As part of an ongoing effort to keep you informed about our latest work, I'd like to let you know about some recently published SEI technical reports and notes. These reports highlight the latest work of SEI technologists in workforce competency and readiness, cyber forensics, exploratory research, acquisition, and software-reliant systems. This post includes a listing of each report, author(s), and links where the published reports can be accessed on the SEI website.

Competency Lifecycle Roadmap: Toward Performance Readiness
By Sandra Behrens, Christopher J. Alberts, & Robin Ruefle

Workforce effectiveness relies on two critical characteristics: competence and readiness. This technical note describes the Competency Lifecycle Roadmap (CLR), a preliminary roadmap for understanding and building workforce readiness, developed by the Computer Security Incident Response Team (CSIRT) Development and Training team at the CERT® Program, part of Carnegie Mellon® University's Software Engineering Institute. This note provides an early look at the roadmap, highlights some of its uses to date, and discusses potential next steps in its development and transition.
PDF Download

Network Profiling Using Flow
By Austin Whisnant & Sid Faber

This report provides a step-by-step guide for profiling--discovering public-facing assets on a network--using network flow (netflow) data. Netflow data can be used for forensic purposes, for finding malicious activity, and for determining appropriate prioritization settings. The goal of this report is to create a profile to see a potential attacker's view of an external network.

Readers will learn how to choose a data set, find the top assets and services with the most traffic on the network, and profile several services. A case study provides an example of the profiling process. The underlying concepts of using netflow data are presented so that readers can apply the approach to other cases. A reader using this report to profile a network can expect to end with a list of public-facing assets and the ports on which each is communicating and may also learn other pertinent information, such as external IP addresses, to which the asset is connecting. This report also provides ideas for using, maintaining, and reporting on findings. The appendices include an example profile and scripts for running the commands in the report. The scripts are a summary only and cannot replace reading and understanding this report.
PDF Download

Results of SEI Line-Funded Exploratory New Starts Projects
By Len Bass, Nanette Brown, Gene Cahill, William Casey, Sagar Chaki, Cory Cohen, Dionisio de Niz, David French, Arie Gurfinkel, Rick Kazman, Ed Morris, Brad Myers, William Nichols, Robert L. Nord, Ipek Ozkaya, Raghvinder S. Sangwan, Soumya Simanta, Ofer Strichman, & Peppo Valetto

The SEI annually undertakes several line-funded exploratory new starts (LENS) projects. These projects serve to (1) support feasibility studies investigating whether further work by the SEI would be of potential benefit and (2) support further exploratory work to determine whether there is sufficient value in eventually funding the feasibility study work as an SEI initiative. Projects are chosen based on their potential to mature and/or transition software engineering practices, develop information that will help in deciding whether further work is worth funding, and set new directions for SEI work. This report describes the LENS projects that were conducted during fiscal year 2011 (October 2010 through September 2011).
PDF Download

The Evolution of a Science Project: A Preliminary System Dynamics Model of a Recurring Software-Reliant Acquisition Behavior
By William Novak, Andrew Moore & Christopher Alberts

Analysis work by the SEI on data collected from more than 100 Independent Technical Assessments (ITAs) of software-reliant acquisition programs has produced insights into some of the most common ways that programs encounter difficulties.

This report describes work done at the SEI that is based on these insights, and intends to mitigate the effects of both misaligned acquisition program organizational incentives, and adverse soft-ware-reliant acquisition structural dynamics, by improving acquisition staff decision-making. The research presented here uses a preliminary system dynamics model to analyze a specific adverse acquisition dynamic concerning the poorly controlled evolution of small prototype efforts into full-scale systems that is called "The Evolution of a Science Project."

The report provides a narrative from an actual acquisition program that exemplifies the dynamic, qualitatively describes its key aspects, and presents some of the most relevant prior research done on one of those aspects, project rework. The system dynamics model of the behavior is described in detail, along with the process by which it was developed, and the results of simulations run using the model. The report concludes with a set of lessons learned about system dynamics modeling, as well as potential future research directions.
PDF Download

A Virtual Upgrade Validation Method for Software-Reliant Systems
By Dio de Niz, Peter Feiler, David Gluch, & Lutz Wrage

This report presents a Virtual Upgrade Validation (VUV) method to improve design quality and confidence in qualification through testing for military systems impacted by computer platform changes. This approach uses architecture-centric, model-based analysis to identify system-level problems early in the upgrade process to complement established test qualification techniques. For purposes of this report, the authors focus on changes to the computer platform consisting of processors, network, operating system, and runtime infrastructure. They describe the VUV method steps and introduce the Architectural Dependencies Catalog that provides guidance for modelers on which aspects of the system to model and how to model them. The report also provides a history and overview of the Architecture Analysis and Design Language standard, which is used with the VUV method.
PDF Download

Additional Resources

For the latest SEI technical reports and papers, please visit
www.sei.cmu.edu/library/reportspapers.cfm