Carnegie Mellon University, Software Engineering Institute

Results per page

Counter AI: What Is It and What Can You Do About It?

August 27, 2024 • White Paper

By Nathan M. VanHoudnos, Shing-hon Lau, Carol J. Smith, Matt Churilla, Lauren McIlvenny, Greg Touhill

This paper describes counter artificial intelligence (AI) and provides recommendations on what can be done about it.
DOWNLOAD this paper describes counter artificial intelligence (ai) and provides recommendations on what can be done about it. Artificial Intelligence Engineering 2024
Lessons Learned in Coordinated Disclosure for Artificial Intelligence and Machine Learning Systems

August 20, 2024 • White Paper

By Matt Churilla, Jeff Havrilla, Vijay S. Sarvepalli, Andrew Kompanek, Lauren McIlvenny, Nathan M. VanHoudnos, Shing-hon Lau, Lena Pons, Allen D. Householder

In this paper, the authors describe lessons learned from coordinating AI and ML vulnerabilities at the SEI's CERT/CC.
DOWNLOAD in this paper, the authors describe lessons learned from coordinating ai and ml vulnerabilities at the sei's cert/cc. CERT/CC Vulnerabilities,Artificial Intelligence,Machine Learning 2024
On the Design, Development, and Testing of Modern APIs

July 30, 2024 • White Paper

By Alejandro Gomez, Alex Vesey

This white paper discusses the design, desired qualities, development, testing, support, and security of modern application programming interfaces (APIs).
DOWNLOAD this white paper discusses the design, desired qualities, development, testing, support, and security of modern application programming interfaces (apis). Secure Development,Secure Coding,Cybersecurity Engineering 2024
A Model Problem for Assurance Research: An Autonomous Humanitarian Mission Scenario

July 23, 2024 • Technical Note

By Anton Hristozov, John E. Robert, Mark H. Klein, Gabriel Moreno

This report describes a model problem to support research in large-scale assurance.
DOWNLOAD this report describes a model problem to support research in large-scale assurance. Software Assurance 2024
Application Programming Interface (API) Vulnerabilities and Risks

June 24, 2024 • Special Report

By McKinley Sconiers-Hasan

This report describes 11 common vulnerabilities and 3 risks related to application programming interfaces, providing suggestions about how to fix or reduce their impact.
DOWNLOAD this report describes 11 common vulnerabilities and 3 risks related to application programming interfaces, providing suggestions about how to fix or reduce their impact. Cybersecurity Engineering 2024
Software Bill of Materials (SBOM) Considerations for Operational Test & Evaluation Activities

June 14, 2024 • White Paper

By Michael S. Bandor

This white paper looks at the background and history of SBOMs as well as the general questions and challenges for use with Operational Test & Evaluation activities.
DOWNLOAD this white paper looks at the background and history of sboms as well as the general questions and challenges for use with operational test & evaluation activities. Secure Development,Security Vulnerabilities,Cyber Risk and Resilience Management,Acquisition 2024
Reachability of System Operation Modes in AADL

May 31, 2024 • Technical Report

By Lutz Wrage

This report presents an algorithm that constructs the set of reachable SOMs for a given AADL model and the transitions between them.
DOWNLOAD this report presents an algorithm that constructs the set of reachable soms for a given aadl model and the transitions between them. Cyber-Physical Systems 2024
Explainable Verification: Survey, Situations, and New Ideas

April 16, 2024 • White Paper

By Bjorn Andersson, Dionisio de Niz, Mark H. Klein

This report focuses on potential changes in software development practice and research that would help tools used for formal methods explain their output, making software practitioners more likely to trust …
DOWNLOAD this report focuses on potential changes in software development practice and research that would help tools used for formal methods explain their output, making software practitioners more likely to trust them. Software Engineering Research and Development 2024
Zero Trust Industry Days 2024: Request for Information (RFI)

February 29, 2024 • White Paper

By The Software Engineering Institute

This request for information (RFI) was created for Zero Trust Industry Days 2024, where developers presented zero trust solutions, shared information, and discussed alternatives.
DOWNLOAD this request for information (rfi) was created for zero trust industry days 2024, where developers presented zero trust solutions, shared information, and discussed alternatives. Cyber Risk and Resilience Management 2024
Zero Trust Industry Days 2024 Scenario: Secluded Semiconductors, Inc.

February 27, 2024 • White Paper

By Rhonda Brown

This scenario guides discussions of solutions submitted to address the challenges of implementing zero trust.
DOWNLOAD this scenario guides discussions of solutions submitted to address the challenges of implementing zero trust. Enterprise Risk and Resilience Management 2024
Considerations for Evaluating Large Language Models for Cybersecurity Tasks

February 20, 2024 • White Paper

By Girish Sastry (OpenAI), Samuel J. Perl, Joel Parish (OpenAI), Jeff Gennari, Shing-hon Lau

In this paper, researchers from the SEI and OpenAI explore the opportunities and risks associated with using large language models (LLMs) for cybersecurity tasks.
DOWNLOAD in this paper, researchers from the sei and openai explore the opportunities and risks associated with using large language models (llms) for cybersecurity tasks. Artificial Intelligence Engineering,Cybersecurity Engineering 2024
Navigating Capability-Based Planning: The Benefits, Challenges, and Implementation Essentials

February 7, 2024 • White Paper

By William Nichols, Anandi Hira

Based on industry and government sources, this paper summarizes the benefits and challenges of implementing Capability-Based Planning (CBP).
DOWNLOAD based on industry and government sources, this paper summarizes the benefits and challenges of implementing capability-based planning (cbp). Acquisition 2024
Encoding Verification Arguments to Analyze High-Level Design Certification Claims: Experiment Zero (E0)

January 18, 2024 • White Paper

By Floyd Fazi (Lockheed Martin Corporation), Ronald Koontz (Boeing Company), Gordon Putsche (The Boeing Company), David Tate (Institute of Defense Analysis), Douglas Schmidt (Vanderbilt University), Daniel Shapiro (Institute of Defense Analysis), Jonathan Preston (Lockheed Martin Corporation), George Romanski (Federal Aviation Administration), Hyoseung Kim (University of California, Riverside), John Lehoczky (Carnegie Mellon University), Mark H. Klein, Bjorn Andersson, Dionisio de Niz

This paper discusses whether automation of certification arguments can identify problems that occur in real systems.
DOWNLOAD this paper discusses whether automation of certification arguments can identify problems that occur in real systems. Cyber-Physical Systems 2024
The Measurement Challenges in Software Assurance and Supply Chain Risk Management

December 22, 2023 • White Paper

By Scott Hissam, Carol Woody, Nancy R. Mead

This paper recommends an approach for developing and evaluating cybersecurity metrics for open source and other software in the supply chain.
DOWNLOAD this paper recommends an approach for developing and evaluating cybersecurity metrics for open source and other software in the supply chain. Supply Chain Assurance,Measurement and Analysis,Software Assurance 2023
Report to the Congressional Defense Committees on National Defense Authorization Act (NDAA) for Fiscal Year 2022 Section 835 Independent Study on Technical Debt in Software-Intensive Systems

December 7, 2023 • Technical Report

By Brigid O'Hearn, Julie B. Cohen, Forrest Shull, Ipek Ozkaya

This independent study of technical debt in software-intensive systems was sent to Congress in December 2023 to satisfy the requirements of NDAA Section 835.
DOWNLOAD this independent study of technical debt in software-intensive systems was sent to congress in december 2023 to satisfy the requirements of ndaa section 835. Technical Debt 2023
Assessing Opportunities for LLMs in Software Engineering and Acquisition

November 1, 2023 • White Paper

By James Ivers, Ipek Ozkaya, Julie B. Cohen, Shen Zhang, Stephany Bellomo

This white paper examines how decision makers, such as technical leads and program managers, can assess the fitness of large language models (LLMs) to address software engineering and acquisition needs.
DOWNLOAD this white paper examines how decision makers, such as technical leads and program managers, can assess the fitness of large language models (llms) to address software engineering and acquisition needs. Artificial Intelligence Engineering,Software Engineering Research and Development,Acquisition 2023
Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk (Expanded Set of Practices)

October 2, 2023 • Technical Note

By Christopher J. Alberts, Charles M. Wallen, Carol Woody, Michael S. Bandor

This framework of practices helps programs coordinate their management of engineering and supply chain risks across the systems lifecycle.
DOWNLOAD this framework of practices helps programs coordinate their management of engineering and supply chain risks across the systems lifecycle. Supply Chain Assurance,Software Assurance,Cyber Risk and Resilience Management,Acquisition 2023
Simulating Realistic Human Activity Using Large Language Model Directives

October 2, 2023 • Technical Report

By Dustin D. Updyke, Sean Huff, Thomas G. Podnar

The authors explore how activities generated from the GHOSTS Framework’s NPC client compare to activities produced by GHOSTS’ default behavior and LLMs.
DOWNLOAD the authors explore how activities generated from the ghosts framework’s npc client compare to activities produced by ghosts’ default behavior and llms. Machine Learning,Cyber Workforce Development,Artificial Intelligence 2023
Why Your Software Cost Estimates Change Over Time and How DevSecOps Data Can Help Reduce Cost Risk

September 29, 2023 • White Paper

By Julie B. Cohen

Early software cost estimates are often off by over 40%; this paper discusses how programs must continually update estimates as more information becomes available.
DOWNLOAD early software cost estimates are often off by over 40%; this paper discusses how programs must continually update estimates as more information becomes available. Software Cost Estimates,DevSecOps 2023
A Retrospective in Engineering Large Language Models for National Security

September 29, 2023 • White Paper

By Angelique McDowell, Shannon Gallagher, Andrew O. Mellinger, Jasmine Ratchford, Nick Winski, Eric Heim, Nathan M. VanHoudnos, Hollen Barmer, Swati Rallapalli, William Nichols, Bryan Brown, Tyler Brooks

This document discusses the findings, recommendations, and lessons learned from engineering a large language model for national security use cases.
DOWNLOAD this document discusses the findings, recommendations, and lessons learned from engineering a large language model for national security use cases. 2023
U.S. Leadership in Software Engineering and AI Engineering

August 25, 2023 • White Paper

By Anita Carleton, Forrest Shull, Douglas Schmidt (Vanderbilt University), Erin Harper, Ipek Ozkaya, John E. Robert

A joint SEI/NITRD workshop will advance U.S. national interests through software and AI engineering and accelerate progress across virtually all scientific domains.
DOWNLOAD a joint sei/nitrd workshop will advance u.s. national interests through software and ai engineering and accelerate progress across virtually all scientific domains. Software Engineering Research and Development 2023
A Holistic View of Architecture Definition, Evolution, and Analysis

August 24, 2023 • Technical Report

By Sebastián Echeverría, James Ivers, Rick Kazman

This report focuses on performing architectural decisions and architectural analysis, spanning multiple quality attributes, in a sustainable and ongoing way.
DOWNLOAD this report focuses on performing architectural decisions and architectural analysis, spanning multiple quality attributes, in a sustainable and ongoing way. Software Architecture 2023
Emerging Technologies: Seven Themes Changing the Future of Software in the DoD

August 24, 2023 • White Paper

By Shen Zhang, Michael Abad-Santos, Scott Hissam

This report summarizes the SEI's Emerging Technologies Study (ETS) and identifies seven emerging technologies to watch in software engineering practices and technology.
DOWNLOAD this report summarizes the sei's emerging technologies study (ets) and identifies seven emerging technologies to watch in software engineering practices and technology. Advanced Computing,Artificial Intelligence Engineering,Cybersecurity Engineering,Quantum Computing 2023
Demonstrating the Practical Utility and Limitations of ChatGPT Through Case Studies

August 23, 2023 • White Paper

By Alejandro Gomez, Dominic A. Ross, Matthew Walsh, Clarence Worrell

In this study, SEI researchers conducted four case studies using GPT-3.5 to assess the practical utility of large language models such as ChatGPT.
DOWNLOAD in this study, sei researchers conducted four case studies using gpt-3.5 to assess the practical utility of large language models such as chatgpt. Artificial Intelligence Engineering 2023
Software Excellence Through the Agile High Velocity Development℠ Process

July 17, 2023 • Technical Report

By Stephen Shook (Ishpi Information Technologies, Inc.), Barti K. Perini (Ishpi Information Technologies, Inc.)

The High Velocity Development℠ process earned Ishpi Information Technologies, Inc. the 2023 Watts Humphrey Software Quality Award.
DOWNLOAD the high velocity development℠ process earned ishpi information technologies, inc. the 2023 watts humphrey software quality award. Agile,Process Improvement 2023
Coding the Future: Recommendations for Defense Software R&D

July 13, 2023 • White Paper

By Software Engineering Institute

This report outlines the key recommendations from the November 2022 workshop "Software as a Modernization Priority."
DOWNLOAD this report outlines the key recommendations from the november 2022 workshop "software as a modernization priority." Acquisition,Governance,Mission Assurance 2023
Engineering of Edge Software Systems: A Report from the November 2022 SEI Workshop on Software Systems at the Edge

June 30, 2023 • White Paper

By Ipek Ozkaya, Kevin A. Pitstick, Grace Lewis

Based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for engineering software systems at the edge.
DOWNLOAD based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for engineering software systems at the edge. Edge Computing 2023
Software Bill of Materials Framework: Leveraging SBOMs for Risk Reduction

June 14, 2023 • White Paper

By Charles M. Wallen, Carol Woody, Michael S. Bandor, Christopher J. Alberts

This paper is a Software Bill of Materials (SBOM) Framework that is a starting point for expanding the use of SBOMs for managing software and systems risk.
DOWNLOAD this paper is a software bill of materials (sbom) framework that is a starting point for expanding the use of sboms for managing software and systems risk. Cyber Risk and Resilience Management,Acquisition 2023
Generative AI: Key Opportunities and Research Challenges

June 9, 2023 • White Paper

By Software Engineering Institute

This 2023 workshop report identifies DoD use cases for generative AI and discusses meeting challenges and needs such as investing in guardrails and responsible AI amid a race to capability.
DOWNLOAD this 2023 workshop report identifies dod use cases for generative ai and discusses meeting challenges and needs such as investing in guardrails and responsible ai amid a race to capability. Artificial Intelligence Engineering 2023
Securing UEFI: An Underpinning Technology for Computing

May 30, 2023 • White Paper

By Vijay S. Sarvepalli

This paper highlights the technical efforts to secure the UEFI-based firmware that serves as a foundational piece of modern computing environments.
DOWNLOAD this paper highlights the technical efforts to secure the uefi-based firmware that serves as a foundational piece of modern computing environments. Security Vulnerabilities 2023
Using Model-Based Systems Engineering (MBSE) to Assure a DevSecOps Pipeline is Sufficiently Secure

May 23, 2023 • Technical Report

By Timothy A. Chick, Nataliya Shevchenko, Scott Pavetti

This report describes how analysts can use a model-based systems engineering (MBSE) approach to detect and mitigate cybersecurity risks to a DevSecOps pipeline.
DOWNLOAD this report describes how analysts can use a model-based systems engineering (mbse) approach to detect and mitigate cybersecurity risks to a devsecops pipeline. DevSecOps,Model-Based Systems Engineering 2023
A Strategy for Component Product Lines: Report 2: Specification Modeling for Components in a Component Product Line

May 17, 2023 • Special Report

By Sholom G. Cohen, John J. Hudak, John McGregor

This report introduces the “model chain” concept for specifying a component product line and realizing architecture requirements through the creation–evolution process.
DOWNLOAD this report introduces the “model chain” concept for specifying a component product line and realizing architecture requirements through the creation–evolution process. Governance 2023
A Strategy for Component Product Lines: Report 3: Component Product Line Governance

