Could software save lives after a natural disaster? Meteorologists use sophisticated software-reliant systems to predict a number of pathways for severe and extreme weather events, such as hurricanes, tornados, and cyclones. Their forecasts can trigger evacuations that remove people from danger.

In this blog post, I explore key technology enablers that might pave the path toward achieving an envisioned end-state capability for software that would improve decision-making and response for disaster managers and warfighters in a modern battlefield, along with some technology deficits that we need to address along the way.

While we work incrementally to close technology gaps for software engineering and information assurance (SE&IA), the SEI also keeps a vision of the end-state for work in this area front and center. Our view of a great end-state for SE&IA--one that can improve decision-making in critical situations-- is to be able to use automated service and data discovery for automated analytical tool composition.

The SEI categorizes its R&D and customer work in technical areas, one of which is SE&IA. Through SE&IA work, we provide technologies to enable those acquiring, developing, operating, or maintaining software-based capabilities to design-in assurance, reduce the attack surface, and increase resilience across the lifecycle, thereby yielding increased capability more quickly at reduced cost.

In our envisioned end-state, computational analytics are rigorously specified and cataloged in a repository and are available for users to discover and call on. When a user expresses a new need that requires data modeling and analytics, software acts on the analytical tool repository to form a response matching the user's desired outcome. When our automated decision aid finds that it does not have an appropriate analytic available, it provides an approximation and points out the need for further analytic development or refinement.

Using a Scenario to Spark Engineering of the Imaginable

For several years, we have used scenarios, vignettes, and/or mission threads to serve as proxies to identify requirements, architecture risks, threat awareness, and other significant SE&IA attributes. In picturing what might be needed to move us closer to this idealized SE&IA state, let us consider response management during a natural disaster. In addition to being a useful capability in its own right, this scenario also approximates conditions that warfighters often face on a modern battlefield.

Imagine the difference it would make if disaster responders or soldiers in an urban tactical setting could rely on automated analytical tool composition enabled by software capabilities for automated service and data discovery. Could software allow disaster responders to reduce loss of life even more than their heroic efforts have already done? Could casualties among victims, first responders, and warfighters be greatly reduced or even eliminated?

In this scenario, disaster response management needs

• rapid and thorough sensor deployment, tasking, and surveillance through automated means of affected and potentially affected areas before, during, and after a disaster
• a robust, rapidly deployed, self-forming network to transmit and aggregate the massive amounts of data generated by the sensors
• automated composition of analytic building blocks into analysis pipelines to fuse and make sense of all the sensor data
• the capability to ascertain rapidly where the living and dead are, where those who are not safe (or at risk of becoming unsafe) are, and what is needed by area
• rapid understanding and situational awareness of supporting services and infrastructure (e.g., power, sewer, and fresh water)
• decision support for assignment and continual reprioritization and queueing of response resources
• continuous system operation in a changeable--and possibly compromised-- computing environment

Nearly a decade ago, Emergency Management offered something of a recipe for ideal SE&IA technical capabilities in disaster response that included situational awareness, interoperability, Internet of Things (IoT) device discovery and connection, and information security.

Superior situational awareness depends on the real-time availability of assured, fused information from various data sources for a dynamic, "full picture of the situation." Support for that level of situational awareness would come from real-time sensor aggregation, data modeling, and analytics that incorporate data from a variety of sensors (e.g., geospatial, human) to enable disaster response managers to keep pace with rapidly changing conditions.

Disaster response managers can use this level of situational awareness to deploy autonomous and human rescue teams effectively; prioritize the distribution of food, water, and medicine; determine best routes for rescuers to get to people in need and for people in need to find shelter; and assess when sheltering in place is the best short-term answer. Ideally, too, this advanced situational awareness capability would feed valuable information to modify training to improve the next response.

A related need is for interoperability to establish and maintain a collaborative flow of information across geographic and political boundaries. Interoperability must also incorporate support for mobile and IoT devices connected with one another and with command centers anywhere in the environment. Disaster response managers need the ultimate in collaborative communications environments to coordinate activities among local, state, federal, military, and non-government organizations providing humanitarian support for rescue or relief efforts and to convey necessary information to those affected by the disaster.

In addition to being reliable (24x7 availability), the system must be secure to ensure that managers receive authenticated reports and imagery of damage and need. For example, in the midst of the recent flooding in Houston caused by Tropical Storm/Hurricane Harvey, Houston mayor Sylvester Turner said, "False forecasts and irresponsible rumors on social media are interfering with efforts by the city of Houston, and its government and news media partners, to provide accurate information to the public." In addition to false reports and rumors, software-based devices and systems can be subject to exploitation of their vulnerabilities to insert incorrect data or to disrupt operations.

How R&D is Helping Us Get There

The path to the end-state we envision offers technology enablers and obstacles (in the form of gaps in existing technology capabilities).

Among the enablers, we see cloud computing infrastructures (and better search tools), increased sensor capabilities, large-scale analytics, data-intensive computing, machine learning (ML), virtual system integration, and improved acquisition practices that leverage Agile and DevOps approaches.

We also recognize that gaps exist in several areas, including:

• techniques for verification of software components of known or unknown origin
• a shortfall in methods to develop and assure resilient software architecture for complex system of systems at scale
• tools for automated code analysis, repair, and transformation to detect and address exploitable software flaws before the software is deployed
• threat-aware sustainment practices, so that software-based system owners can perform upgrades without introducing new vulnerabilities
• a workforce qualified to acquire and evolve complex software capabilities

We are focusing our SE&IA work in several of the enabler and gap technologies, such as

• software analysis tool chaining that accounts for continuous runtime verification
• security-aware acquisition practices that address vulnerabilities and plan for threats earlier and more effectively in the lifecycle
• methods to ensure mission accomplishment, even in the face of adversarial behavior aimed at subverting system operation
• algorithms to gather biometric data (i.e., heart rate) from video of non-stationary subjects in real-world settings
• benchmarks to baseline and analyze the scalability of ML platforms for large-scale and complex applications
• automated techniques to assess cyber operator skill acquisition and proficiency

What do You Think?

While automated discovery and composition of computational building blocks is largely unavailable for now, we believe that software can enable it. If you wonder about the promise software has, just look at the mobile computing and communications powerhouse that you hold in your hand, which has become ubiquitous in daily life.

In our work toward one ideal end-state for SE&IA, we are imagining what software can provide and engineering tools, technologies, and practices to enable our sponsor, and other organizations that rely on software, to accomplish their missions. We would like to hear from you about our envisioned end-state and how R&D can help realize it. We would also like to hear about your envisioned end state as well.

In our next blog entry in this series, we will discuss engineering and an imagined end-state for another SEI technical area: system verification and validation.

Additional Resources

For more information on our SE&IA work, look at Software Engineering and Information Assurance, a Primer.