Building Systems from Commercial Components

Commercial software components can dramatically reduce the cost and time required to develop complex business-critical systems. However, integrating them offers stiff challenges that are not well understood by most software practitioners, and there have been many spectacular failures. Now, a team of authors from the Software Engineering Institute draws upon the lessons presented by both the failures and the successes, offering a start-to-finish methodology for integrating commercial components successfully. The authors examine failed integration projects, identifying key lessons and early warning signs, including the failure to account for loss of control over engineering design and production. Drawing upon both successes and failures, they present proven solutions for establishing requirements, evaluating components, creating flexible system designs that incorporate commercial components; and managing multiple concurrent design options linked to external market events and feasibility proofs. They also show how to build "just-in-time" competency with commercial components and integration.

Kurt C. Wallnau is a senior technical staff member at the Software Engineering Institute (SEI). He was team lead for the SEI's commercial off-the-shelf (COTS)-based systems project, and now leads the predictable assembly from certifiable components project. He designed and taught the CMU/MSE course in component-based development methods, and has over 20 years experience in research and industry.

Scott A. Hissam is a senior technical staff member at the SEI and adjunct faculty member at the University of Pittsburgh. He has over 15 years of software development experience, including project leadership positions at Lockheed Martin and Bell Atlantic.

Robert Seacord began programming (professionally) for IBM in 1982 and has been programming in C since 1985, and in C++ since 1992. Robert is currently a Senior Vulnerability Analyst with the CERT/Coordination Center at the Software Engineering Institute (SEI). He is coauthor of Building Systems from Commercial Components (Addison-Wesley, 2002) and Modernizing Legacy Systems (Addison-Wesley, 2003). The CERT/CC, among other security-related activities, regularly analyzes software vulnerability reports and assesses the risk to the Internet and other critical infrastructure.