May 4, 2023 • Special Report

By Sholom G. Cohen, Alfred Schenker

This report provides guidance for the community involved with developing and sustaining product lines of components used by the U.S. government.
DOWNLOAD this report provides guidance for the community involved with developing and sustaining product lines of components used by the u.s. government. Governance 2023
Program Managers—The DevSecOps Pipeline Can Provide Actionable Data

April 24, 2023 • White Paper

By Bill Nichols, Julie B. Cohen

This paper describes the Automated Continuous Estimation for a Pipeline of Pipelines research project, which automates data collection to track program progress.
DOWNLOAD this paper describes the automated continuous estimation for a pipeline of pipelines research project, which automates data collection to track program progress. Acquisition,Measurement and Analysis,Agile,DevSecOps 2023
Zero Trust Industry Day 2022: Areas of Future Research

January 25, 2023 • White Paper

By Trista Polaski, Timothy Morrow, Matthew Nicolai

This paper describes the future research discussed at the 2022 Zero Trust Industry Day event.
DOWNLOAD this paper describes the future research discussed at the 2022 zero trust industry day event. Cyber Risk and Resilience Management 2023
Industry Best Practices for Zero Trust Architecture

December 13, 2022 • White Paper

By Matthew Nicolai, Timothy Morrow, Nathaniel Richmond

This paper describes best practices identified during the SEI’s Zero Trust Industry Day 2022, and provides ways to help organizations shift to zero trust.
DOWNLOAD this paper describes best practices identified during the sei’s zero trust industry day 2022, and provides ways to help organizations shift to zero trust. Cyber Risk and Resilience Management 2022
A Strategy for Component Product Lines: Report 1: Scoping, Objectives, and Rationale

December 8, 2022 • Special Report

By Gabriel Moreno, Alfred Schenker, Sholom G. Cohen, John J. Hudak, John McGregor

This report establishes a Component Product Line Strategy to address problems in systematically reusing and integrating components built to conform to component specification models.
DOWNLOAD this report establishes a component product line strategy to address problems in systematically reusing and integrating components built to conform to component specification models. Software Product Lines 2022
Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk

November 11, 2022 • Technical Note

By Michael S. Bandor, Christopher J. Alberts, Charles M. Wallen, Carol Woody

This report provides an overview of the Acquisition Security Framework (ASF), a description of the practices developed thus far, and a plan for completing the ASF body of work.
DOWNLOAD this report provides an overview of the acquisition security framework (asf), a description of the practices developed thus far, and a plan for completing the asf body of work. Cyber Risk and Resilience Management 2022
Zero Trust Industry Day Experience Paper

October 31, 2022 • White Paper

By Rhonda Brown, Timothy Morrow, Mary Popeck

This paper describes the results of the 2022 Zero Trust Industry Day event.
DOWNLOAD this paper describes the results of the 2022 zero trust industry day event. Cyber Risk and Resilience Management 2022
Challenge Development Guidelines for Cybersecurity Competitions

October 27, 2022 • Technical Report

By Dennis M. Allen, Jarrett Booz, Leena Arora, Joseph Vessella, Josh Hammerstein, Matt Kaar

This paper draws on the SEI’s experience to provide general-purpose guidelines and best practices for developing effective cybersecurity challenges.
DOWNLOAD this paper draws on the sei’s experience to provide general-purpose guidelines and best practices for developing effective cybersecurity challenges. Cyber Workforce Development 2022
Acquisition Security Framework (ASF): An Acquisition and Supplier Perspective on Managing Software-Intensive Systems’ Cybersecurity Risk

October 4, 2022 • White Paper

By Christopher J. Alberts, Carol Woody, Charles M. Wallen, Michael S. Bandor

The Acquisition Security Framework (ASF) contains practices that support programs acquiring/building a secure, resilient software-reliant system to manage risks.
DOWNLOAD the acquisition security framework (asf) contains practices that support programs acquiring/building a secure, resilient software-reliant system to manage risks. Cyber Risk and Resilience Management 2022
Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)

September 15, 2022 • Special Report

By Allen D. Householder

This report proposes a formal protocol specification for MPCVD to improve the interoperability of both CVD and MPCVD processes.
DOWNLOAD this report proposes a formal protocol specification for mpcvd to improve the interoperability of both cvd and mpcvd processes. Security Vulnerabilities,Cybersecurity 2022
Common Sense Guide to Mitigating Insider Threats, Seventh Edition

September 7, 2022 • Technical Report

By Software Engineering Institute

The guide describes 22 best practices for mitigating insider threat based on the CERT Division's continued research and analysis of more than 3,000 insider threat cases.
DOWNLOAD the guide describes 22 best practices for mitigating insider threat based on the cert division's continued research and analysis of more than 3,000 insider threat cases. Insider Threat 2022
Coordinated Vulnerability Disclosure User Stories

August 25, 2022 • White Paper

By Timur D. Snoke, Vijay S. Sarvepalli, Art Manion, Laurie Tyzenhaus, Eric Hatleback, Allen D. Householder, Brad Runyon, Charles G. Yarbrough, Jonathan Spring

This paper provides user stories to guide the development of a technical protocol and application programming interface for Coordinated Vulnerability Disclosure.
DOWNLOAD this paper provides user stories to guide the development of a technical protocol and application programming interface for coordinated vulnerability disclosure. Cybersecurity Engineering 2022
LLVM Intermediate Representation for Code Weakness Identification

July 8, 2022 • White Paper

By David Svoboda, Shannon Gallagher, William Klieber

This paper examines whether intermediate representation used in Large Language Models can be useful to indicate the presence of software vulnerabilities.
DOWNLOAD this paper examines whether intermediate representation used in large language models can be useful to indicate the presence of software vulnerabilities. Artificial Intelligence Engineering 2022
Digital Engineering Effectiveness

May 19, 2022 • White Paper

By Bill Nichols, Alfred Schenker, Tyler Smith (Adventium Labs, Inc.)

This paper explores the reluctance of developers of cyber-physical systems to embrace digital engineering (DE), how DE methods should be tailored to achieve their stakeholders' goals, and how to measure …
DOWNLOAD this paper explores the reluctance of developers of cyber-physical systems to embrace digital engineering (de), how de methods should be tailored to achieve their stakeholders' goals, and how to measure the effectiveness of de-enabled workflows. Cyber-Physical Systems 2022
A Brief Introduction to the Evaluation of Learned Models for Aerial Object Detection

May 2, 2022 • White Paper

By Eric Heim

The SEI AI Division assembled guidance on the design, production, and evaluation of machine-learning models for aerial object detection.
DOWNLOAD the sei ai division assembled guidance on the design, production, and evaluation of machine-learning models for aerial object detection. Best Practices,Data Modeling and Analytics,Artificial Intelligence Engineering 2022
Guidance for Tailoring DoD Request for Proposals (RFPs) to Include Modeling

April 27, 2022 • Special Report

By Julie B. Cohen, Robert Wojcik, Tom Merendino

This report provides guidance for government program offices that are including digital engineering/modeling requirements into a request for proposal.
DOWNLOAD this report provides guidance for government program offices that are including digital engineering/modeling requirements into a request for proposal. Acquisition 2022
Modeling to Support DoD Acquisition Lifecycle Events (Version 1.4)

April 26, 2022 • White Paper

By Robert Wojcik, Tom Merendino, Julie B. Cohen

This document provides suggestions for producing requirement, system, and software models that will be used to support various DoD system acquisition lifecycle events.
DOWNLOAD this document provides suggestions for producing requirement, system, and software models that will be used to support various dod system acquisition lifecycle events. Acquisition 2022
Extensibility

April 6, 2022 • Technical Report

By Rick Kazman, Sebastián Echeverría, James Ivers

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for extensibility.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for extensibility. Software Architecture 2022
TwinOps: Digital Twins Meets DevOps

March 24, 2022 • Technical Report

By John J. Hudak, Anton Hristozov, Joe Yankel, Jerome Hugues

This report describes ModDevOps, an approach that bridges model-based engineering and software engineering using DevOps concepts and code generation from models, and TwinOps, a specific ModDevOps pipeline.
DOWNLOAD this report describes moddevops, an approach that bridges model-based engineering and software engineering using devops concepts and code generation from models, and twinops, a specific moddevops pipeline. Cyber-Physical Systems 2022
Robustness

March 15, 2022 • Technical Report

By Rick Kazman, James Ivers, Sebastián Echeverría, Philip Bianco

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for robustness.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for robustness. Software Architecture 2022
An Analysis of How Many Undiscovered Vulnerabilities Remain in Information Systems

March 9, 2022 • White Paper

By Jonathan Spring

This paper examines the paradigm that the number of undiscovered vulnerabilities is manageably small through the lens of mathematical concepts from the theory of computing.
DOWNLOAD this paper examines the paradigm that the number of undiscovered vulnerabilities is manageably small through the lens of mathematical concepts from the theory of computing. Security Vulnerabilities 2022
Using XML to Exchange Floating Point Data

February 10, 2022 • White Paper

By John Klein

This paper explains issues of using XML to exchange floating point values, how to address them, and the limits of technology to enforce a correct implementation.
DOWNLOAD this paper explains issues of using xml to exchange floating point values, how to address them, and the limits of technology to enforce a correct implementation. System of Systems,Best Practices 2022
Using Machine Learning to Increase NPC Fidelity

December 1, 2021 • Technical Report

By Thomas G. Podnar, Dustin D. Updyke, Geoffrey B. Dobson, John Yarger

The authors describe how they used machine learning (ML) modeling to create decision-making preferences for non-player characters (NPCs).
DOWNLOAD the authors describe how they used machine learning (ml) modeling to create decision-making preferences for non-player characters (npcs). Cyber Workforce Development 2021
A Prototype Set of Cloud Adoption Risk Factors

October 27, 2021 • White Paper

By Christopher J. Alberts

Alberts discusses the results of a study to identify a prototype set of risk factors for adopting cloud technologies.
DOWNLOAD alberts discusses the results of a study to identify a prototype set of risk factors for adopting cloud technologies. Cyber Risk and Resilience Management 2021
Cloud Security Best Practices Derived from Mission Thread Analysis

September 2, 2021 • Technical Report

By Timothy Morrow, Donald Faatz, Angel Luis Hueca, Vincent LaPiana, Nathaniel Richmond

This report presents practices for secure, effective use of cloud computing and risk reduction in transitioning applications and data to the cloud, and considers the needs of limited-resource businesses.
DOWNLOAD this report presents practices for secure, effective use of cloud computing and risk reduction in transitioning applications and data to the cloud, and considers the needs of limited-resource businesses. Cloud Computing 2021
Accenture: An Automation Maturity Journey

July 29, 2021 • Technical Report

By Rajendra T. Prasad (Accenture)

This paper describes work in the area of automation that netted Accenture the 2020 Watts Humphrey Software Process Achievement Award.
DOWNLOAD this paper describes work in the area of automation that netted accenture the 2020 watts humphrey software process achievement award. 2021
Experiences with Deploying Mothra in Amazon Web Services (AWS)

July 26, 2021 • Technical Report

By Brad Powell, John Stogoski, Daniel Ruef

The authors describe development of an at-scale prototype of an on-premises system to test the performance of Mothra in the cloud and provide recommendations for similar deployments.
DOWNLOAD the authors describe development of an at-scale prototype of an on-premises system to test the performance of mothra in the cloud and provide recommendations for similar deployments. Cyber Risk and Resilience Management 2021
Planning and Design Considerations for Data Centers

July 19, 2021 • Technical Note

By Lyndsi A. Hughes, Mark Kasunic, David Sweeney

This report shares important lessons learned from establishing small- to mid-size data centers.
DOWNLOAD this report shares important lessons learned from establishing small- to mid-size data centers. Cyber Risk and Resilience Management 2021
Integrating Zero Trust and DevSecOps

July 5, 2021 • White Paper

By Carol Woody, Timothy Morrow, Geoff Sanders, Nathaniel Richmond

This paper discusses the interdependent strategies of zero trust and DevSecOps in the context of application development.
DOWNLOAD this paper discusses the interdependent strategies of zero trust and devsecops in the context of application development. DevSecOps,Secure Development,Situational Awareness 2021
A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)

July 1, 2021 • Special Report

By Jonathan Spring, Allen D. Householder

This report discusses performance indicators that stakeholders in Coordinated Vulnerability Disclosure (CVD) can use to measure its effectiveness.
DOWNLOAD this report discusses performance indicators that stakeholders in coordinated vulnerability disclosure (cvd) can use to measure its effectiveness. Cybersecurity,Security Vulnerabilities 2021
Human-Centered AI

June 25, 2021 • White Paper

By Matt Gaston, Rachel Dzombak, Hollen Barmer, Tanisha Smith, Carol J. Smith, Jay Palat, Frank Redner

This white paper discusses Human-Centered AI: systems that are designed to work with, and for, people.
DOWNLOAD this white paper discusses human-centered ai: systems that are designed to work with, and for, people. Artificial Intelligence Engineering 2021
Robust and Secure AI

June 25, 2021 • White Paper

By Eric Heim, Rachel Dzombak, Hollen Barmer, Frank Redner, Tanisha Smith, Nathan M. VanHoudnos, Matt Gaston, Jay Palat

This white paper discusses Robust and Secure AI systems: AI systems that reliably operate at expected levels of performance, even when faced with uncertainty and in the presence of danger …
DOWNLOAD this white paper discusses robust and secure ai systems: ai systems that reliably operate at expected levels of performance, even when faced with uncertainty and in the presence of danger or threat. Artificial Intelligence Engineering 2021
Scalable AI

June 25, 2021 • White Paper

By John Wohlbier, Hollen Barmer, Rachel Dzombak, Matt Gaston, Jay Palat, Frank Redner, Tanisha Smith

This white paper discusses Scalable AI: the ability of AI algorithms, data, models, and infrastructure to operate at the size, speed, and complexity required for the mission.
DOWNLOAD this white paper discusses scalable ai: the ability of ai algorithms, data, models, and infrastructure to operate at the size, speed, and complexity required for the mission. Artificial Intelligence Engineering 2021
The Sector CSIRT Framework: Developing Sector-Based Incident Response Capabilities

June 8, 2021 • Technical Report

By Tracy Bills, Brittany Manley, David McIntire, Sharon Mudd, Angel Luis Hueca, Justin Novak

This framework guides the development and implementation of a sector CSIRT.
DOWNLOAD this framework guides the development and implementation of a sector csirt. Incident Management,CSIRT 2021
Foundation of Cyber Ranges

May 19, 2021 • Technical Report

By Dustin D. Updyke, Thomas G. Podnar, Geoffrey B. Dobson, Bill Reed

This report details the design considerations and execution plan for building high-fidelity, realistic virtual cyber ranges that deliver maximum training and exercise value for cyberwarfare participants.
DOWNLOAD this report details the design considerations and execution plan for building high-fidelity, realistic virtual cyber ranges that deliver maximum training and exercise value for cyberwarfare participants. Cyber Workforce Development 2021
Software Assurance Guidance and Evaluation (SAGE) Tool

May 3, 2021 • White Paper

By Hasan Yasar, Robert Schiela, Luiz Antunes, Ebonie McNeil

The Software Assurance Guidance and Evaluation (SAGE) tool helps an organization assess the security of its systems development and operations practices.
DOWNLOAD the software assurance guidance and evaluation (sage) tool helps an organization assess the security of its systems development and operations practices. Software Assurance 2021
Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)

April 30, 2021 • White Paper

By Jonathan Spring, Laurie Tyzenhaus, Vijay S. Sarvepalli, Charles G. Yarbrough, Madison Oliver, Art Manion, Eric Hatleback, Allen D. Householder

This paper presents version 2.0 of a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that takes the form of decision trees and that avoids some problems with the Common Vulnerability Scoring System …
DOWNLOAD this paper presents version 2.0 of a testable stakeholder-specific vulnerability categorization (ssvc) that takes the form of decision trees and that avoids some problems with the common vulnerability scoring system (cvss). Security Vulnerabilities 2021
Modeling and Validating Security and Confidentiality in System Architectures

