search menu icon-carat-right cmu-wordmark

Subject: cybersecurity

Cat and Mouse in the Age of .NET

Cat and Mouse in the Age of .NET

• SEI Blog
Brandon Marzik

Penetration testers have long exploited the PowerShell scripting language to gain a foothold in systems and execute an attack. PowerShell is installed on every Windows machine, has direct access to the Windows application programming interface (API), and is rarely disabled. Over the years, red teams have created extensive tool suites to leverage the language for offensive tradecraft. Blue teams have kept pace by developing defenses to stop these tools. Eventually, changes in the PowerShell landscape...

Read More
How to Protect Your High Value Assets

How to Protect Your High Value Assets

• SEI Blog
Brian Benestelli

This post was co-authored by Emily Shawgo. Every organization has mission-critical information and technology assets that require enhanced security. Private organizations may identify these assets informally or rely on community knowledge to decide how to prioritize security resources. Federal government departments and agencies, however, have official guidelines for identifying and securing their high value assets. These guidelines can provide lessons for all organizations protecting their most critical assets. This blog post will outline the background...

Read More
Is Your Organization Using Cybersecurity Analysis Effectively?

Is Your Organization Using Cybersecurity Analysis Effectively?

• SEI Blog
Angela Horneman

Cybersecurity analysis techniques and practices are key components of maintaining situational awareness (SA) for cybersecurity. In this blog post in our series on cyber SA in the enterprise, I define the term analysis, describe what constitutes a security problem that analysts seek to identify, and survey analysis methods. Organizations and analysts can ensure that they are covering the full range of analytical methods by reviewing the matrix of six methods that I present below (see...

Read More
Could Blockchain Improve the Cybersecurity of Supply Chains?

Could Blockchain Improve the Cybersecurity of Supply Chains?

• SEI Blog
Eliezer Kanal

A September 2018 report to the President, Assessing and Strengthening the Manufacturing and Defense Industrial Base and Supply Chain Resiliency of the United States, raised concerns about cybersecurity in light of the reliance on complex supply chains in defense applications. Gaps in the cybersecurity sector lead to pervasive and persistent vulnerabilities to the industrial base, [...] unauthorized access to any facet of manufacturing information could create rippling effects and cause innumerable negative economic and national...

Read More
Six Free Tools for Creating a Cyber Simulator

Six Free Tools for Creating a Cyber Simulator

• SEI Blog
Joseph Mayes

It can be hard for developers of cybersecurity training to create realistic simulations and training exercises when trainees are operating in closed (often classified) environments with no ability to connect to the Internet. To address this challenge, the CERT Workforce Development (CWD) Team recently released a suite of open-source and freely available tools for use in creating realistic Internet simulations for cybersecurity training and other purposes. The tools improve the realism, efficiency, and cost effectiveness...

Read More
How to Use Static Analysis to Enforce SEI CERT Coding Standards for IoT Applications

How to Use Static Analysis to Enforce SEI CERT Coding Standards for IoT Applications

• SEI Blog
David Svoboda

The Jeep hack, methods to hack ATMs, and even hacks to a casino's fish tank provide stark evidence of the risks associated with the Internet of Things (IoT). High-end automobiles today have more than 100 million lines of code, and connectivity between cars and the outside world through, for example, infotainment systems and the Global Positioning System (GPS) expose a number of interfaces that can be attacked to communicate with an automobile in unintended and...

Read More
Cost-Effective Software Security Assurance Workflows

Cost-Effective Software Security Assurance Workflows

• SEI Blog
Bill Nichols

Software developers are increasingly pressured to rapidly deliver cutting-edge software at an affordable cost. An increasingly important software attribute is security, meaning that the software must be resistant to malicious attacks. Software becomes vulnerable when one or more weaknesses can be exploited by an attacker to cause to modify or access data, interrupt proper execution, or perform incorrect actions....

Read More
Obsidian: A New, More Secure Programming Language for Blockchain

Obsidian: A New, More Secure Programming Language for Blockchain

• SEI Blog
Eliezer Kanal

Billions of dollars in venture capital, industry investments, and government investments are going into the technology known as blockchain. It is being investigated in domains as diverse as finance, healthcare, defense, and communications. As blockchain technology has become more popular, programming-language security issues have emerged that pose a risk to the adoption of cryptocurrencies and other blockchain applications. In this post, I describe a new programming language, Obsidian, which we at the SEI are developing...

Read More
Decision-Making Factors for Selecting Application Security Testing Tools

Decision-Making Factors for Selecting Application Security Testing Tools

• SEI Blog
Thomas Scanlon

In the first post in this series, I presented 10 types of application security testing (AST) tools and discussed when and how to use them. In this post, I will delve into the decision-making factors to consider when selecting an AST tool and present guidance in the form of lists that can easily be referenced as checklists by those responsible for application security testing....

Read More
10 Types of Application Security Testing Tools: When and How to Use Them

10 Types of Application Security Testing Tools: When and How to Use Them

• SEI Blog
Thomas Scanlon

Bugs and weaknesses in software are common: 84 percent of software breaches exploit vulnerabilities at the application layer. The prevalence of software-related problems is a key motivation for using application security testing (AST) tools. With a growing number of application security testing tools available, it can be confusing for information technology (IT) leaders, developers, and engineers to know which tools address which issues. This blog post, the first in a series on application security testing...

Read More
Best Practices and Considerations in Egress Filtering

Best Practices and Considerations in Egress Filtering

• SEI Blog
Rachel Kartch

When considering best practices in egress filtering, it is important to remember that egress filtering is not focused on protecting your network, but rather on protecting other organizations' networks. For example, the May 2017 Wannacry Ransomware attack is believed to have exploited an exposed vulnerability in the server message block (SMB) protocol and was rapidly spread via communications over port 445. Egress and ingress filtering of port 445 would have helped limit the spread of...

Read More
Cybersecurity Engineering, Performance, Risk, and Secure Coding: The Latest Work from the SEI

Cybersecurity Engineering, Performance, Risk, and Secure Coding: The Latest Work from the SEI

• SEI Blog
Douglas C. Schmidt

As part of an ongoing effort to keep you informed about our latest work, this blog post summarizes some recently published books, SEI technical reports, and webinars in cybersecurity engineering, performance and dependability, cyber risk and resilience management, cyber intelligence, secure coding, and the latest requirements for chief information security officers (CISOs). These publications highlight the latest work of SEI technologists in these areas. This post includes a listing of each publication, author(s), and links...

Read More
New & Upcoming SEI Research Initiatives

New & Upcoming SEI Research Initiatives

• SEI Blog
Douglas C. Schmidt

In response to a comment on my initial post introducing the SEI blog, I wanted to provide some additional information on new and upcoming SEI research initiatives. In this post, I describe these areas, and include a "sneak preview" of upcoming blog postings in each area....

Read More