search menu icon-carat-right cmu-wordmark

SEI Blog

The Latest Research in Software Engineering and Cybersecurity

Latest Posts

Best Practices for Cloud Security

Best Practices for Cloud Security

• SEI Blog
Donald Faatz

As detailed in last week's post, SEI researchers recently identified a collection of vulnerabilities and risks faced by organizations moving data and applications to the cloud. In this blog post, we outline best practices that organizations should use to address the vulnerabilities and risks in moving applications and data to cloud services. These practices are geared toward small and medium-sized organizations; however, all organizations, independent of size, can use these practices to improve the security...

Read More
12 Risks, Threats, & Vulnerabilities in Moving to the Cloud

12 Risks, Threats, & Vulnerabilities in Moving to the Cloud

• SEI Blog
Timothy Morrow

Organizations continue to develop new applications in or migrate existing applications to cloud-based services. The federal government recently made cloud-adoption a central tenet of its IT modernization strategy. An organization that adopts cloud technologies and/or chooses cloud service providers (CSP)s and services or applications without becoming fully informed of the risks involved exposes itself to a myriad of commercial, financial, technical, legal, and compliance risks. In this blog post, we outline 12 risks, threats, and...

Read More
Agile/DevOps, Best Practices in Insider Threat, and Dynamic Design Analysis: The Latest Work from the SEI

Agile/DevOps, Best Practices in Insider Threat, and Dynamic Design Analysis: The Latest Work from the SEI

• SEI Blog
Douglas C. Schmidt

As part of an ongoing effort to keep you informed about our latest work, this blog post summarizes some recently published SEI reports, podcasts, and presentations highlighting our work in cyber risk and resilience management, Agile/DevOps and risk management, best practices in insider threat, and dynamic design analysis. This post also includes a link to our recently published 2017 SEI Year in Review. These publications highlight the latest work of SEI technologists in these areas....

Read More
Automated Assurance of Security-Policy Enforcement In Critical Systems

Automated Assurance of Security-Policy Enforcement In Critical Systems

• SEI Blog
Peter Feiler

As U.S. Department of Defense (DoD) mission-critical and safety-critical systems become increasingly connected, exposure from security infractions is likewise increasing. In the past, system developers had worked on the assumption that, because their systems were not connected and did not interact with other systems, they did not have to worry about security. "Closed" system assumptions, however, are no longer valid, and security threats affect the safe operation of systems. To address exponential growth in the...

Read More
Deep Learning: Going Deeper toward Meaningful Patterns in Complex Data

Deep Learning: Going Deeper toward Meaningful Patterns in Complex Data

• SEI Blog
Carson Sestili

In a previous blog post, we addressed how machine learning is becoming ever more useful in cybersecurity and introduced some basic terms, techniques, and workflows that are essential for those who work in machine learning. Although traditional machine learning methods are already successful for many problems, their success often depends on choosing and extracting the right features from a dataset, which can be hard for complex data. For instance, what kinds of features might be...

Read More
Why You Should Apply Agile-DevOps Earlier in the Lifecycle

Why You Should Apply Agile-DevOps Earlier in the Lifecycle

• SEI Blog
Hasan Yasar

DevOps is a set of development practices that emphasizes collaboration, communication, and automation throughout the application lifecycle. In DevOps, all stakeholders--including IT operations staff, testers, developers, customers, and security personnel--are embedded from the inception of the project to its end. This blog post describes SEI research and customer engagements aimed at applying DevOps practices that are typically used at the end of the lifecycle to automate governance at the beginning of the development timeline....

Read More
Efficient and Effective Software Sustainment of Product-Line-Based Systems

Efficient and Effective Software Sustainment of Product-Line-Based Systems

• SEI Blog
Mike Phillips

In the SEI's examination of the software sustainment phase of the Department of Defense (DoD) acquisition lifecycle, we have noted that the best descriptor for sustainment efforts for software is "continuous engineering." Typically, during this phase, the hardware elements are repaired or have some structural modifications to carry new weapons or sensors. Software, on the other hand, continues to evolve in response to new security threats, new safety approaches, or new functionality provided within the...

Read More
Video Summarization: Using Machine Learning to Process Video from Unmanned Aircraft Systems

Video Summarization: Using Machine Learning to Process Video from Unmanned Aircraft Systems

• SEI Blog
Kevin Pitstick

As the use of unmanned aircraft systems (UASs) increases, the volume of potentially useful video data that UASs capture on their missions is straining the resources of the U.S. military that are needed to process and use this data. This publicly released video is an example of footage captured by a UAS in Iraq. The video shows ISIS fighters herding civilians into a building. U.S. forces did not fire on the building because of the...

Read More