March 19, 2021 • Technical Report

By Lutz Wrage, Aaron Greenhouse, Jörgen Hansson (University of Skovde)

This report presents an approach for modeling and validating conﬁdentiality using the Bell–LaPadula security model and the Architecture Analysis & Design Language.
DOWNLOAD this report presents an approach for modeling and validating conﬁdentiality using the bell–lapadula security model and the architecture analysis & design language. Software Architecture 2021
Overview of Practices and Processes of the CMMC 1.0 Assessment Guides (CMMC 1.0)

March 3, 2021 • White Paper

By Douglas Gardner

This document is intended to help anyone unfamiliar with cybersecurity standards get started with the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC).
DOWNLOAD this document is intended to help anyone unfamiliar with cybersecurity standards get started with the department of defense (dod) cybersecurity maturity model certification (cmmc). Supply Chain Assurance,Cyber Risk and Resilience Management 2021
Zero Trust: Risks and Research Opportunities

March 1, 2021 • White Paper

By Timothy Morrow, Geoff Sanders

This paper describes a zero trust vignette and three mission threads that highlight risks and research areas to consider for zero trust environments.
DOWNLOAD this paper describes a zero trust vignette and three mission threads that highlight risks and research areas to consider for zero trust environments. Cyber Risk and Resilience Management 2021
Artificial Intelligence (AI) and Machine Learning (ML) Acquisition and Policy Implications

February 26, 2021 • White Paper

By William E. Novak

This paper reports on a high-level survey of a set of both actual and potential acquisition and policy implications of the use of Artificial Intelligence (AI) and Machine Learning (ML) …
DOWNLOAD this paper reports on a high-level survey of a set of both actual and potential acquisition and policy implications of the use of artificial intelligence (ai) and machine learning (ml) technologies. Acquisition 2021
Security Engineering Risk Analysis (SERA) Threat Archetypes

December 16, 2020 • White Paper

By Christopher J. Alberts, Carol Woody

This report examines the concept of threat archetypes and how analysts can use them during scenario development.
DOWNLOAD this report examines the concept of threat archetypes and how analysts can use them during scenario development. Cyber Risk and Resilience Management 2020
Loss Magnitude Estimation in Support of Business Impact Analysis

December 15, 2020 • Technical Report

By Brett Tucker, Andrew P. Moore, David Tobar, Daniel J. Kambic

The authors describe a project to develop an estimation method that yields greater confidence in and improved ranges for estimates of potential cyber loss magnitude.
DOWNLOAD the authors describe a project to develop an estimation method that yields greater confidence in and improved ranges for estimates of potential cyber loss magnitude. Cyber Risk and Resilience Management 2020
Emerging Technologies 2020: Six Areas of Opportunity

December 14, 2020 • White Paper

By Software Engineering Institute

This study seeks to understand what the software engineering community perceives to be key emerging technologies. The six technologies described hold great promise and, in some cases, have already attracted …
DOWNLOAD this study seeks to understand what the software engineering community perceives to be key emerging technologies. the six technologies described hold great promise and, in some cases, have already attracted the interest of the department of defense. 2020
Maintainability

December 1, 2020 • Technical Report

By John Klein, James Ivers, Philip Bianco, Rick Kazman

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for maintainability.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for maintainability. Software Architecture 2020
Advancing Risk Management Capability Using the OCTAVE FORTE Process

November 17, 2020 • Technical Note

By Brett Tucker

OCTAVE FORTE is a process model that helps organizations evaluate their security risks and use ERM principles to bridge the gap between executives and practitioners.
DOWNLOAD octave forte is a process model that helps organizations evaluate their security risks and use erm principles to bridge the gap between executives and practitioners. Cyber Risk and Resilience Management,Enterprise Risk and Resilience Management,OCTAVE 2020
Analytic Capabilities for Improved Software Program Management

November 2, 2020 • White Paper

By Christopher Miller, David Zubrow

This white paper describes an update to the SEI Quantifying Uncertainty in Early Lifecycle Cost Estimation approach.
DOWNLOAD this white paper describes an update to the sei quantifying uncertainty in early lifecycle cost estimation approach. Measurement and Analysis 2020
AI Engineering for Defense and National Security: A Report from the October 2019 Community of Interest Workshop

October 29, 2020 • Special Report

By Software Engineering Institute

Based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for AI Engineering for Defense and National Security.
DOWNLOAD based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for ai engineering for defense and national security. Artificial Intelligence Engineering 2020
NICE Framework Cybersecurity Evaluator

August 20, 2020 • White Paper

By Christopher Herr

This cybersecurity evaluator is designed to assess members of the cyber workforce within the scope of the NICE Cybersecurity Workforce Framework.
DOWNLOAD this cybersecurity evaluator is designed to assess members of the cyber workforce within the scope of the nice cybersecurity workforce framework. 2020
Current Ransomware Threats

August 19, 2020 • White Paper

By Marisa Midler, Kyle O'Meara

This report by Marisa Midler, Kyle O'Meara, and Alexandra Parisi discusses ransomware, including an explanation of its design, distribution, execution, and business model.
DOWNLOAD this report by marisa midler, kyle o'meara, and alexandra parisi discusses ransomware, including an explanation of its design, distribution, execution, and business model. Cybersecurity 2020
An Updated Framework of Defenses Against Ransomware

August 18, 2020 • White Paper

By Timothy J. Shimeall, Timur D. Snoke

This report, loosely structured around the NIST Cybersecurity Framework, seeks to frame an approach for defending against Ransomware-as-a-Service (RaaS) as well as direct ransomware attacks.
DOWNLOAD this report, loosely structured around the nist cybersecurity framework, seeks to frame an approach for defending against ransomware-as-a-service (raas) as well as direct ransomware attacks. Cybersecurity 2020
Historical Analysis of Exploit Availability Timelines

August 13, 2020 • White Paper

By Trent Novelly, Jeff Chrabaszcz (Govini), Allen D. Householder, David Warren, Jonathan Spring

This paper analyzes when and how known exploits become associated with the vulnerabilities that made them possible.
DOWNLOAD this paper analyzes when and how known exploits become associated with the vulnerabilities that made them possible. Measurement and Analysis,CERT/CC 2020
Architecture Evaluation for Universal Command and Control

August 3, 2020 • White Paper

By Harry L. Levinson, Jason Popowski, Reed Little, Philip Bianco, Patrick Donohoe, John Klein

The SEI developed an analysis method to assess function allocations in existing C2 systems and reason about design choices and tradeoffs during the design of new C2 systems.
DOWNLOAD the sei developed an analysis method to assess function allocations in existing c2 systems and reason about design choices and tradeoffs during the design of new c2 systems. Software Architecture 2020
A Risk Management Perspective for AI Engineering

June 10, 2020 • White Paper

By Brett Tucker

This paper describes several steps of OCTAVE FORTE in the context of adopting AI technology.
DOWNLOAD this paper describes several steps of octave forte in the context of adopting ai technology. Cyber Risk and Resilience Management,Cybersecurity,Artificial Intelligence Engineering,OCTAVE,Resilience Management Model (RMM) 2020
Attack Surface Analysis - Reduce System and Organizational Risk

June 8, 2020 • White Paper

By Carol Woody, Robert J. Ellison

This paper offers system defenders an overview of how threat modeling can provide a systematic way to identify potential threats and prioritize mitigations.
DOWNLOAD this paper offers system defenders an overview of how threat modeling can provide a systematic way to identify potential threats and prioritize mitigations. Cybersecurity Engineering 2020
Guide to Implementing DevSecOps for a System of Systems in Highly Regulated Environments

April 8, 2020 • Technical Report

By Suzanne Miller, Peter Capell, Jose A. Morales, Richard Turner, Patrick R. Place, David James Shepard

This Technical Report provides guidance to projects interested in implementing DevSecOps (DSO) in defense or other highly regulated environments, including those involving systems of systems.
DOWNLOAD this technical report provides guidance to projects interested in implementing devsecops (dso) in defense or other highly regulated environments, including those involving systems of systems. Agile,Acquisition 2020
Integrability

February 7, 2020 • Technical Report

By John Klein, Rick Kazman, Philip Bianco, James Ivers

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for integrability.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for integrability. Software Architecture 2020
Comments on NISTIR 8269 (A Taxonomy and Terminology of Adversarial Machine Learning)

February 4, 2020 • White Paper

By Nathan M. VanHoudnos, Jonathan Spring, April Galyardt

Feedback to the U.S. National Institute of Standards and Technology (NIST) about NIST IR 8269, a draft report detailing the proposed taxonomy and terminology of Adversarial Machine Learning (AML).
DOWNLOAD feedback to the u.s. national institute of standards and technology (nist) about nist ir 8269, a draft report detailing the proposed taxonomy and terminology of adversarial machine learning (aml). Best Practices 2020
Penetration Tests Are The Check Engine Light On Your Security Operations

January 7, 2020 • White Paper

By Allen D. Householder, Dan J. Klinedinst

A penetration test serves as a lagging indicator of a network security operations problem. Organizations should implement and document several security controls before a penetration test can be useful.
DOWNLOAD a penetration test serves as a lagging indicator of a network security operations problem. organizations should implement and document several security controls before a penetration test can be useful. Security Vulnerabilities 2020
Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization

December 4, 2019 • White Paper

By Art Manion, Deana Shick, Allen D. Householder, Eric Hatleback, Jonathan Spring

This paper presents a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that takes the form of decision trees and that avoids some problems with the Common Vulnerability Scoring System (CVSS).
DOWNLOAD this paper presents a testable stakeholder-specific vulnerability categorization (ssvc) that takes the form of decision trees and that avoids some problems with the common vulnerability scoring system (cvss). Security Vulnerabilities 2019
Architecture Centric Virtual Integration Process (ACVIP): A Key Component of the DoD Digital Engineering Strategy

September 27, 2019 • White Paper

By Peter H. Feiler, Bruce Lewis (U.S. Army AMCOM), Alex Boydston (U.S. Army ADD/JMR), Steve Vestal (Honeywell Technology Center)

ACVIP is a compositional, architecture-centric, model-based approach enabling virtual integration analysis in the early phases and throughout the lifecycle to detect and remove defects that currently are not found until …
DOWNLOAD acvip is a compositional, architecture-centric, model-based approach enabling virtual integration analysis in the early phases and throughout the lifecycle to detect and remove defects that currently are not found until integration and test. Software Architecture,System of Systems,Best Practices 2019
AI Engineering: 11 Foundational Practices

September 12, 2019 • White Paper

By Software Engineering Institute

These recommendations help organizations that are beginning to build, acquire, and integrate artificial intelligence capabilities into business and mission systems.
DOWNLOAD these recommendations help organizations that are beginning to build, acquire, and integrate artificial intelligence capabilities into business and mission systems. 2019
Machine Learning in Cybersecurity: A Guide

September 5, 2019 • Technical Report

By Jonathan Spring, April Galyardt, Ed Stoner, Angela Horneman, Leigh B. Metcalf, Joshua Fallon

This report suggests seven key questions that managers and decision makers should ask about machine learning tools to effectively use those tools to solve cybersecurity problems.
DOWNLOAD this report suggests seven key questions that managers and decision makers should ask about machine learning tools to effectively use those tools to solve cybersecurity problems. Artificial Intelligence Engineering,Cybersecurity,CERT/CC 2019
Operational Test & Evaluation (OT&E) Roadmap for Cloud-Based Systems

September 2, 2019 • White Paper

By Charles M. Wallen, Carol Woody, Christopher J. Alberts, John Klein

This paper provides an overview of the preparation and work that the AEC needs to perform to successfully transition the Army to cloud computing.
DOWNLOAD this paper provides an overview of the preparation and work that the aec needs to perform to successfully transition the army to cloud computing. Cloud Computing 2019
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award 2018: U.S. Army Combat Capabilities Development Command Armaments Center, Fire Control Systems and Technology Directorate

August 1, 2019 • Technical Report

By Victor A. Elias (U.S. Army CCDC Armaments Center, Fire Control Systems and Technology Directorate)

This report presents a systemic approach to software development process improvement and its impact for the U.S. Army Combat Capabilities Development Command Armaments Center, Fire Control Systems and Technology Directorate …
DOWNLOAD this report presents a systemic approach to software development process improvement and its impact for the u.s. army combat capabilities development command armaments center, fire control systems and technology directorate (fcstd) and its stakeholders. CMMI,Process Improvement 2019
Overview of Risks, Threats, and Vulnerabilities Faced in Moving to the Cloud

July 11, 2019 • Technical Report

By Carrie Lee (U.S. Department of Veteran Affairs), Donald Faatz, Kelwyn Pender, Timothy Morrow

This report, updated in October 2020, examines the changes to risks, threats, and vulnerabilities when applications are deployed to cloud services.
DOWNLOAD this report, updated in october 2020, examines the changes to risks, threats, and vulnerabilities when applications are deployed to cloud services. Cloud Computing,Cybersecurity,Situational Awareness 2019
Automatically Detecting Technical Debt Discussions

June 24, 2019 • White Paper

By Raghvinder Sangwan, Robert Nord, Zachary Kurtz, Ipek Ozkaya

This study introduces (1) a dataset of expert labels of technical debt in developer comments and (2) a classifier trained on those labels.
DOWNLOAD this study introduces (1) a dataset of expert labels of technical debt in developer comments and (2) a classifier trained on those labels. Technical Debt 2019
Multi-Method Modeling and Analysis of the Cybersecurity Vulnerability Management Ecosystem

June 24, 2019 • White Paper

By Allen D. Householder, Andrew P. Moore

This paper presents modeling and analysis of two critical foundational processes of the cybersecurity vulnerability management ecosystem using a combination of system dynamics and agent-based modeling techniques.
DOWNLOAD this paper presents modeling and analysis of two critical foundational processes of the cybersecurity vulnerability management ecosystem using a combination of system dynamics and agent-based modeling techniques. Cybersecurity,Security Vulnerabilities 2019
SCAIFE API Definition Beta Version 0.0.2 for Developers

June 14, 2019 • White Paper

By Lori Flynn, Ebonie McNeil

This paper provides the SCAIFE API definition for beta version 0.0.2. SCAIFE is an architecture that supports static analysis alert classification and prioritization.
DOWNLOAD this paper provides the scaife api definition for beta version 0.0.2. scaife is an architecture that supports static analysis alert classification and prioritization. Secure Coding,Secure Development 2019
Creating xBD: A Dataset for Assessing Building Damage from Satellite Imagery

May 21, 2019 • White Paper

By Software Engineering Institute

We present a preliminary report for xBD, a new large-scale dataset for the advancement of change detection and building damage assessment for humanitarian assistance and disaster recovery research.
DOWNLOAD we present a preliminary report for xbd, a new large-scale dataset for the advancement of change detection and building damage assessment for humanitarian assistance and disaster recovery research. 2019
Integration of Automated Static Analysis Alert Classification and Prioritization with Auditing Tools: Special Focus on SCALe

May 13, 2019 • Technical Report

By David Svoboda, Ebonie McNeil, Lori Flynn, Jiyeon Lee (Carnegie Mellon University), Zachary Kurtz, Derek Leung

This report summarizes progress and plans for developing a system to perform automated classification and advanced prioritization of static analysis alerts.
DOWNLOAD this report summarizes progress and plans for developing a system to perform automated classification and advanced prioritization of static analysis alerts. Cybersecurity,Secure Coding,Secure Development 2019
Cybersecurity Career Paths and Progression

May 7, 2019 • White Paper

By Marie Baker, Dennis M. Allen, Melissa Burns, Nicholas Giruzzi

This paper explores the current state of cybersecurity careers, from the importance of early exposure, to methods of entry into the field, to career progression.
DOWNLOAD this paper explores the current state of cybersecurity careers, from the importance of early exposure, to methods of entry into the field, to career progression. Cybersecurity 2019
Cybersecurity Talent Identification and Assessment

