this mechanism in order to
introduce roles, each with different access rights for,
e.g., KOs, KAs or administrative functions of SMW+.
Depending on the project phase, quality is assured
in different ways.
In the inception phase, quality is assured by a re-
strictive access control, allowing only partners of the
network to have full access to the CBK. Additionally,
a central quality assurance (QA) team will start their
work having a regular qualitative review on the con-
tents of the CBK, flagging them with a marker indi-
cating when a KO needs to be revised due to a low
content quality. But not only the QA team is able to
flag KOs. Everyone is allowed to flag an article if
vandalism is detected.
While the inception phase is characterized by
a controlled environment through a closed user
group, the run phase takes a more decentralized and
community-driven approach. Since we assume that
we will reach a critical mass of users during a short
period after going public, content contribution will in-
crease and self-regulation will become realistic. Thus,
quality assurance is incrementally shifted over to the
user, because the QA task is no more feasible to be ex-
ercised by a few experts. Instead, experts will rather
be assigned responsibilities along the knowledge ar-
eas, taking a more moderating role.
As already mentioned, the underlying SMW+
platform supports both approaches, providing ade-
quate collaboration functionality such as feedback
and access control mechanisms.
5 RELATED WORK
The concept of a codified BOK is not new and can be
found in many different disciplines. Compared to our
CBK, they all differ in how they were created and in
how knowledge is codified.
All of the BOKs presented in the following were
created top-down. By this we mean that an expert
team was formed or authors were chosen to write ar-
ticles. Our approach comprises a top-down phase, but
also a bottom-up phase in which the CBK is opened
to the public in terms of reading and writing (see
Sect. 4). This is comparable to the shift from the cre-
ation of the Encyclopedia Britannica to the creation of
Wikipedia, acknowledging the fact that new knowl-
edge is generated very fast and by many people these
days.
A BOK mentioned before is the “Software
Engineering Body of Knowledge” aka SWEBOK
(Bourque and Dupuis, 2005), the most prominent
among all other BOKs within the SE discipline. The
Computer Engineering Body of Knowledge (Com-
puting Curricula 2005) (Div. Auth., 2006) and the
Software Engineering Education Knowledge (SEEK)
(part of (Div. Auth., 2004)) have a special focus on SE
education. The Project Management Body of Knowl-
edge (PMBOK) (Project Management Institute, 2008)
is also well-known and covers project management
knowledge in general. In the security field, BOKs do
exist with different focuses promoted by both indus-
try and governments such as the Information Tech-
nology Security Essential Body of Knowledge (U.S.
Department of Homeland SecurityOffice of Cyberse-
curity and Communications National Cyber Security
Division, 2008).
A more collaborative approach is taken by the two
TOWARDS A COMMON BODY OF KNOWLEDGE FOR ENGINEERING SECURE SOFTWARE AND SERVICES
373