Take time to read your paper against the rubric. I have highlighted yellow important rows which you should target.

I did not see any references to what you read and where got all this information from.  Please add references and citations to your research. 

Also, do not forget to add interviews with industry professionals as personal communication.

Dr. Singh

First Iteration

Effectiveness of Veracode's Web Application Security Testing and Scanning Solutions

Action Research

IST 8101

Bharath Yerukala

Table of contents

PLAN……………………………………………………………………………………………...3

ACT ………………………………………………………………………………………………4

OBSERVE ………………………………………………………………………………………..5

REFLECT ………………………………………………………………………………………...5

First Iteration

Plan

Iteration has three phases, the first one being the planning stage. It is prudent that a researcher, before conducting the actual research, plans for it to develop a clear path that the research will follow the ultimate goals and objectives are achieved. It is the same case where the iteration should be planned before the various activities therein can be conducted in practice. Planning entails various activities that are all aimed at making clear what is to be done and how, when, and by who. The first iteration of this action research has been defined as determining the research focus where the researcher identifies the problem to be analyzed. Various activities that were conducted during the planning phase were as follows:

· Identifying the topic of discussion. The topic under discussion herein has to be identified to give the action research some sense of direction. Without this, the rest of the phases in this iteration may not be possible to undertake, neither are the rest of the iterations in the action research.

· Resources assessment. The researcher also needs to assess the resource requirements for the iteration to determine if there are adequate resources that include time, money, equipment and tools (where necessary) to complete the iteration. Each action requires specified resources whose availability has to be assured before conducting the iteration.

· Resource allocation. This is the activity where the researcher allocates the necessary resources to the various activities and processes for the iteration (generally the action phase).

· Scheduling. This is the last activity where the researcher makes a schedule for the various activities take place in the iteration.

Action

Each iteration will have a second phase as the action phase. When undertaking research projects, the researcher gets ready for the research (planning) before actually conducting the research. The second phase is where the researcher puts the plan into action to materialize the plans and to achieve the objectives of the iteration. This is the phase that makes things real – that is, actions within the iteration done practically. The various activities conducted within the second phase of the iteration are as discussed below:

· Topic adopted. The topic of research was selected. This topic is the web application security testing and scanning. In action research, a topic is chosen and then the problem(s) identified for the purpose of inquiring about it. The problem mentioned in this subject is the ineffectiveness of the various web application security and scanning tools or solutions offered by the different vendors. Despite by various vendors to help solve this problem, the web applications have always been at risk of attacks.

· The scope of the action research is defined. This action research is to be narrowed down because it is too general. The action researcher describes the extent of the action research as focusing on the solutions offered by a company called Veracode Inc., where the researcher will focus on how effective these solutions are in enhancing the security of the web applications.

· Defining metrics. After the scope of the research has been defined, metrics are then defined. Effectiveness can be assessed using various parameters that the researcher needs to identify before applying them. The parameters herein would include the number of vulnerabilities detected and sealed by the company's solutions, as well as the strength of these solutions against the deadliest threats.

ObserveObservation

The essence of conducting a research exercise is to obtain insight into the various issues under study. In other words, the researcher needs to take note of the things happening and their similar outcomes. This is the work of the third phase of the iterations: observation period. In this step, the action researcher keeps a record of all activities and outcomes before seeking explanations in the phase that follows the comment period. Various observations recorded by the action researcher are as follows:

· All web application security solutions claimed by vendors to offer the best solutions in the industry, but the fact remains there are always vulnerabilities. Data present indicates web applications remain among the key target for attacks. The research’s focus was based on this knowledge.

· Veracode is among the vendors offering solutions that could be amongst the best in the industry, and this makes it an excellent choice for the action research. The effectiveness of these solutions will be representative of all others in the industry, and the researcher needs to ascertain claims that all vulnerabilities are taken care of by the company's products.

· The iteration was a success, as the information was available. Defining the problem was supported by facts presented by various experts who claimed the web application to remain vulnerable despite the efforts of the developers to improve their security. This was against the claims by vendors who claimed to offer an ultimate solution, and the conflict has become a topic of discussion by various groups of people. Key parties include the users and the vendors, as well as the experts/developers.

Reflection Comment by Dr. Anand Singh: I did not see any personal communication from industry professionals. Make sure you interview these professional to substantiate your project.

After taking note of the actions undertaken and their similar outcomes, the researcher needs to clarify various issues surrounding the research. In this case, the action researcher intends to explain various matters relating to the happenings in the iteration. Reflection phaseThis is the last phase of the iteration, and it is called the reflection phase. In this phase, the focus is to derive lessons and also explain why things went on as they disdid. This includes also explaining success and failures, as well as the challenges and restraints experienced while undertaking the iteration.

There are a good number of things that went on well. Among these include defining the focus of the action research. Comment by Dr. Anand Singh: Add an Indent here.

The researcher gave the action research a sense of direction, just as the planning phase gives direction to the iteration. The success of this iteration meant the success of the rest. Secondly, the resources were all made available successfully, and this was perhaps because there were not many resources required, just some insight into the problem at hand. Information was the key resource needed for the success of the iteration. There is nothing significant that was seen to go wrong. However, a process that could be improved was the assessment of the problem and extending the focus to one or two more vendors.

The primary challenge herein was the time, whereby some more time would have been more helpful in offering a clearer scope of the problem. Gaps are more likely to appear, and the main one here is focusing on a single company expecting it to be representative of the entire industry. This causes the risk of biases of the outcome of this action research.