May 7, 2019 • White Paper

By Dennis M. Allen, Marie Baker, Christopher Herr

To help fill cybersecurity roles, this paper explores how organizations identify talent, discusses assessment capabilities, and provides recommendations on recruitment and talent evaluations.
DOWNLOAD to help fill cybersecurity roles, this paper explores how organizations identify talent, discusses assessment capabilities, and provides recommendations on recruitment and talent evaluations. Cybersecurity 2019
Cybersecurity Careers of the Future

May 7, 2019 • White Paper

By Dennis M. Allen

Using workforce data analysis, this paper identifies key cybersecurity skills the workforce needs to close the cybersecurity workforce gap.
DOWNLOAD using workforce data analysis, this paper identifies key cybersecurity skills the workforce needs to close the cybersecurity workforce gap. Cybersecurity 2019
A Targeted Improvement Plan for Service Continuity

April 8, 2019 • Technical Note

By Andrew F. Hoover, Robert A. Vrtis, Philip A. Scolieri, Jeffrey Pinckard, Gavin Jurecko

Describes how an organization can leverage the results of a Cyber Resilience Review to create a Targeted Improvement Plan for its service continuity management.
DOWNLOAD describes how an organization can leverage the results of a cyber resilience review to create a targeted improvement plan for its service continuity management. Cyber Risk and Resilience Management 2019
Exploring the Use of Metrics for Software Assurance

March 7, 2019 • Technical Note

By Charlie Ryan, Robert J. Ellison, Carol Woody

This report proposes measurements for each Software Assurance Framework (SAF) practice that a program can select to monitor and manage the progress it's making toward software assurance.
DOWNLOAD this report proposes measurements for each software assurance framework (saf) practice that a program can select to monitor and manage the progress it's making toward software assurance. software engineering and information assurance,CERT/CC 2019
Common Sense Guide to Mitigating Insider Threats, Sixth Edition

February 27, 2019 • Technical Report

By Sarah Miller, Randall F. Trzeciak, Michael C. Theis, Daniel L. Costa, Andrew P. Moore, William R. Claycomb, Tracy Cassidy

The guide presents recommendations for mitigating insider threat based on the CERT Division's continued research and analysis of more than 1,500 insider threat cases.
DOWNLOAD the guide presents recommendations for mitigating insider threat based on the cert division's continued research and analysis of more than 1,500 insider threat cases. Insider Threat,Best Practices,Cybersecurity 2019
An Approach for Integrating the Security Engineering Risk Analysis (SERA) Method with Threat Modeling

February 6, 2019 • White Paper

By Christopher J. Alberts, Carol Woody

This report examines how cybersecurity data generated by a threat modeling method can be integrated into a mission assurance context using the SERA Method.
DOWNLOAD this report examines how cybersecurity data generated by a threat modeling method can be integrated into a mission assurance context using the sera method. Cybersecurity Engineering,Mission Assurance 2019
Infrastructure as Code: Final Report

January 28, 2019 • White Paper

By John Klein, Doug Reynolds

This project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated IaC scripts from the model.
DOWNLOAD this project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated iac scripts from the model. Software Architecture 2019
Incident Management Capability Assessment

December 19, 2018 • Technical Report

By Pennie Walters, Christopher J. Alberts, Samuel J. Perl, David McIntire, Mark Zajicek, Robin Ruefle, Audrey J. Dorofee, Carly L. Huth

The capabilities presented in this report provide a benchmark of incident management practices.
DOWNLOAD the capabilities presented in this report provide a benchmark of incident management practices. Incident Handling,Incident Management,Cybersecurity 2018
Program Manager's Guidebook for Software Assurance

December 14, 2018 • Special Report

By Timothy A. Chick, Carol Woody, Kenneth Nidiffer

This guidebook helps program managers address the software assurance responsibilities critical in defending software-intensive systems, including mission threads and cybersecurity.
DOWNLOAD this guidebook helps program managers address the software assurance responsibilities critical in defending software-intensive systems, including mission threads and cybersecurity. Software Assurance,software engineering and information assurance 2018
DoD Developer’s Guidebook for Software Assurance

December 14, 2018 • Special Report

By Tom Scanlon, Bill Nichols

This guidebook helps software developers for DoD programs understand expectations for software assurance and standards and requirements that affect assurance.
DOWNLOAD this guidebook helps software developers for dod programs understand expectations for software assurance and standards and requirements that affect assurance. Software Assurance,software engineering and information assurance 2018
Towards Improving CVSS

December 4, 2018 • White Paper

By Allen D. Householder, Art Manion, Deana Shick, Eric Hatleback, Jonathan Spring

This paper outlines challenges with the Common Vulnerability Scoring System (CVSS).
DOWNLOAD this paper outlines challenges with the common vulnerability scoring system (cvss). Security Vulnerabilities 2018
GHOSTS in the Machine: A Framework for Cyber-Warfare Exercise NPC Simulation

December 3, 2018 • Technical Report

By Dustin D. Updyke, Geoffrey B. Dobson, Adam D. Cerini, Luke J. Osterritter, Thomas G. Podnar, Benjamin L. Earl

This report outlines how the GHOSTS (General HOSTS) framework helps create realism in cyber-warfare simulations and discusses how it was used in a case study.
DOWNLOAD this report outlines how the ghosts (general hosts) framework helps create realism in cyber-warfare simulations and discusses how it was used in a case study. Cyber Workforce Development 2018
Composing Effective Software Security Assurance Workflows

October 18, 2018 • Technical Report

By Aaron Volkmann, Jim McHale, David Sweeney, William Snavely, Bill Nichols

In an effort to determine how to make secure software development more cost effective, the SEI conducted a research study to empirically measure the effects that security tools—primarily automated static …
DOWNLOAD in an effort to determine how to make secure software development more cost effective, the sei conducted a research study to empirically measure the effects that security tools—primarily automated static analysis tools—had on costs and benefits. Software Assurance,Process Improvement,Performance and Dependability 2018
FedCLASS: A Case Study of Agile and Lean Practices in the Federal Government

October 5, 2018 • Special Report

By Linda Parker Gates, Nanette Brown, Jeff Davenport, Tamara Marshall-Keim

This study reports the successes and challenges of using Agile and Lean methods and cloud-based technologies in a government software development environment.
DOWNLOAD this study reports the successes and challenges of using agile and lean methods and cloud-based technologies in a government software development environment. Agile,Acquisition 2018
Threat Modeling for Cyber-Physical System-of-Systems: Methods Evaluation

September 25, 2018 • White Paper

By Nataliya Shevchenko, Brent Frye, Carol Woody

This paper compares threat modeling methods for cyber-physical systems and recommends which methods (and combinations of methods) to use.
DOWNLOAD this paper compares threat modeling methods for cyber-physical systems and recommends which methods (and combinations of methods) to use. 2018
Software Architecture Publications

September 17, 2018 • White Paper

By Software Engineering Institute

The SEI compiled this bibliography of publications about software architecture as a resource for information about system architecture throughout its lifecycle.
DOWNLOAD the sei compiled this bibliography of publications about software architecture as a resource for information about system architecture throughout its lifecycle. Software Architecture 2018
Practical Precise Taint-flow Static Analysis for Android App Sets

August 27, 2018 • White Paper

By Michael Zheng, William Klieber, Lori Flynn, William Snavely

This paper describes how to detect taint flow in Android app sets with a static analysis method that is fast and uses little disk and memory space.
DOWNLOAD this paper describes how to detect taint flow in android app sets with a static analysis method that is fast and uses little disk and memory space. Secure Coding,Secure Development 2018
Threat Modeling: A Summary of Available Methods

August 9, 2018 • White Paper

By Tom Scanlon, Carol Woody, Paige O'Riordan, Timothy A. Chick, Nataliya Shevchenko

This paper discusses twelve threat modeling methods from a variety of sources that target different parts of the development process.
DOWNLOAD this paper discusses twelve threat modeling methods from a variety of sources that target different parts of the development process. Cyber-Physical Systems,Cybersecurity Engineering,Software Assurance,Science of Cybersecurity,OCTAVE,SQUARE,Cybersecurity,Mission Assurance,software engineering and information assurance,Insider Threat,Enterprise Risk and Resilience Management 2018
Navigating the Insider Threat Tool Landscape: Low-Cost Technical Solutions to Jump-Start an Insider Threat Program

July 3, 2018 • White Paper

By Michael J. Albrethsen, Derrick Spooner, George Silowash, Daniel L. Costa

This paper explores low cost technical solutions that can help organizations prevent, detect, and respond to insider incidents.
DOWNLOAD this paper explores low cost technical solutions that can help organizations prevent, detect, and respond to insider incidents. Insider Threat 2018
Blacklist Ecosystem Analysis: July - December 2017

April 19, 2018 • White Paper

By Eric Hatleback, Leigh B. Metcalf

This short report provides a summary of the various analyses of the blacklist ecosystem performed from July 1, 2017, through December 31, 2017.
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed from july 1, 2017, through december 31, 2017. Situational Awareness 2018
ROI Analysis of the System Architecture Virtual Integration Initiative

April 12, 2018 • Technical Report

By Peter H. Feiler, Jörgen Hansson (University of Skovde), Steve Helton (The Boeing Company)

This report presents an analysis of the economic effects of the System Architecture Virtual Integration approach on the development of software-reliant systems for aircraft compared to existing development paradigms.
DOWNLOAD this report presents an analysis of the economic effects of the system architecture virtual integration approach on the development of software-reliant systems for aircraft compared to existing development paradigms. Software Architecture 2018
Implementing DevOps Practices in Highly Regulated Environments

April 2, 2018 • White Paper

By Hasan Yasar, Aaron Volkmann, Jose A. Morales

In this paper, the authors layout the process with insights on performing a DevOps assessment in a highly regulated environment.
DOWNLOAD in this paper, the authors layout the process with insights on performing a devops assessment in a highly regulated environment. CERT/CC 2018
A Mapping of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule to the Cyber Resilience Review (CRR)

March 29, 2018 • Technical Note

By Greg Porter (Heinz College at Carnegie Mellon University), Matthew Trevors, Robert A. Vrtis

This technical note describes mapping of HIPAA Security Rule requirements to practice questions found in the CERT Cyber Resilience Review for organizations' use in HIPAA compliance.
DOWNLOAD this technical note describes mapping of hipaa security rule requirements to practice questions found in the cert cyber resilience review for organizations' use in hipaa compliance. Cyber Risk and Resilience Management 2018
A Hybrid Threat Modeling Method

March 27, 2018 • Technical Note

By Ole Villadsen (Carnegie Mellon University), Krishnamurthy Vemuru (University of Virginia), Forrest Shull, Nancy R. Mead

Presents a hybrid method of threat modeling that attempts to meld the desirable features of three methods: Security Cards, Persona non Grata, and STRIDE.
DOWNLOAD presents a hybrid method of threat modeling that attempts to meld the desirable features of three methods: security cards, persona non grata, and stride. Cybersecurity Engineering,Software Assurance 2018
Cyber Mutual Assistance Workshop Report

February 13, 2018 • Special Report

By Dan Bennett, PhD (Army Cyber Institute), Blake Rhoades (Army Cyber Institute), Dan Huynh (Army Cyber Institute), Bill Lawrence (North American Electric Reliability Corporation), Judy Esquibel (Army Cyber Institute), Matt Hutchison (Army Cyber Institute), Fernando Maymi, PhD (Army Cyber Institute), Jonathon Monken (PJM Interconnection), Katie C. Stewart

The Army Cyber Institute hosted a Cyber Mutual Assistance Workshop to identify challenges in defining cyber requirements for Regional Mutual Assistance Groups.
DOWNLOAD the army cyber institute hosted a cyber mutual assistance workshop to identify challenges in defining cyber requirements for regional mutual assistance groups. Cyber Risk and Resilience Management 2018
Embedded Device Vulnerability Analysis Case Study Using Trommel

December 6, 2017 • White Paper

By Madison Oliver, Kyle O'Meara

This document provides security researchers with a repeatable methodology to produce more thorough and actionable results when analyzing embedded devices for vulnerabilities.
DOWNLOAD this document provides security researchers with a repeatable methodology to produce more thorough and actionable results when analyzing embedded devices for vulnerabilities. Security Vulnerabilities 2017
2017 Emerging Technology Domains Risk Survey

October 5, 2017 • Technical Report

By Dan J. Klinedinst, Kyle O'Meara, Joel Land

This report describes our understanding of future technologies and helps US-CERT identify vulnerabilities, promote security practices, and understand vulnerability risk.
DOWNLOAD this report describes our understanding of future technologies and helps us-cert identify vulnerabilities, promote security practices, and understand vulnerability risk. Cyber-Physical Systems,Security Vulnerabilities,Artificial Intelligence Engineering,Insider Threat,Enterprise Risk and Resilience Management 2017
R-EACTR: A Framework for Designing Realistic Cyber Warfare Exercises

September 29, 2017 • Technical Report

By Luke J. Osterritter, Geoffrey B. Dobson, Thomas G. Podnar, Adam D. Cerini

R-EACTR is a design framework for cyber warfare exercises. It ensures that designs of team-based exercises factor realism into all aspects of the participant experience.
DOWNLOAD r-eactr is a design framework for cyber warfare exercises. it ensures that designs of team-based exercises factor realism into all aspects of the participant experience. Cybersecurity Engineering 2017
Architecture Practices for Complex Contexts

September 26, 2017 • White Paper

By John Klein

This doctoral thesis, completed at Vrije Universiteit Amsterdam, focuses on software architecture practices for systems of systems, including data-intensive systems.
DOWNLOAD this doctoral thesis, completed at vrije universiteit amsterdam, focuses on software architecture practices for systems of systems, including data-intensive systems. Software Architecture,Artificial Intelligence Engineering 2017
Defining a Progress Metric for CERT-RMM Improvement

September 8, 2017 • Technical Note

By Gregory Crabb (United States Postal Service), Nader Mehravari, David Tobar

Describes the Cybersecurity Program Progress Metric and how its implementation in a large, diverse U.S. national organization can serve to indicate progress toward improving cybersecurity and resilience capabilities.
DOWNLOAD describes the cybersecurity program progress metric and how its implementation in a large, diverse u.s. national organization can serve to indicate progress toward improving cybersecurity and resilience capabilities. Cyber Risk and Resilience Management 2017
Blacklist Ecosystem Analysis: January - June, 2017

August 22, 2017 • White Paper

By Eric Hatleback, Leigh B. Metcalf

This short report provides a summary of the various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data …
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from january through june 2017. Situational Awareness 2017
The CERT Guide to Coordinated Vulnerability Disclosure

August 15, 2017 • Special Report

By Art Manion, Allen D. Householder, Garret Wassermann, Christopher King

This guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful Coordinated Vulnerability Disclosure process. It also provides insights into how CVD can go …
DOWNLOAD this guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful coordinated vulnerability disclosure process. it also provides insights into how cvd can go awry and how to respond when it does so. CSIRT,Cybersecurity Center Development 2017
Systemic Vulnerabilities in Customer-Premises Equipment (CPE) Routers

July 11, 2017 • Special Report

By Joel Land

This report describes a test framework that the CERT/CC developed to identify systemic and other vulnerabilities in CPE routers.
DOWNLOAD this report describes a test framework that the cert/cc developed to identify systemic and other vulnerabilities in cpe routers. Security Vulnerabilities 2017
Department of Defense Software Factbook

July 11, 2017 • Technical Report

By David Zubrow, Christopher Miller, James McCurley, Rhonda Brown, Mike Zuccher (No Affiliation), Brad Clark

In this report, the Software Engineering Institute has analyzed data related to DoD software projects and translated it into information that is frequently sought-after across the DoD.
DOWNLOAD in this report, the software engineering institute has analyzed data related to dod software projects and translated it into information that is frequently sought-after across the dod. Measurement and Analysis 2017
DidFail: Coverage and Precision Enhancement

