Using i* to Represent OSS Ecosystems for Risk Assessment

Open Source Software (OSS) is a strategic asset for organisations thanks to its short time-to-market, the opportunity for a reduced development effort and total cost of ownership, and its customization capabilities. OSS-based solutions include projects that are developed and co-evolve within the same organisation, OSS communities, companies, and regulatory bodies, forming an articulated strategic business ecosystem. The adoption of OSS in commercial projects leads to numerous challenges in the wide spectrum of available OSS solutions and risks emerging from the intrinsic structure of an OSS project. In this position paper we devise the use of i* models for understanding the strategic perspective of OSS ecosystems, representing actors, intentional dependencies and responsibilities. We argue that these models can play a crucial role in the analysis of organisational risks inherent to OSS component adoption and in the definition of risk mitigation activities.