Can generic software be assured?

There are many definitions as to what COTS software is. The author uses a very simple definition: COTS software is software functionality obtained from a third party and that is used on an “as is” basis. Examples here include operating system utilities, class libraries, databases, word processing applications, and browser plug-ins. Software assurance problems become magnified for systems that are heavily comprised from COTS software because most of the prevalent quality improvement techniques cannot be applied by the user of the acquired software. These techniques are of course available to the software publisher, but whether the publisher opts to use them cannot be independently verified by the user. That is alarming and could be highly problematic for organizations that opt to buy versus build software systems. In summary, the lack of software quality and publisher responsibility are the greatest concerns that the author sees facing the software industry. The upside, however, is that certification and IV&V can bring assurance back to generic software