July 6, 2017 • Technical Report

By William Snavely, William Klieber, Lori Flynn, Xiaoxiao Tang (No Affiliation), Pranav Bagree (No Affiliation), Hongli Yin (No Affiliation), Karan Dwivedi (No Affiliation)

This report describes recent enhancements to Droid Intent Data Flow Analysis for Information Leakage (DidFail), the CERT static taint analyzer for sets of Android apps.
DOWNLOAD this report describes recent enhancements to droid intent data flow analysis for information leakage (didfail), the cert static taint analyzer for sets of android apps. Secure Coding,Secure Development 2017
The Hard Choices Game Explained

June 26, 2017 • White Paper

By Erin Lim, Philippe Kruchten, Nanette Brown, Ipek Ozkaya, Robert Nord

The Hard Choices game is a simulation of the software development cycle meant to communicate the concepts of uncertainty, risk, and technical debt.
DOWNLOAD the hard choices game is a simulation of the software development cycle meant to communicate the concepts of uncertainty, risk, and technical debt. Software Architecture,Technical Debt 2017
Federal Virtual Training Environment (FedVTE)

June 5, 2017 • White Paper

By Dominic A. Ross, April Galyardt, Marie Baker

The Federal Virtual Training Environment (FedVTE) is an online, on‐demand training system containing cybersecurity and certification prep courses, at no cost to federal, state, and local government employees.
DOWNLOAD the federal virtual training environment (fedvte) is an online, on‐demand training system containing cybersecurity and certification prep courses, at no cost to federal, state, and local government employees. 2017
Blacklist Ecosystem Analysis: July – December 2016

June 1, 2017 • White Paper

By Leigh B. Metcalf, Eric Hatleback

This report provides a summary of various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data in this …
DOWNLOAD this report provides a summary of various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from july 1 through december 31, 2016. 2017
Guide to Software Architecture Tools

May 22, 2017 • White Paper

By Software Engineering Institute

This document discusses tools and methods for analyzing the architecture, establishing requirements, evaluating the architecture, and defining the architecture.
DOWNLOAD this document discusses tools and methods for analyzing the architecture, establishing requirements, evaluating the architecture, and defining the architecture. 2017
System-of-Systems Software Architecture Evaluation

May 15, 2017 • White Paper

By Software Engineering Institute

The SoS Architecture Evaluation Method provides an initial identification of SoS architectural risks and quality attribute inconsistencies across the constituent systems.
DOWNLOAD the sos architecture evaluation method provides an initial identification of sos architectural risks and quality attribute inconsistencies across the constituent systems. Artificial Intelligence Engineering 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award

May 15, 2017 • White Paper

By Software Engineering Institute

IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award
DOWNLOAD ieee computer society/software engineering institute watts s. humphrey software process achievement award Process Improvement 2017
SEI-Certified PSP Developer Examination: Sample Questions

May 15, 2017 • White Paper

By Software Engineering Institute

This page contains sample questions similar to those found on the PSP Developer examination.
DOWNLOAD this page contains sample questions similar to those found on the psp developer examination. 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award 2016: Raytheon Integrated Defense Systems

April 28, 2017 • Technical Report

By Peter Kraus (Raytheon), Brian Foley (Raytheon), Kurt Mittelstaedt (Raytheon), Neal Mackertich (Raytheon), Dan Bardsley (Raytheon), Kelli Grimes (Raytheon), Mike Nolan (Raytheon)

The Raytheon Integrated Defense Systems DFSS team has been recognized with the 2016 Watts Humphrey Software Process Achievement Award.
DOWNLOAD the raytheon integrated defense systems dfss team has been recognized with the 2016 watts humphrey software process achievement award. Process Improvement,Best Practices 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement (SPA) Award 2016: Nationwide

April 13, 2017 • Technical Report

By Will J.M. Pohlman (Nationwide IT)

This report describes the 10-year history of Nationwide's software process improvement journey. Nationwide received the 2016 Watts Humphrey Software Process Achievement Award from the SEI and IEEE.
DOWNLOAD this report describes the 10-year history of nationwide's software process improvement journey. nationwide received the 2016 watts humphrey software process achievement award from the sei and ieee. Process Improvement 2017
Prototype Software Assurance Framework (SAF): Introduction and Overview

April 6, 2017 • Technical Note

By Christopher J. Alberts, Carol Woody

In this report, the authors discuss the Software Assurance Framework (SAF), a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain.
DOWNLOAD in this report, the authors discuss the software assurance framework (saf), a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain. Cybersecurity Engineering 2017
15 Tips for Preparing and Delivering a Great Presentation at SATURN

March 14, 2017 • White Paper

By Software Engineering Institute

You submitted a proposal to SATURN, and it got accepted. Congratulations! Here are 15 tips for creating and giving a great presentation at SATURN.
DOWNLOAD you submitted a proposal to saturn, and it got accepted. congratulations! here are 15 tips for creating and giving a great presentation at saturn. SATURN 2017
The CISO Academy

February 23, 2017 • White Paper

By Pamela D. Curtis, David Ulicne, David Tobar, Summer C. Fowler

In this paper, the authors describe the project that led to the creation of the U.S. Postal Service's CISO Academy.
DOWNLOAD in this paper, the authors describe the project that led to the creation of the u.s. postal service's ciso academy. Cyber Risk and Resilience Management,Cybersecurity 2017
Agile Acquisition and Milestone Reviews

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 4
DOWNLOAD acquisition & management concerns for agile use in government series - 4 Acquisition,Agile 2017
Management and Contracting Practices for Agile Programs

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 3
DOWNLOAD acquisition & management concerns for agile use in government series - 3 Acquisition,Agile 2017
Estimating in Agile Acquisition

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 5
DOWNLOAD acquisition & management concerns for agile use in government series - 5 Acquisition,Agile 2017
Agile Development and DoD Acquisitions

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 1
DOWNLOAD acquisition & management concerns for agile use in government series - 1 Acquisition,Agile 2017
Agile Culture in the DoD

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 2
DOWNLOAD acquisition & management concerns for agile use in government series - 2 Acquisition,Agile 2017
Adopting Agile in DoD IT Acquisitions

February 15, 2017 • White Paper

By Software Engineering Institute

Acquisition & Management Concerns for Agile Use in Government Series - 6
DOWNLOAD acquisition & management concerns for agile use in government series - 6 Acquisition,Agile 2017
Supply Chain and Commercial-off-the-Shelf (COTS) Assurance

January 24, 2017 • White Paper

By Software Engineering Institute

The Software Engineering Institute can help your organization apply techniques to reduce software supply chain risk.
DOWNLOAD the software engineering institute can help your organization apply techniques to reduce software supply chain risk. Cybersecurity Engineering,software engineering and information assurance 2017
COTS-Based Systems

January 24, 2017 • White Paper

By Software Engineering Institute

This paper presents a summary of SEI commercial off-the-shelf (COTS) software documents and COTS tools.
DOWNLOAD this paper presents a summary of sei commercial off-the-shelf (cots) software documents and cots tools. Acquisition 2017
Create a CSIRT

January 18, 2017 • White Paper

By Software Engineering Institute

This white paper discusses the issues and decisions organizations should address when planning, implementing, and building a CSIRT.
DOWNLOAD this white paper discusses the issues and decisions organizations should address when planning, implementing, and building a csirt. Cybersecurity 2017
Skills Needed When Staffing Your CSIRT

January 18, 2017 • White Paper

By Software Engineering Institute

This white paper describes a set of skills that CSIRT staff members should have to provide basic incident-handling services.
DOWNLOAD this white paper describes a set of skills that csirt staff members should have to provide basic incident-handling services. 2017
CSIRT Frequently Asked Questions (FAQ)

January 18, 2017 • White Paper

By Software Engineering Institute

This FAQ addresses CSIRTS, organizations responsible for receiving, reviewing, and responding to computer security incident reports and activity.
DOWNLOAD this faq addresses csirts, organizations responsible for receiving, reviewing, and responding to computer security incident reports and activity. Cybersecurity 2017
CERT-RMM Capability Appraisals

January 17, 2017 • White Paper

By Software Engineering Institute

The white paper describe CERT-RMM appraisals and the benefits they offer organizations.
DOWNLOAD the white paper describe cert-rmm appraisals and the benefits they offer organizations. Mission Assurance 2017
A Technical History of the SEI

January 6, 2017 • Special Report

By Larry Druffel

This report chronicles the technical accomplishments of the Software Engineering Institute and its impact on the Department of Defense software community, as well as on the broader software engineering community.
DOWNLOAD this report chronicles the technical accomplishments of the software engineering institute and its impact on the department of defense software community, as well as on the broader software engineering community. 2017
SQUARE Frequently Asked Questions (FAQ)

January 5, 2017 • White Paper

By Software Engineering Institute

This paper contains information about SQUARE, a process that helps organizations build security into the early stages of the software production lifecycle.
DOWNLOAD this paper contains information about square, a process that helps organizations build security into the early stages of the software production lifecycle. Cybersecurity Engineering,SQUARE 2017
Common Sense Guide to Mitigating Insider Threats, Fifth Edition

December 21, 2016 • Technical Report

By Tracy Cassidy, Andrew P. Moore, Michael J. Albrethsen, Daniel L. Costa, Jason W. Clark, Jeremy R. Strozer, Randall F. Trzeciak, Michael C. Theis, Matthew L. Collins

Presents recommendations for mitigating insider threat based on CERT's continued research and analysis of over 1,000 cases.
DOWNLOAD presents recommendations for mitigating insider threat based on cert's continued research and analysis of over 1,000 cases. Insider Threat 2016
Architecture-Led Safety Process

December 21, 2016 • Technical Report

By Peter H. Feiler, John McGregor, Julien Delange, David P. Gluch

Architecture-Led Safety Analysis (ALSA) is a safety analysis method that uses early architecture knowledge to supplement traditional safety analysis techniques to identify faults as early as possible.
DOWNLOAD architecture-led safety analysis (alsa) is a safety analysis method that uses early architecture knowledge to supplement traditional safety analysis techniques to identify faults as early as possible. Software Architecture 2016
The Critical Role of Positive Incentives for Reducing Insider Threats

December 15, 2016 • Technical Report

By Jennifer Cowley, Elizabeth A. Monaco, Jeff Savinda, Andrew P. Moore, Jamie L. Moyes, Denise M. Rousseau (Carnegie Mellon University), Samuel J. Perl, Allison Parshall, Daniel Bauer, Palma Buttles-Valdez, Nathan M. VanHoudnos, Tracy Cassidy, Matthew L. Collins

This report describes how positive incentives complement traditional practices to provide a better balance for organizations' insider threat programs.
DOWNLOAD this report describes how positive incentives complement traditional practices to provide a better balance for organizations' insider threat programs. Insider Threat 2016
Update 2016: Considerations for Using Agile in DoD Acquisition

December 14, 2016 • Technical Note

By Daniel Burton, Mary Ann Lapham, Alfred Schenker, Ray C. Williams, Charles (Bud) Hammons, Dan Ward (Dan Ward Consulting), Suzanne Miller

This report updates a 2010 technical note, addressing developments in commercial Agile practices as well as the Department of Defense (DoD) acquisition environment.
DOWNLOAD this report updates a 2010 technical note, addressing developments in commercial agile practices as well as the department of defense (dod) acquisition environment. Acquisition 2016
Scaling Agile Methods for Department of Defense Programs

December 13, 2016 • Technical Note

By Mary Ann Lapham, Peter Capell, Eileen Wrubel, Suzanne Miller, Will Hayes

This report discusses methods for scaling Agile processes to larger software development programs in the Department of Defense.
DOWNLOAD this report discusses methods for scaling agile processes to larger software development programs in the department of defense. Acquisition 2016
Low Cost Technical Solutions to Jump Start an Insider Threat Program

December 12, 2016 • Technical Note

By George Silowash, Derrick Spooner, Daniel L. Costa, Michael J. Albrethsen

This technical note explores free and low cost technical solutions to help organizations prevent, detect, and respond to malicious insiders.
DOWNLOAD this technical note explores free and low cost technical solutions to help organizations prevent, detect, and respond to malicious insiders. Insider Threat 2016
RFP Patterns and Techniques for Successful Agile Contracting

December 2, 2016 • Special Report

By Keith Korzec, John H. Norton III (Raytheon Integrated Defense Systems), Michael Ryan (BTAS), Greg Howard (MITRE), Peter Capell, Thomas E. Friend (Agile On Target), Steven Martin (Space and Missile Systems Center), Larri Ann Rosser (Raytheon Intelligence Information and Services), Mary Ann Lapham

This report discusses request-for-proposal patterns and techniques for successfully contracting a federal Agile project.
DOWNLOAD this report discusses request-for-proposal patterns and techniques for successfully contracting a federal agile project. Acquisition 2016
Ultra-Large-Scale Systems: Socio-adaptive Systems

December 1, 2016 • White Paper

By Gabriel Moreno, Lutz Wrage, Linda M. Northrop, Mark H. Klein, Scott Hissam

Ultra-large-scale systems are interdependent webs of software, people, policies, and economics. In socio-adaptive systems, humans and software interact as peers.
DOWNLOAD ultra-large-scale systems are interdependent webs of software, people, policies, and economics. in socio-adaptive systems, humans and software interact as peers. Artificial Intelligence Engineering,Ultra-Large-Scale Systems 2016
Cyber-Physical Systems

December 1, 2016 • White Paper

By David Kyle, Dionisio de Niz, Sagar Chaki, Jeffrey Hansen, Bjorn Andersson, Scott Hissam, John J. Hudak, Mark H. Klein, Gabriel Moreno

Cyber-physical systems (CPS) integrate computational algorithms and physical components. SEI promotes the efficient development of high-confidence, distributed CPS.
DOWNLOAD cyber-physical systems (cps) integrate computational algorithms and physical components. sei promotes the efficient development of high-confidence, distributed cps. Artificial Intelligence Engineering,Cyber-Physical Systems 2016
Pervasive Mobile Computing

December 1, 2016 • White Paper

By William Anderson, Jeff Boleng, Ben W. Bradshaw, James Edmondson, Grace Lewis, Edwin J. Morris, Marc Novakouski, James Root

Pervasive mobile computing focuses on how soldiers and first responders can use smartphones, tablets, and other mobile/wearable devices at the tactical edge.
DOWNLOAD pervasive mobile computing focuses on how soldiers and first responders can use smartphones, tablets, and other mobile/wearable devices at the tactical edge. Pervasive Mobile Computing 2016
Predictability by Construction

December 1, 2016 • White Paper

By Linda M. Northrop, Gabriel Moreno, Kurt C. Wallnau, Sagar Chaki, Scott Hissam

Predictability by construction (PBC) makes the behavior of a component-based system predictable before implementation, based on known properties of components.
DOWNLOAD predictability by construction (pbc) makes the behavior of a component-based system predictable before implementation, based on known properties of components. Process Improvement 2016
Blacklist Ecosystem Analysis: January – June, 2016

December 1, 2016 • White Paper

By Leigh B. Metcalf, Eric Hatleback

This short report provides a summary of the various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data …
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from january through june 2016. Situational Awareness 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Testing the Identified Metrics

November 30, 2016 • White Paper

By Bill Nichols, Charles Weinstock, Sarah Sheard, Michael D. Konrad

This report describes a test of an algorithm for estimating the complexity of a safety argument.
DOWNLOAD this report describes a test of an algorithm for estimating the complexity of a safety argument. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Estimating Complexity of a Safety Argument

November 30, 2016 • White Paper

By Charles Weinstock, Michael D. Konrad, Bill Nichols, Sarah Sheard

This report presents a formula for estimating the complexity of an avionics system and directly connects that complexity to the size of its safety argument.
DOWNLOAD this report presents a formula for estimating the complexity of an avionics system and directly connects that complexity to the size of its safety argument. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Identifying the Impact of Complexity on Safety

