Can a group of software developers, located in Mexico, achieve CMMI® certification and set the standard for their larger U.S. parent company to follow? A software branch of Freescale Semiconductors Inc., located in Guadalajara, did exactly that. Developing the CMMI® processes and procedures that made business sense for a remote software group was tricky, but not as tricky as assuring that they aligned their practices with the parent company's processes and requirements. The months of work that led to this achievement were filled with high points-and big challenges. Jeff Fiebrich discusses the planning, budgeting, and implementation that contributed to their ultimately successful CMMI® certification. He addresses the collaboration between their parent company and the local government that was an essential part of this effort. And, most importantly, Jeff reveals the immediate impact of their certification on the entire company.

Service Oriented Architecture (SOA) is becoming a widely adopted approach for enterprises to attain agility and economy while meeting their Information Technology (IT) needs. Unlike previous attempts at component based software development efforts, development in SOA environments stresses code reuse through development, deployment, and orchestration standards. Frank Cohen explains the major trends currently in play that impact the use of XML in SOA and how a new base of computing technology using composite applications, Registry/Repository, Enterprise Service Bus (ESB,) Master Data Management (MDM), Database, and SOA protocols and practices deliver a solution. Frank begins with the SOA basics, explains their applications, and shares specific metrics that you can use to govern your SOA efforts.

• Identify where SOA is applicable, and where it is not
• The importance of performance and scalability

Security threats are becoming increasingly more dangerous to consumers and to your organization. Paco Hope provides the latest on static analysis techniques for finding vulnerabilities and the tools you need for performing white-box secure code reviews. He provides guidance on selecting and using source code static analysis and navigation tools. Learn why secure code reviews are imperative and how to implement a secure code review process in terms of tasks, tools, and artifacts. In addition to describing the steps in the static analysis process, Paco explains methods for examining threat boundaries, error handling, and other "hot spots" in software. Find out about the analysis techniques of Attack Resistance Analysis, Ambiguity Analysis, and Underlying Framework Analysis as ways to expose risk and prioritize remediation of insecure code.

• Why secure code reviews are the right approach for finding security defects

When it comes to system and acceptance testing, project teams often end up scrambling for resources, late in the project schedule. The test team must be assembled or expanded, learn the application, and improve their skills before testing begins. When the project ends, the team is downsized or disbanded and its knowledge, skills, and experience are all diminished or lost. David Wong thinks there is a better way-organize skilled individuals into a Testing Center of Excellence (TCOE) to leverage their built-up expertise and application knowledge. A TCOE increases operational efficiencies and provides your organization with one-stop shopping for all testing services. The TCOE is responsible for scheduling test cycles, recruiting and training new staff, and retaining a pool of talented test professionals.