During software development activities, it is important for Information and Communication Technology (ICT) practitioners to know and understand practices and guidelines regarding information privacy, as software requirements must comply with data privacy laws and members of development teams should know current legislation related to the protection of personal data. In order to gain a better understanding on how industry ICT practitioners perceive the practical relevance of software privacy and privacy requirements and how these professionals are implementing data privacy concepts, we conducted a survey with ICT practitioners from software development organizations to get an overview of how these professionals are implementing data privacy concepts during software design. We performed a systematic literature review to identify related works with software privacy and privacy requirements and what methodologies and techniques are used to specify them. In addition, we conducted a survey with ICT practitioners from different organizations. Findings revealed that ICT practitioners lack a comprehensive knowledge of software privacy and privacy requirements and the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD, in Portuguese), nor they are able to work with the laws and guidelines governing data privacy. Organizations are demanded to define an approach to contextualize ICT practitioners with the importance of knowledge of software privacy and privacy requirements, as well as to address them during software development, since LGPD must change the way teams work, as a number of features and controls regarding consent, documentation, and privacy accountability will be required.

Responding to change over following a plan is one of the Agile Manifesto's values. According to its original perspective, development teams should embrace changes due to a better understanding of the business domain or about the users' needs. This kind of change is well understood and explored by practitioners and researchers. However, the issue of how development teams embrace changes due to unexpected, severe, and atypical external events (like the ones we are facing during COVID-19) have not been fully discussed. In this paper, we present our experience in managing the expectations and changing the development methods to mitigate the risks of carrying out a research and development project (named Virtual Social Office-VSO) during a pandemic time. To this end, we report on an observational study that explains the main differences between the procedures we expected to follow before the pandemic and the procedures we are following. We also present the perceptions of both stakeholder and development teams about the impact of COVID-19 on VSO development. Although the development team quickly adapted itself to work from home, we observed some impact on the development plans. In particular, trying to reconcile the trade-offs between completeness and the tight schedule for the first release was a challenge, since we depended on different partners to collect the information that we need to make available in a mobile application (app) that corresponds to one of the VSO project outcomes. According to one stakeholder, the initial effort to design and prototype the VSO app (using the Design Thinking approach) before the start of the pandemic, has been considered essential to mitigate part of the threats that arose due to the COVID-19. We discuss part of these threats in this paper and the actions we have been taking to mitigate them. In addition, according to members of the development team, working remotely presents both challenges (e.g., adapt to a new routine, prepare a comfortable place, isolation feelings), and benefits (e.g., working hours flexibility, less distraction from co-workers).

In order to guarantee the privacy of users’ data, the Brazilian government created the Brazilian General Data Protection Law (LGPD). This article made a diagnostic of Brazilian organizations in relation to their suitability for LGPD, based on the perception of Information Technology (IT) practitioners who work in these organizations. We used a survey with 41 questions to diagnose different Brazilian organizations, both public and private. The diagnostic questionnaire was answered by 105 IT practitioners. The results show that 27% of organizations process personal data of public access based on good faith and LGPD principles. In addition, our findings also revealed that 16.3% of organizations have not established a procedure or methodology to verify that the LGPD principles are being respected during the development of services that will handle personal data from the product or service design phase to its execution and 20% of the organizations did not establish a communication process to the personal data holders, regarding the possible data breaches. The result of the diagnostic allows organizations and data users to have an overview of how the treatment of personal data of their customers is being treated and which points of attention are in relation to the principles of LGPD.

Misuse of cryptographic (crypto) APIs is a noteworthy cause of security vulnerabilities. For this reason, static analyzers were recently proposed for detecting crypto API misuses. They differ in strengths and weaknesses, and they might miss bugs. Motivated by the inherent limitations of static analyzers, this paper reports on a study of runtime verification (RV) as a dynamic-analysis-based alternative for crypto API misuse detection. RV monitors program runs against formal specifications; it was shown to be effective and efficient for amplifying the bug-finding ability of software tests. We focus on the popular JCA crypto API and write 22 RV specifications based on expert-validated rules in a static analyzer. We monitor these specifications while running tests in five benchmarks. Lastly, we compare the accuracy of our RV-based approach, RVSec, with those of three state-of-the-art crypto API misuses detectors: CogniCrypt, CryptoGuard, and CryLogger. Results show that RVSec has higher accuracy in four benchmarks and is on par with CryptoGuard in the fifth. Overall, RVSec achieves an average F ₁ measure of 95%, compared with 83%, 78%, and 86% for CogniCrypt, CryptoGuard, and CryLogger, respectively. We highlight the strengths and limitations of these tools and show that RV is effective for detecting crypto API misuses. We also discuss how static and dynamic analysis can complement each other for detecting crypto API misuses.