November 30, 2016 • White Paper

By Michael D. Konrad, Sarah Sheard, Charles Weinstock, Donald Firesmith

This report organizes our work on the impact of software complexity on aircraft safety by asking, “How can complexity complicate safety and, thus, certification?”
DOWNLOAD this report organizes our work on the impact of software complexity on aircraft safety by asking, “how can complexity complicate safety and, thus, certification?” Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Candidate Complexity Metrics

November 30, 2016 • White Paper

By Sarah Sheard, Bill Nichols

This special report identifies candidate measures of complexity for systems with embedded software that relate to safety, assurance, or both.
DOWNLOAD this special report identifies candidate measures of complexity for systems with embedded software that relate to safety, assurance, or both. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Literature Search to Define Complexity for Avionics Systems

November 30, 2016 • White Paper

By Sarah Sheard, Michael D. Konrad

This special report describes the results of a literature review sampling what is known about complexity for application in the context of safety and assurance.
DOWNLOAD this special report describes the results of a literature review sampling what is known about complexity for application in the context of safety and assurance. Measurement and Analysis 2016
Seven Proposal-Writing Tips That Make Conference Program Committees Smile

November 30, 2016 • White Paper

By Bill Pollak, Mike Petock

Writing a great session proposal for a conference is difficult. Here are seven tips for writing a session proposal that will make reviewers go from frown to smile.
DOWNLOAD writing a great session proposal for a conference is difficult. here are seven tips for writing a session proposal that will make reviewers go from frown to smile. SATURN 2016
Definition and Measurement of Complexity in the Context of Safety Assurance

October 27, 2016 • Technical Report

By Bill Nichols, Sarah Sheard, Michael D. Konrad, Charles Weinstock

This report describes research to define complexity measures for avionics systems to help the FAA identify when systems are too complex to assure their safety.
DOWNLOAD this report describes research to define complexity measures for avionics systems to help the faa identify when systems are too complex to assure their safety. Performance and Dependability 2016
Establishing Trusted Identities in Disconnected Edge Environments

October 27, 2016 • White Paper

By Dan J. Klinedinst, Sebastián Echeverría, Keegan M. Williams

he goal of this paper is to present a solution for establishing trusted identities in disconnected environments based on secure key generation and exchange in the field.
DOWNLOAD he goal of this paper is to present a solution for establishing trusted identities in disconnected environments based on secure key generation and exchange in the field. Cloud Computing,Edge Computing 2016
A Mapping of the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT) to the Cyber Resilience Review (CRR)

October 25, 2016 • Technical Note

By Robert A. Vrtis, Jeffrey Pinckard, Michael Rattigan

To help financial organizations assess cyber resilience, we map FFIEC Cybersecurity Assessment Tool (CAT) statements to Cyber Resilience Review (CRR) questions.
DOWNLOAD to help financial organizations assess cyber resilience, we map ffiec cybersecurity assessment tool (cat) statements to cyber resilience review (crr) questions. Cyber Risk and Resilience Management 2016
Managing Third Party Risk in Financial Services Organizations: A Resilience-Based Approach

September 27, 2016 • White Paper

By Charles M. Wallen, John Haller

A resilience-based approach can help financial services organizations to manage cybersecurity risks from outsourcing and comply with federal regulations.
DOWNLOAD a resilience-based approach can help financial services organizations to manage cybersecurity risks from outsourcing and comply with federal regulations. Cyber Risk and Resilience Management 2016
Agile Development in Government: Myths, Monsters, and Fables

September 21, 2016 • White Paper

By Suzanne Miller, Mary Ann Lapham, David J. Carney

This volume is a reflection on attitudes toward Agile software development now current in the government workplace.
DOWNLOAD this volume is a reflection on attitudes toward agile software development now current in the government workplace. Acquisition,Agile 2016
Striving for Effective Cyber Workforce Development

September 12, 2016 • White Paper

By Marie Baker

This paper reviews the issue of cyber awareness and identify efforts to combat this deficiency and concludes with strategies moving forward.
DOWNLOAD this paper reviews the issue of cyber awareness and identify efforts to combat this deficiency and concludes with strategies moving forward. Cyber Workforce Development 2016
Segment-Fixed Priority Scheduling for Self-Suspending Real-Time Tasks

August 18, 2016 • Technical Report

By Geoffrey Nelissen, Junsung Kim, Dionisio de Niz, Ragunathan (Raj) Rajkumar, Jian-Jia Chen, Bjorn Andersson, Wen-Hung Huang

This report describes schedulability analyses and proposes segment-fixed priority scheduling for self-suspending tasks.
DOWNLOAD this report describes schedulability analyses and proposes segment-fixed priority scheduling for self-suspending tasks. Cyber-Physical Systems,Performance and Dependability 2016
Creating Centralized Reporting for Microsoft Host Protection Technologies: The Enhanced Mitigation Experience Toolkit (EMET)

August 18, 2016 • Technical Note

By Craig Lewis, Joseph Tammariello

This report describes how to set up a centralized reporting console for the Windows Enhanced Mitigation Experience Toolkit.
DOWNLOAD this report describes how to set up a centralized reporting console for the windows enhanced mitigation experience toolkit. 2016
The QUELCE Method: Using Change Drivers to Estimate Program Costs

August 17, 2016 • Technical Note

By Sarah Sheard

This technical note introduces Quantifying Uncertainty in Early Lifecycle Cost Estimation (QUELCE), a method for estimating program costs early in development.
DOWNLOAD this technical note introduces quantifying uncertainty in early lifecycle cost estimation (quelce), a method for estimating program costs early in development. Measurement and Analysis 2016
Blacklist Ecosystem Analysis: 2016 Update

August 15, 2016 • White Paper

By Leigh B. Metcalf, Eric Hatleback, Jonathan Spring

This white paper, which is the latest in a series of regular updates, builds upon the analysis of blacklists presented in our 2013 and 2014 reports.
DOWNLOAD this white paper, which is the latest in a series of regular updates, builds upon the analysis of blacklists presented in our 2013 and 2014 reports. Situational Awareness 2016
Architecture Fault Modeling and Analysis with the Error Model Annex, Version 2

June 22, 2016 • Technical Report

By Julien Delange, Peter H. Feiler, John J. Hudak, David P. Gluch

This report describes the Error Model Annex, Version 2 (EMV2), notation for architecture fault modeling, which supports safety, reliability, and security analyses.
DOWNLOAD this report describes the error model annex, version 2 (emv2), notation for architecture fault modeling, which supports safety, reliability, and security analyses. Software Architecture 2016
A Requirement Specification Language for AADL

June 22, 2016 • Technical Report

By Lutz Wrage, Julien Delange, Peter H. Feiler

This report describes a textual requirement specification language, called ReqSpec, for the Architecture Analysis & Design Language (AADL) and demonstrates its use.
DOWNLOAD this report describes a textual requirement specification language, called reqspec, for the architecture analysis & design language (aadl) and demonstrates its use. Software Architecture 2016
DMPL: Programming and Verifying Distributed Mixed-Synchrony and Mixed-Critical Software

June 21, 2016 • Technical Report

By David Kyle, Sagar Chaki

DMPL is a language for programming distributed real-time, mixed-criticality software. It supports distributed systems in which each node executes a set of periodic real-time threads that are scheduled by priority …
DOWNLOAD dmpl is a language for programming distributed real-time, mixed-criticality software. it supports distributed systems in which each node executes a set of periodic real-time threads that are scheduled by priority and criticality. Cyber-Physical Systems 2016
Wireless Emergency Alerts Commercial Mobile Service Provider (CMSP) Cybersecurity Guidelines

June 9, 2016 • Special Report

By Audrey J. Dorofee, Carol Woody, Christopher J. Alberts

This report provides members of the Commercial Mobile Service Provider (CMSP) community with practical guidance for better managing cybersecurity risk exposure, based on an SEI study of the CMSP element …
DOWNLOAD this report provides members of the commercial mobile service provider (cmsp) community with practical guidance for better managing cybersecurity risk exposure, based on an sei study of the cmsp element of the wireless emergency alert pipeline. Pervasive Mobile Computing,Wireless Emergency Alerts 2016
Report Writer and Security Requirements Finder: User and Admin Manuals

June 7, 2016 • Special Report

By Walid El Baroni (Carnegie Mellon University), Gupta Anurag (Carnegie Mellon), Nancy R. Mead, Priyam Swati (Carnegie Mellon University), Yaobin Wen (Carnegie Mellon University), Anand Sankalp (Carnegie Mellon University)

This report presents instructions for using the Malware-driven Overlooked Requirements (MORE) website applications.
DOWNLOAD this report presents instructions for using the malware-driven overlooked requirements (more) website applications. Software Assurance,Reverse Engineering for Malware Analysis 2016
Applying the Goal-Question-Indicator-Metric (GQIM) Method to Perform Military Situational Analysis

May 23, 2016 • Technical Note

By Douglas Gray

This report describes how to use the goal-question-indicator-metric method in tandem with the military METT-TC method (mission, enemy, time, terrain, troops available, and civil-military considerations).
DOWNLOAD this report describes how to use the goal-question-indicator-metric method in tandem with the military mett-tc method (mission, enemy, time, terrain, troops available, and civil-military considerations). Cyber Risk and Resilience Management 2016
An Insider Threat Indicator Ontology

May 10, 2016 • Technical Report

By George Silowash, Samuel J. Perl, Derrick Spooner, Matthew L. Collins, Daniel L. Costa, Michael J. Albrethsen

This report presents an ontology for insider threat indicators, describes how the ontology was developed, and outlines the process by which it was validated.
DOWNLOAD this report presents an ontology for insider threat indicators, describes how the ontology was developed, and outlines the process by which it was validated. Insider Threat 2016
Using Honeynets and the Diamond Model for ICS Threat Analysis

May 6, 2016 • Technical Report

By John Kotheimer, Deana Shick, Kyle O'Meara

This report presents an approach to analyzing approximately 16 gigabytes of full packet capture data collected from an industrial control system honeynet—a network of seemingly vulnerable machines designed to lure …
DOWNLOAD this report presents an approach to analyzing approximately 16 gigabytes of full packet capture data collected from an industrial control system honeynet—a network of seemingly vulnerable machines designed to lure attackers. Security Vulnerabilities,Critical Infrastructure Protection,Enterprise Risk and Resilience Management 2016
2016 State of Cybercrime Survey

May 2, 2016 • White Paper

By Software Engineering Institute

This paper examines the current state of cybercrime and explores how organizations and individuals respond to cybercrime threats.
DOWNLOAD this paper examines the current state of cybercrime and explores how organizations and individuals respond to cybercrime threats. Insider Threat,Critical Infrastructure Protection,Cybersecurity 2016
The QUELCE Method: Using Change Drivers to Estimate Program Costs

April 19, 2016 • White Paper

By Sarah Sheard

This report introduces the Quantifying Uncertainty in Early Lifecycle Cost Estimation (QUELCE) method for estimating program costs early in a development lifecycle.
DOWNLOAD this report introduces the quantifying uncertainty in early lifecycle cost estimation (quelce) method for estimating program costs early in a development lifecycle. Measurement and Analysis 2016
A Unique Approach to Threat Analysis Mapping: A Malware-Centric Methodology

April 19, 2016 • Technical Report

By Kyle O'Meara, Deana Shick

As they constantly change network infrastructure, adversaries consistently use and update their tools. This report presents a way for researchers to begin threat analysis with those tools rather than with …
DOWNLOAD as they constantly change network infrastructure, adversaries consistently use and update their tools. this report presents a way for researchers to begin threat analysis with those tools rather than with network or incident data alone. Insider Threat 2016
On Board Diagnostics: Risks and Vulnerabilities of the Connected Vehicle

April 13, 2016 • White Paper

By Dan J. Klinedinst, Christopher King

This report describes cybersecurity risks and vulnerabilities in modern connected vehicles.
DOWNLOAD this report describes cybersecurity risks and vulnerabilities in modern connected vehicles. Security Vulnerabilities 2016
2016 Emerging Technology Domains Risk Survey

April 8, 2016 • Technical Report

By Todd Lewellen, Christopher King, Garret Wassermann, Dan J. Klinedinst

This 2016 report provides a snapshot of our current understanding of future technologies.
DOWNLOAD this 2016 report provides a snapshot of our current understanding of future technologies. Pervasive Mobile Computing,Cloud Computing 2016
Malware Capability Development Patterns Respond to Defenses: Two Case Studies

March 7, 2016 • White Paper

By Jonathan Spring, Deana Shick, Ed Stoner, Kyle O'Meara

In this paper, the authors describe their analysis of two case studies to outline the relationship between adversaries and network defenders.
DOWNLOAD in this paper, the authors describe their analysis of two case studies to outline the relationship between adversaries and network defenders. Reverse Engineering for Malware Analysis 2016
Cyber-Foraging for Improving Survivability of Mobile Systems

February 18, 2016 • Technical Report

By James Root, Ben W. Bradshaw, Sebastián Echeverría, Grace Lewis

This report presents an architecture and experimental results that demonstrate that cyber-foraging using tactical cloudlets increases the survivability of mobile systems.
DOWNLOAD this report presents an architecture and experimental results that demonstrate that cyber-foraging using tactical cloudlets increases the survivability of mobile systems. Pervasive Mobile Computing,Cloud Computing 2016
CERT-RMM Version 1.2 Release Notes

February 14, 2016 • White Paper

By Software Engineering Institute

This document contains the release notes for CERT-RMM Version 1.2, released February 2014.
DOWNLOAD this document contains the release notes for cert-rmm version 1.2, released february 2014. Cyber Risk and Resilience Management 2016
DoD Software Factbook

December 31, 2015 • White Paper

By James McCurley, David Zubrow, Brad Clark

This DoD Factbook is an initial analysis of software engineering data from the perspective of policy and management questions about software projects.
DOWNLOAD this dod factbook is an initial analysis of software engineering data from the perspective of policy and management questions about software projects. Acquisition,Best Practices,Measurement and Analysis 2015
Architecture-Led Safety Analysis of the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By Peter H. Feiler

This report summarizes an architecture-led safety analysis of the aircraft-survivability situation-awareness system for the Joint Multi-Role vertical lift program.
DOWNLOAD this report summarizes an architecture-led safety analysis of the aircraft-survivability situation-awareness system for the joint multi-role vertical lift program. Software Architecture 2015
Requirements and Architecture Specification of the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By Peter H. Feiler

This report describes a method for capturing information from requirements documents in AADL and the draft Requirement Definition & Analysis Language Annex.
DOWNLOAD this report describes a method for capturing information from requirements documents in aadl and the draft requirement definition & analysis language annex. Software Architecture 2015
Potential System Integration Issues in the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By John J. Hudak, Peter H. Feiler

This report describes a method for capturing information from requirements documents in AADL to identify potential integration problems early in system development.
DOWNLOAD this report describes a method for capturing information from requirements documents in aadl to identify potential integration problems early in system development. Software Architecture 2015
Extending AADL for Security Design Assurance of Cyber-Physical Systems

December 16, 2015 • Technical Report

By Rick Kazman, Carol Woody, Robert J. Ellison, Allen D. Householder, John J. Hudak

This report demonstrates the viability and limitations of using the Architecture Analysis and Design Language (AADL) through an extended example that allows for specifying and analyzing the security properties of …
DOWNLOAD this report demonstrates the viability and limitations of using the architecture analysis and design language (aadl) through an extended example that allows for specifying and analyzing the security properties of an automotive electronics system. Cyber-Physical Systems 2015
Cybersecurity Considerations for Vehicles

