198 BOOK REVIEWS

of the SPARK approach/philosophy and then describesthe language and tools in a little more detail. Part 2provides a detailed review of the language while Part 3describes the tools.

To summarize, this is a well-written book that pro-vides a good overview of an interesting approach tosoftware development: that based on SPARK Ada andthe corresponding tool set. I highly recommend thisbook to anyone wishing to learn more about the SPARKapproach.

ROBERT M. HIERONSReviews Editor for STVR,

Department of Information Systems and Computing,Brunel University,

Uxbridge,Middlesex UB8 3PH, U.K.

QUALITY WEB SYSTEMS: PERFORMANCE,SECURITY, AND USABILITY. By Elfriede Dustin,Jeff Rashka and Douglas McDiarmid. Published byAddison-Wesley, Boston, MA, U.S.A., 2001. ISBN:0-201-71936-3, 318 pages. Price: U.K. £34.99,U.S.A. $44.99, Soft Cover.

This book aims to provide a single source textbookthat addresses the ‘key success factors’ for quality Websystems, namely: security, performance and scalability,compatibility, usability and the specification of func-tionality. The book attempts to provide a guide for theengineering of these factors and the test activities toensure that they are achieved.

Chapter 1 sets out a very brief overview of thearchitecture of Web systems, as well as their busi-ness objectives, key success factors and the notion ofprioritization. Chapter 2 presents a generic approach todescribing system functionality using ‘Requirements,Service and Interface’ (RSI) use cases and the selectionof test cases based on them. Chapters 3, 4, 5 and 6 coverthe security, performance and scalability, compatibility,and usability and accessibility aspects of Web sites andguidelines for testing. Chapter 7 presents an overviewof tools and the substantial appendices provide usefultest checklists, tool evaluations and the case study usedin many of the chapters.

At a high level, the organization of the book is verygood. The title of the book implies there are threekey areas—in fact, the book presents the challengesand an overview of five areas, including functionalityand compatibility. (I assume the publishers wanteda punchier title.) Chapters 2–6, which make up thecore of the book, are less coherent at a detailed level.

Essentially, these chapters present an overview of therisks, followed by testing hints and tips.

I particularly liked Chapter 2, which sets out the RSImethod of using use cases to document requirementsand introduces the notion of black-box test designbased on use cases, with hints at how ‘gray box’ testingmight be done.

The chapter on security provides an interesting butpartial list of security risks, mixed with brief descrip-tions of the technologies involved. Security is a hugesubject, but there is no discussion of hacker attackmethodologies, denial of service attacks and the secu-rity assessment process is only briefly covered.

The performance and scalability chapter providesan interesting overview of performance testing andhas useful graphics showing resource usage/load andresponse time/load graphs. The chapter is strong onthe causes of poor performance and the diagnosis andremedy of bottlenecks. However, it is weaker on thespecification and design of tests—for example, thereis no mention of database volume requirements andthe challenges of building realistically-sized test envi-ronments. There is little discussion of the practicalitiesof executing tests in real-world complex architecturesor where only partial environments are available fortesting.

The compatibility chapter sets out the causes of siteincompatibilities in some detail. However, compati-bility testing is only briefly covered and, essentially,promotes functional testing and visual inspection.Tools are mentioned, but no advice on their use forHTML validation and browser compatibility, for exam-ple, is given.

The usability and accessibility chapter focuses ondesign issues and discusses accessibility (although,surprisingly, there is no mention of the Web Acces-sibility Initiative). The section on usability evaluationfocuses primarily on informal methods based aroundheuristic evaluation and explores some of the practical-ities. It touches on the use of usability labs but doesnot cover collaborative usability inspections or expertevaluation.

The tools chapter presents tool categories and brieflistings of tools with which, it seems, the authors havedirect experience. There is little mention of free andshareware tools and no guidance on where home-brewtools might be appropriate. More references to the hugerange of tools now available, or at least some Web-based tool listings, would have been useful.

The first appendix provides a comprehensive check-list for usability assessments in addition to checklistsfor the other success criteria. Using a comprehensive

Copyright c© 2003 John Wiley & Sons, Ltd. Softw. Test. Verif. Reliab. 2003; 13:197–199

BOOK REVIEWS 199

list of key tool characteristics, a very useful comparisonof the offerings of five major tool vendors is alsoprovided as a second appendix. The authors make nojudgments or recommendations, but the listing shouldprove useful as a way of identifying potential candi-date tools. The third and final appendix presents thefunctional and non-functional requirements for the casestudy used throughout the book.

The book promises much but was somewhat disap-pointing. It does not provide any overall strategy orprocess for testing, but does give a useful introductionto the topics of performance, security and usability.It does not cover all the aspects of testing for Websystems and it dwells more on Web site risks ratherthan the practicalities of testing. There are gaps in thecoverage of risks and testing, most notably in the areaof component-level, security, small and large scale inte-gration testing. The book did not differentiate betweenInternets and Intranets or mention post-deploymentmonitoring.

The guidance provided appears to be based onthe authors’ direct experience, which is very soundbut there are too many vague recommendations made(without supporting references) in areas that appearto be beyond their experience. The book is aimed atWeb architects, developers, test engineers and projectmanagers, but would appear lightweight for the moretechnically aware reader.

Given the large number of good resources now avail-able on the Web, the number of references appearingin the book is surprisingly low. The references that areprovided support the propositions made in the book,but there are few references to alternative approaches.There is no glossary of acronyms and terms, whichwould also have made the book more usable.

In summary, the book provides a good basic intro-duction to the risks of Web systems and a backgroundon how these risks can be designed for and tested.The testing guidance provided in each of the mainchapters would be helpful to people who are new totesting Internet-based systems. The chapter explainingthe RSI method is of some interest, but probably onlyrelevant to organizations using use cases to definerequirements and seems to be out of place. The toolcomparison appendix is excellent. The book is well laidout and attractive; the authors’ style is very readableand the index is comprehensive.

I would recommend the book to testers and projectmanagers who are new to Web systems and need aneasily accessible overview.

PAUL GERRARDTechnical Director,

Systeme Evolutif Ltd.,9 Cavendish Place,

London W1G 0QD, U.K.

Copyright c© 2003 John Wiley & Sons, Ltd. Softw. Test. Verif. Reliab. 2003; 13:197–199