Microservices are small applications with a single responsibility that can be deployed, scaled, and tested independently. They’re gaining momentum across industries to facilitate agile delivery mechanisms for service-oriented architecture and to migrate function-oriented legacy architectures toward highly flexible service orientation. This article presents a brief overview of microservice technologies and how to migrate to them.

No consolidated set of software engineering best practices for the Internet of Things (IoT) has yet emerged. Too often, the landscape resembles the Wild West, with unprepared programmers putting together IoT systems in ad hoc fashion and throwing them out into the market, often poorly tested. In addition, the academic sector is in danger of fragmenting into specialized, often unrelated research areas. This IEEE Software theme issue aims to help provide the basis for a set of best practices that will guide the industry through the challenges of software engineering for the IoT

Introduction: Chemical, biological, radiological, and nuclear (CBRN) emergencies need particular hospital preparedness and resources availability. Also, specific skills and capabilities are required for efficient response to these types of events. The aim of this study was to develop an assessment tool to evaluate hospital preparedness and response performance with respect to CBRN emergencies. Methods: An evaluation tool was developed using the Delphi technique. A panel of experts from 10 countries, both European and non-European, with more than 5 years of experience in research or practice in CBRN emergency management was involved in this study. The study was run online, and the experts were asked to evaluate a list of items on hospital preparedness and response in CBRN emergencies. A threshold of 85% agreement level was defined as the consensus of experts in this study. Results: The first-round questionnaire was answered by 13 experts. Consensus on the preparedness section was reached for all 29 items during the first round and one item was also added by the experts. Consensus on the response performance indicators were reached in 51 out of the 59 items, during the first round, and eight items were modified and then approved in the second round by the experts. Conclusion: Hospitals need a specific level of preparedness to enable an effective response to CBRN emergencies. The assessment tool, developed through experts’ consensus in this study, provides a standardized method for the evaluation of hospital preparedness and response performance with respect to CBRN emergencies. The feasibility and reliability of this assessment tool could be evaluated before and during simulated exercises in a standardized manner.

Compliance with the new European General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and security assurance are currently two major challenges of Cloud‐based systems. GDPR compliance implies both privacy and security mechanisms definition, enforcement and control, including evidence collection. This study presents a novel DevOps framework aimed at supporting Cloud consumers in designing, deploying and operating (multi)Cloud systems that include the necessary privacy and security controls for ensuring transparency to end‐users, third parties in service provision (if any) and law enforcement authorities. The framework relies on the risk‐driven specification at design time of privacy and security level objectives in the system service level agreement and in their continuous monitoring and enforcement at runtime.

Although the risk assessment discipline has been studied from long ago as a means to support security investment decision-making, no holistic approach exists to continuously and quantitatively analyze cyber risks in scenarios where attacks and defenses may target different parts of Internet of Things (IoT)-based smart grid systems. In this paper, we propose a comprehensive methodology that enables informed decisions on security protection for smart grid systems by the continuous assessment of cyber risks. The solution is based on the use of attack defense trees modelled on the system and computation of the proposed risk attributes that enables an assessment of the system risks by propagating the risk attributes in the tree nodes. The method allows system risk sensitivity analyses to be performed with respect to different attack and defense scenarios, and optimizes security strategies with respect to risk minimization. The methodology proposes the use of standard security and privacy defense taxonomies from internationally recognized security control families, such as the NIST SP 800-53, which facilitates security certifications. Finally, the paper describes the validation of the methodology carried out in a real smart building energy efficiency application that combines multiple components deployed in cloud and IoT resources. The scenario demonstrates the feasibility of the method to not only perform initial quantitative estimations of system risks but also to continuously keep the risk assessment up to date according to the system conditions during operation.