December 10, 2015 • White Paper

By Jens Palluch (Method Park), Mark Sherman

In this paper the authors discuss the number of ECUs and software in modern vehicles and the need for cybersecurity to include vehicles.
DOWNLOAD in this paper the authors discuss the number of ecus and software in modern vehicles and the need for cybersecurity to include vehicles. Cybersecurity Engineering 2015
Analytic Approaches to Detect Insider Threats

December 9, 2015 • White Paper

By Software Engineering Institute

This paper identifies steps that organizations can use to enhance their security posture to detect potential insider threats.
DOWNLOAD this paper identifies steps that organizations can use to enhance their security posture to detect potential insider threats. Insider Threat 2015
Intelligence Preparation for Operational Resilience (IPOR)

December 7, 2015 • Special Report

By Douglas Gray

The author describes Intelligence Preparation for Operational Resilience (IPOR), a framework for preparing intelligence that complements commonly used intelligence frameworks such as Intelligence Preparation of the Battlefield (IPB).
DOWNLOAD the author describes intelligence preparation for operational resilience (ipor), a framework for preparing intelligence that complements commonly used intelligence frameworks such as intelligence preparation of the battlefield (ipb). Cyber Risk and Resilience Management 2015
Evaluating and Mitigating the Impact of Complexity in Software Models

December 3, 2015 • Technical Report

By Bill Nichols, Min-Young Nam, Julien Delange, Jim McHale, John J. Hudak

This report defines software complexity, metrics for complexity, and the effects of complexity on cost and presents an analysis tool to measure complexity in models.
DOWNLOAD this report defines software complexity, metrics for complexity, and the effects of complexity on cost and presents an analysis tool to measure complexity in models. Software Architecture 2015
Cyber + Culture Early Warning Study

November 30, 2015 • Special Report

By Char Sample

This study was designed to profile cyber actors, and to examine the time interval between cyber and kinetic events in order to gain greater insights into nation-state cyber responses to …
DOWNLOAD this study was designed to profile cyber actors, and to examine the time interval between cyber and kinetic events in order to gain greater insights into nation-state cyber responses to kinetic events. CERT/CC 2015
Effective Insider Threat Programs: Understanding and Avoiding Potential Pitfalls

October 16, 2015 • White Paper

By William E. Novak, Matthew L. Collins, Michael C. Theis, Randall F. Trzeciak, Andrew P. Moore

In this paper, the authors describe the potential ways an insider threat program (InTP) could go wrong and engage the community to discuss its concerns.
DOWNLOAD in this paper, the authors describe the potential ways an insider threat program (intp) could go wrong and engage the community to discuss its concerns. Insider Threat 2015
Structuring the Chief Information Security Officer Organization

October 6, 2015 • Technical Note

By David Tobar, Brendan Fitzpatrick, Gregory Crabb (United States Postal Service), Julia H. Allen, Pamela D. Curtis, Nader Mehravari

The authors describe how they defined a CISO team structure and functions for a national organization using sources such as CISOs, policies, and lessons learned from cybersecurity incidents.
DOWNLOAD the authors describe how they defined a ciso team structure and functions for a national organization using sources such as cisos, policies, and lessons learned from cybersecurity incidents. Cyber Risk and Resilience Management 2015
Improving Federal Cybersecurity Governance Through Data-Driven Decision Making and Execution

September 16, 2015 • Technical Report

By Julia H. Allen, C. Aaron Cois, Anne Connell, Erik Ebel (Veris Group), William Gulley (Veris Group), Michael Riley (Veris Group), Robert W. Stoddard, Marie Vaughn (Veris Group), Douglas Gray, Brian D. Wisniewski

This technical report focuses on cybersecurity at the indirect, strategic level. It discusses how cybersecurity decision makers at the tactical or implementation level can establish a supportive contextual environment to …
DOWNLOAD this technical report focuses on cybersecurity at the indirect, strategic level. it discusses how cybersecurity decision makers at the tactical or implementation level can establish a supportive contextual environment to help enable their success. Cybersecurity Engineering,Governance 2015
Secure Coding Analysis of an AADL Code Generator's Runtime System

September 12, 2015 • White Paper

By David Keaton

This paper describes a secure coding analysis of the PolyORB-HI-C runtime system used by C language code output from the Ocarina AADL code generator.
DOWNLOAD this paper describes a secure coding analysis of the polyorb-hi-c runtime system used by c language code output from the ocarina aadl code generator. Cybersecurity Engineering 2015
Contracting for Agile Software Development in the Department of Defense: An Introduction

August 18, 2015 • Technical Note

By Jon Gross, Eileen Wrubel

This technical note addresses effective contracting for Agile software development and offers a primer on Agile based on a contracting officer's goals.
DOWNLOAD this technical note addresses effective contracting for agile software development and offers a primer on agile based on a contracting officer's goals. Acquisition,Agile 2015
CND Equities Strategy

July 22, 2015 • White Paper

By Ed Stoner, Jonathan Spring

In this paper, the authors discuss strategies for successful computer network defense (CND) based on considering the adversaries' responses.
DOWNLOAD in this paper, the authors discuss strategies for successful computer network defense (cnd) based on considering the adversaries' responses. Security Vulnerabilities,CERT/CC,Situational Awareness 2015
Comments on Bureau of Industry and Security (BIS) Proposed Rule Regarding Wassenaar Arrangement 2013 Plenary Agreements Implementation for Intrusion and Surveillance Items

July 22, 2015 • White Paper

By Art Manion, Allen D. Householder

In this paper, CERT researchers comment on the proposed rule, Wassenaar Arrangement 2013 Plenary Agreements Implementation: Intrusion and Surveillance Items.
DOWNLOAD in this paper, cert researchers comment on the proposed rule, wassenaar arrangement 2013 plenary agreements implementation: intrusion and surveillance items. Security Vulnerabilities 2015
Enabling Incremental Iterative Development at Scale: Quality Attribute Refinement and Allocation in Practice

June 4, 2015 • Technical Report

By Neil Ernst, Stephany Bellomo, Robert Nord, Ipek Ozkaya

This report describes industry practices used to develop business capabilities and suggests approaches to enable large-scale iterative development, or agile at scale.
DOWNLOAD this report describes industry practices used to develop business capabilities and suggests approaches to enable large-scale iterative development, or agile at scale. Software Architecture 2015
State of Practice Report: Essential Technical and Nontechnical Issues Related to Designing SoS Platform Architectures

May 13, 2015 • Technical Report

By Sholom G. Cohen, John Klein

This report analyzes the state of the practice in system-of-systems (SoS) development, based on 12 interviews of leading SoS developers in the DoD and industry.
DOWNLOAD this report analyzes the state of the practice in system-of-systems (sos) development, based on 12 interviews of leading sos developers in the dod and industry. System of Systems,Software Architecture 2015
Emerging Technology Domains Risk Survey

April 30, 2015 • Technical Note

By Jonathan Chu, Andrew O. Mellinger, Christopher King

This report provides a snapshot in time of our current understanding of future technologies.
DOWNLOAD this report provides a snapshot in time of our current understanding of future technologies. Cloud Computing,Pervasive Mobile Computing 2015
SCALe Analysis of JasPer Codebase

April 1, 2015 • White Paper

By David Svoboda

In this paper, David Svoboda provides the findings of a SCALe audit on a codebase.
DOWNLOAD in this paper, david svoboda provides the findings of a scale audit on a codebase. Secure Development,Secure Coding 2015
Model-Driven Engineering: Automatic Code Generation and Beyond

March 25, 2015 • Technical Note

By John Klein, Jay Marchetti, Harry L. Levinson

This report offers guidance on selecting, analyzing, and evaluating model-driven engineering tools for automatic code generation in acquired systems.
DOWNLOAD this report offers guidance on selecting, analyzing, and evaluating model-driven engineering tools for automatic code generation in acquired systems. Software Architecture,Acquisition 2015
Defining a Maturity Scale for Governing Operational Resilience

March 19, 2015 • Technical Note

By Julia H. Allen, Katie C. Stewart, Audrey J. Dorofee, Lisa R. Young, Michelle A. Valdez

Governing operational resilience requires the appropriate level of sponsorship, a commitment to strategic planning that includes resilience objectives, and proper oversight of operational resilience activities.
DOWNLOAD governing operational resilience requires the appropriate level of sponsorship, a commitment to strategic planning that includes resilience objectives, and proper oversight of operational resilience activities. Cyber Risk and Resilience Management 2015
SEI SPRUCE Project: Curating Recommended Practices for Software Producibility

March 16, 2015 • White Paper

By B. Craig Meyers, Mike Petock, Bill Pollak, Michael D. Konrad, Gerald W. Miller, Tamara Marshall-Keim

This paper describes the Systems and Software Producibility Collaboration Environment (SPRUCE) project and the resulting recommended practices on five software topics.
DOWNLOAD this paper describes the systems and software producibility collaboration environment (spruce) project and the resulting recommended practices on five software topics. Software Architecture,Measurement and Analysis,Cyber Risk and Resilience Management 2015
Improving Quality Using Architecture Fault Analysis with Confidence Arguments

March 10, 2015 • Technical Report

By Neil Ernst, John B. Goodenough, Julien Delange, Charles Weinstock, Peter H. Feiler, Ari Z. Klein

The case study shows that by combining an analytical approach with confidence maps, we can present a structured argument that system requirements have been met and problems in the design …
DOWNLOAD the case study shows that by combining an analytical approach with confidence maps, we can present a structured argument that system requirements have been met and problems in the design have been addressed adequately. Software Architecture 2015
Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets

March 4, 2015 • Technical Report

By William Klieber, Jonathan Burket, Lori Flynn, Jonathan Lim, Wei Shen, William Snavely

In this report, the authors describe how the DidFail tool was enhanced to improve its effectiveness.
DOWNLOAD in this report, the authors describe how the didfail tool was enhanced to improve its effectiveness. Secure Coding,Secure Development 2015
Eliminative Argumentation: A Basis for Arguing Confidence in System Properties

February 25, 2015 • Technical Report

By Ari Z. Klein, John B. Goodenough, Charles Weinstock

This report defines the concept of eliminative argumentation and provides a basis for assessing how much confidence one should have in an assurance case argument.
DOWNLOAD this report defines the concept of eliminative argumentation and provides a basis for assessing how much confidence one should have in an assurance case argument. Software Architecture,Software Assurance 2015
A Proven Method for Meeting Export Control Objectives in Postal and Shipping Sectors

February 10, 2015 • Technical Note

By Nader Mehravari, Julia H. Allen, Pamela D. Curtis, Gregory Crabb (United States Postal Service)

This report describes how the CERT-RMM enabled the USPIS to implement an innovative approach for achieving complex international mail export control objectives.
DOWNLOAD this report describes how the cert-rmm enabled the uspis to implement an innovative approach for achieving complex international mail export control objectives. Cyber Risk and Resilience Management 2015
Measuring What Matters Workshop Report

February 9, 2015 • Technical Note

By Michelle A. Valdez, Katie C. Stewart, Lisa R. Young, Julia H. Allen

This report describes the inaugural Measuring What Matters Workshop conducted in November 2014, and the team's experiences in planning and executing the workshop and identifying improvements for future offerings.
DOWNLOAD this report describes the inaugural measuring what matters workshop conducted in november 2014, and the team's experiences in planning and executing the workshop and identifying improvements for future offerings. Enterprise Risk and Resilience Management,Cyber Risk and Resilience Management 2015
A Dynamic Model of Sustainment Investment

February 5, 2015 • Technical Report

By Mike Phillips, Sarah Sheard, Robert Ferguson, Andrew P. Moore

This paper describes a dynamic sustainment model that shows how budgeting, allocation of resources, mission performance, and strategic planning are interrelated and how they affect each other over time.
DOWNLOAD this paper describes a dynamic sustainment model that shows how budgeting, allocation of resources, mission performance, and strategic planning are interrelated and how they affect each other over time. Process Improvement,Measurement and Analysis 2015
Cybersecurity Assurance

January 15, 2015 • White Paper

By Software Engineering Institute

This paper describes the SEI research and solutions that help organizations gain justified confidence in their cybersecurity posture.
DOWNLOAD this paper describes the sei research and solutions that help organizations gain justified confidence in their cybersecurity posture. Cybersecurity Engineering,Cybersecurity 2015
Blacklist Ecosystem Analysis Update: 2014

January 7, 2015 • White Paper

By Leigh B. Metcalf, Jonathan Spring

This white paper compares the contents of 85 different Internet blacklists to discover patterns in shared entries.
DOWNLOAD this white paper compares the contents of 85 different internet blacklists to discover patterns in shared entries. Situational Awareness 2015
Predicting Software Assurance Using Quality and Reliability Measures

December 22, 2014 • Technical Note

By Carol Woody, Bill Nichols, Robert J. Ellison

In this report, the authors discuss how a combination of software development and quality techniques can improve software security.
DOWNLOAD in this report, the authors discuss how a combination of software development and quality techniques can improve software security. Cybersecurity Engineering,Software Assurance,Measurement and Analysis 2014
Regional Use of Social Networking Tools

December 17, 2014 • Technical Report

By Kate Meeuf

This paper explores the regional use of social networking services (SNSs) to determine if participation with a subset of SNSs can be applied to identify a user's country of origin.
DOWNLOAD this paper explores the regional use of social networking services (snss) to determine if participation with a subset of snss can be applied to identify a user's country of origin. Situational Awareness 2014
Domain Parking: Not as Malicious as Expected

December 10, 2014 • White Paper

By Jonathan Spring, Leigh B. Metcalf

In this paper we discuss scalable detection methods for domain names parking on reserved IP address space, and then using this data set, evaluate whether this behavior appears to be …
DOWNLOAD in this paper we discuss scalable detection methods for domain names parking on reserved ip address space, and then using this data set, evaluate whether this behavior appears to be indicative of malicious behavior. Cybersecurity Engineering 2014
Pattern-Based Design of Insider Threat Programs

December 9, 2014 • Technical Note

By Andrew P. Moore, David McIntire, Robin Ruefle, Dave Mundie, Matthew L. Collins

In this report, the authors describe a pattern-based approach to designing insider threat programs that could provide a better defense against insider threats.
DOWNLOAD in this report, the authors describe a pattern-based approach to designing insider threat programs that could provide a better defense against insider threats. Insider Threat 2014
Introduction to the Security Engineering Risk Analysis (SERA) Framework

December 4, 2014 • Technical Note

By Carol Woody, Christopher J. Alberts, Audrey J. Dorofee

This report introduces the SERA Framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle.
DOWNLOAD this report introduces the sera framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle. Cybersecurity Engineering 2014
Using Malware Analysis to Tailor SQUARE for Mobile Platforms

November 18, 2014 • Technical Note

By Gregory Paul Alice, Nancy R. Mead

This technical note explores the development of security requirements for the K-9 Mail application, an open source email client for the Android operating system.
DOWNLOAD this technical note explores the development of security requirements for the k-9 mail application, an open source email client for the android operating system. Cybersecurity Engineering,Reverse Engineering for Malware Analysis 2014
A Method for Aligning Acquisition Strategies and Software Architectures

October 29, 2014 • Technical Note

By Patrick R. Place, Cecilia Albert, Lisa Brownsword, David J. Carney

This report describes the third year of the SEI's research into aligning acquisition strategies and software architecture.
DOWNLOAD this report describes the third year of the sei's research into aligning acquisition strategies and software architecture. Acquisition 2014
Agile Methods in Air Force Sustainment: Status and Outlook

October 23, 2014 • Technical Note

By Michael S. Bandor, Stephen Beck, Eileen Wrubel, Mary Ann Lapham, Colleen Regan

This paper examines using Agile techniques in the software sustainment arena—specifically Air Force programs. The intended audience is the staff of DoD programs and related personnel who intend to use …
DOWNLOAD this paper examines using agile techniques in the software sustainment arena—specifically air force programs. the intended audience is the staff of dod programs and related personnel who intend to use agile methods during software sustainment. Acquisition,Agile 2014
Development of an Intellectual Property Strategy: Research Notes to Support Department of Defense Programs

October 14, 2014 • Special Report

By Charlene Gross

This report is intended to help program managers understand categories of intellectual property, various intellectual property challenges, and approaches to assessing the license rights that the program needs for long-term …
DOWNLOAD this report is intended to help program managers understand categories of intellectual property, various intellectual property challenges, and approaches to assessing the license rights that the program needs for long-term execution and sustainment. Acquisition 2014
AADL Fault Modeling and Analysis Within an ARP4761 Safety Assessment

October 10, 2014 • Technical Report

By Julien Delange, John J. Hudak, David P. Gluch, Peter H. Feiler

This report describes how the Architecture Analysis and Design Language (AADL) Error Model Annex supports the safety-assessment methods in SAE Standard ARP4761.
DOWNLOAD this report describes how the architecture analysis and design language (aadl) error model annex supports the safety-assessment methods in sae standard arp4761. Software Architecture 2014
CERT Resilience Management Model—Mail-Specific Process Areas: International Mail Transportation (Version 1.0)

September 18, 2014 • Technical Note

By Sam Lin, Nader Mehravari, Julia H. Allen, Gregory Crabb (United States Postal Service), Pamela D. Curtis, Dawn Wilkes

This report describes a new process area that ensures that international mail is transported according to Universal Postal Union standards.
DOWNLOAD this report describes a new process area that ensures that international mail is transported according to universal postal union standards. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
CERT Resilience Management Model—Mail-Specific Process Areas: Mail Revenue Assurance (Version 1.0)

September 18, 2014 • Technical Note

By Pamela D. Curtis, Gregory Crabb (United States Postal Service), Julia H. Allen, David W. White, Nader Mehravari

This report describes a new process area that ensures that the USPS is compensated for mail that is accepted, transported, and delivered.
DOWNLOAD this report describes a new process area that ensures that the usps is compensated for mail that is accepted, transported, and delivered. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
CERT Resilience Management Model—Mail-Specific Process Areas: Mail Induction (Version 1.0)

September 18, 2014 • Technical Note

By Nader Mehravari, Julia H. Allen, Pamela D. Curtis, Gregory Crabb (United States Postal Service), David W. White

This report describes a new process area that ensures that mail is inducted into the U.S. domestic mail stream according to USPS standards and requirements.
DOWNLOAD this report describes a new process area that ensures that mail is inducted into the u.s. domestic mail stream according to usps standards and requirements. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
Smart Collection and Storage Method for Network Traffic Data

September 15, 2014 • Technical Report

By Nathan Dell, Angela Horneman

This report discusses considerations and decisions to be made when designing a tiered network data storage solution.
DOWNLOAD this report discusses considerations and decisions to be made when designing a tiered network data storage solution. Situational Awareness 2014
A Systematic Approach for Assessing Workforce Readiness

August 18, 2014 • Technical Report

By Christopher J. Alberts, David McIntire

In this report, the authors present the Competency Lifecycle Roadmap and the readiness test development method, both used to maintain workforce readiness.
DOWNLOAD in this report, the authors present the competency lifecycle roadmap and the readiness test development method, both used to maintain workforce readiness. Incident Management 2014
Assuring Software Reliability

August 15, 2014 • Special Report

By Robert J. Ellison

This report describes ways to incorporate the analysis of the potential impact of software failures--regardless of their cause--into development and acquisition practices through the use of software assurance.
DOWNLOAD this report describes ways to incorporate the analysis of the potential impact of software failures--regardless of their cause--into development and acquisition practices through the use of software assurance. Acquisition 2014
Patterns and Practices for Future Architectures

August 15, 2014 • Technical Note

By Eric Werner, Scott McMillan, Jonathan Chu

This report discusses best practices and patterns that will make high-performance graph analytics on new and emerging architectures more accessible to users.
DOWNLOAD this report discusses best practices and patterns that will make high-performance graph analytics on new and emerging architectures more accessible to users. Ultra-Large-Scale Systems 2014
Abuse of Customer Premise Equipment and Recommended Actions

August 7, 2014 • White Paper

By Chris Hallenbeck, Jonathan Spring, Paul Vixie

In this paper, the authors provide recommendations for addressing problems related to poor management of Consumer Premise Equipment (CPE).
DOWNLOAD in this paper, the authors provide recommendations for addressing problems related to poor management of consumer premise equipment (cpe). Reverse Engineering for Malware Analysis,Security Vulnerabilities 2014
Performance of Compiler-Assisted Memory Safety Checking

July 31, 2014 • Technical Note

By Robert C. Seacord, David Keaton

This technical note describes the criteria for deploying a compiler-based memory safety checking tool and the performance that can be achieved with two such tools whose source code is freely …
DOWNLOAD this technical note describes the criteria for deploying a compiler-based memory safety checking tool and the performance that can be achieved with two such tools whose source code is freely available. Secure Coding,Secure Development 2014
Unintentional Insider Threats: A Review of Phishing and Malware Incidents by Economic Sector

July 18, 2014 • Technical Note

By CERT Insider Threat Team

This report analyzes unintentional insider threat cases of phishing and other social engineering attacks involving malware.
DOWNLOAD this report analyzes unintentional insider threat cases of phishing and other social engineering attacks involving malware. 2014
Evaluation of the Applicability of HTML5 for Mobile Applications in Resource-Constrained Edge Environments

July 2, 2014 • Technical Note

By Bryan Yan (Carnegie Mellon University – Institute for Software Research), Grace Lewis

This technical note presents an analysis of the feasibility of using HTML5 for developing mobile applications, for "edge" environments where resources and connectivity are uncertain, such as in battlefield or …
DOWNLOAD this technical note presents an analysis of the feasibility of using html5 for developing mobile applications, for "edge" environments where resources and connectivity are uncertain, such as in battlefield or natural disaster situations. Pervasive Mobile Computing,Edge Computing 2014
Agile Software Teams: How They Engage with Systems Engineering on DoD Acquisition Programs

July 1, 2014 • Technical Note

By Mary Ann Lapham, Timothy A. Chick, Eileen Wrubel, Suzanne Miller

This technical note addresses issues with Agile software teams engaging systems engineering functions in developing and acquiring software-reliant systems.
DOWNLOAD this technical note addresses issues with agile software teams engaging systems engineering functions in developing and acquiring software-reliant systems. Acquisition,Agile 2014
Improving the Automated Detection and Analysis of Secure Coding Violations

June 27, 2014 • Technical Note

By Robert C. Seacord, Daniel Plakosh, Robert W. Stoddard, David Svoboda, David Zubrow

This technical note describes the accuracy analysis of the Source Code Analysis Laboratory (SCALe) tools and the characteristics of flagged coding violations.
DOWNLOAD this technical note describes the accuracy analysis of the source code analysis laboratory (scale) tools and the characteristics of flagged coding violations. Secure Coding,Secure Development 2014
CERT® Resilience Management Model (CERT®-RMM) V1.1: NIST Special Publication Crosswalk Version 2

June 11, 2014 • Technical Note

By Kevin G. Partridge, Lisa R. Young, Mary Popeck

This update to Version 1 of this same title (CMU/SEI-2011-TN-028) maps CERT-RMM process areas to certain NIST 800-series special publications.
DOWNLOAD this update to version 1 of this same title (cmu/sei-2011-tn-028) maps cert-rmm process areas to certain nist 800-series special publications. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
The Business Case for Systems Engineering: Comparison of Defense Domain and Non-defense Projects

June 10, 2014 • Special Report

By Dennis Goldenson, Joseph P. Elm

This report analyzes differences in systems-engineering activities for defense and non-defense projects and finds differences in both deployment and effectiveness.
DOWNLOAD this report analyzes differences in systems-engineering activities for defense and non-defense projects and finds differences in both deployment and effectiveness. Measurement and Analysis 2014
Job Analysis Results for Malicious-Code Reverse Engineers: A Case Study

June 3, 2014 • Technical Report

By Jennifer Cowley

This report describes individual and team factors that enable, encumber, or halt the development of malicious-code reverse engineering expertise.
DOWNLOAD this report describes individual and team factors that enable, encumber, or halt the development of malicious-code reverse engineering expertise. Cyber Risk and Resilience Management,Reverse Engineering for Malware Analysis,Science of Cybersecurity,Enterprise Risk and Resilience Management,Cyber Workforce Development 2014
An Introduction to the Mission Risk Diagnostic for Incident Management Capabilities (MRD-IMC)

May 30, 2014 • Technical Note

By Audrey J. Dorofee, Mark Zajicek, Robin Ruefle, Christopher J. Alberts

The Mission Risk Diagnostic for Incident Management Capabilities revises the Incident Management Mission Diagnostic Method with updated and expanded drivers.
DOWNLOAD the mission risk diagnostic for incident management capabilities revises the incident management mission diagnostic method with updated and expanded drivers. Incident Management,Cybersecurity Engineering,Incident Handling,Enterprise Risk and Resilience Management 2014
A Taxonomy of Operational Cyber Security Risks Version 2

May 21, 2014 • Technical Note

By James J. Cebula, Lisa R. Young, Mary Popeck

This second version of the 2010 report presents a taxonomy of operational cyber security risks and harmonizes it with other risk and security activities.
DOWNLOAD this second version of the 2010 report presents a taxonomy of operational cyber security risks and harmonizes it with other risk and security activities. OCTAVE,Insider Threat,Cybersecurity Engineering,Cyber Risk and Resilience Management 2014
An Evaluation of A-SQUARE for COTS Acquisition

May 13, 2014 • Technical Note

By Sidhartha Mani, Nancy R. Mead

An evaluation of the effectiveness of Software Quality Requirements Engineering for Acquisition (A-SQUARE) in a project to select a COTS product for the advanced metering infrastructure of a smart grid.
DOWNLOAD an evaluation of the effectiveness of software quality requirements engineering for acquisition (a-square) in a project to select a cots product for the advanced metering infrastructure of a smart grid. SQUARE,Cybersecurity Engineering 2014
Investigating Advanced Persistent Threat 1 (APT1)

May 12, 2014 • Technical Report

By Angela Horneman, Deana Shick

This report analyzes unclassified data sets in an attempt to understand APT1's middle infrastructure.
DOWNLOAD this report analyzes unclassified data sets in an attempt to understand apt1's middle infrastructure. Measurement and Analysis 2014
Precise Static Analysis of Taint Flow for Android Application Sets

May 9, 2014 • White Paper

By Amar S. Bhosale (No Affiliation)

This thesis describes a static taint analysis for Android that combines the FlowDroid and Epicc analyses to track inter- and intra-component data flow.
DOWNLOAD this thesis describes a static taint analysis for android that combines the flowdroid and epicc analyses to track inter- and intra-component data flow. Secure Development,Secure Coding 2014
Data-Driven Software Assurance: A Research Study

May 9, 2014 • Technical Report

By Michael F. Orlando, Erin Harper, Andrew P. Moore, Julia L. Mullaney, Bill Nichols, Michael D. Konrad, Art Manion

In 2012, Software Engineering Institute (SEI) researchers began investigating vulnerabilities reported to the SEI's CERT Division. A research project was launched to investigate design-related vulnerabilities and quantify their effects.
DOWNLOAD in 2012, software engineering institute (sei) researchers began investigating vulnerabilities reported to the sei's cert division. a research project was launched to investigate design-related vulnerabilities and quantify their effects. Software Assurance,Performance and Dependability,Process Improvement,Measurement and Analysis 2014
ALTernatives to Signatures (ALTS)

April 30, 2014 • White Paper

By George Jones, John Stogoski

This paper presents the results of a study of non-signature-based approaches to detecting malicious activity in computer network traffic.
DOWNLOAD this paper presents the results of a study of non-signature-based approaches to detecting malicious activity in computer network traffic. Situational Awareness,CERT/CC 2014
Potential Use of Agile Methods in Selected DoD Acquisitions: Requirements Development and Management

April 29, 2014 • Technical Note

By David J. Carney, Kenneth Nidiffer, Suzanne Miller

This report explores issues that practitioners in the field who are actively adopting Agile methods have identified in our interviews about their experience in defining and managing requirements.
DOWNLOAD this report explores issues that practitioners in the field who are actively adopting agile methods have identified in our interviews about their experience in defining and managing requirements. Acquisition,Agile 2014
The Readiness & Fit Analysis: Is Your Organization Ready for Agile?

April 28, 2014 • White Paper

By Suzanne Miller

This paper summarizes the Readiness & Fit Analysis and describes its extension to support risk identification for organizations that are adopting agile methods.
DOWNLOAD this paper summarizes the readiness & fit analysis and describes its extension to support risk identification for organizations that are adopting agile methods. Acquisition,Agile 2014
International Implementation of Best Practices for Mitigating Insider Threat: Analyses for India and Germany

April 16, 2014 • Technical Report

By Tracy Cassidy, Lori Flynn, Carly L. Huth, Palma Buttles-Valdez, Michael C. Theis, Randall F. Trzeciak, Travis Wright (Carnegie Mellon University, Master of Science in Information Security Policy and Management Program), George Silowash

This report analyzes insider threat mitigation in India and Germany, using the new framework for international cybersecurity analysis described in the paper titled “Best Practices Against Insider Threats in All …
DOWNLOAD this report analyzes insider threat mitigation in india and germany, using the new framework for international cybersecurity analysis described in the paper titled “best practices against insider threats in all nations.” Insider Threat 2014
Wireless Emergency Alerts (WEA) Cybersecurity Risk Management Strategy for Alert Originators

March 31, 2014 • Special Report

By The WEA Project Team

In this report, the authors describe a cybersecurity risk management (CSRM) strategy that alert originators can use throughout WEA adoption, operations, and sustainment, as well as a set of governance …
DOWNLOAD in this report, the authors describe a cybersecurity risk management (csrm) strategy that alert originators can use throughout wea adoption, operations, and sustainment, as well as a set of governance activities for developing a plan to execute the csrm. Enterprise Risk and Resilience Management,Wireless Emergency Alerts,Cybersecurity Engineering 2014
Maximizing Trust in the Wireless Emergency Alerts (WEA) Service

February 28, 2014 • Special Report

By Robert J. Ellison, Carol Woody

This 2014 report presents recommendations for stakeholders of the Wireless Emergency Alerts (WEA) service that resulted from the development of two trust models, focusing on how to increase both alert …
DOWNLOAD this 2014 report presents recommendations for stakeholders of the wireless emergency alerts (wea) service that resulted from the development of two trust models, focusing on how to increase both alert originators' and the public's trust in wea. Measurement and Analysis,Wireless Emergency Alerts 2014
Wireless Emergency Alerts: Trust Model Simulations

February 26, 2014 • Special Report

By Robert W. Stoddard, Timothy Morrow, Joseph P. Elm

This report presents four types of simulations run on the public trust model and the alert originator trust model developed for the Wireless Emergency Alerts (WEA) service, focusing on how …
DOWNLOAD this report presents four types of simulations run on the public trust model and the alert originator trust model developed for the wireless emergency alerts (wea) service, focusing on how to increase both alert originators' and the public's trust in wea. Measurement and Analysis,Wireless Emergency Alerts 2014
Commercial Mobile Alert Service (CMAS) Alerting Pipeline Taxonomy

February 24, 2014 • Technical Report

By The WEA Project Team

This report presents the Commercial Mobile Alert Service (CMAS) Alerting Pipeline Taxonomy, a hierarchical classification that encompasses four elements of the alerting pipeline, to help stakeholders understand and reason about …
DOWNLOAD this report presents the commercial mobile alert service (cmas) alerting pipeline taxonomy, a hierarchical classification that encompasses four elements of the alerting pipeline, to help stakeholders understand and reason about required cmas operations. Software Architecture,Wireless Emergency Alerts 2014
Best Practices in Wireless Emergency Alerts

February 19, 2014 • Special Report

By

Software Engineering Institute

Technical Papers

Filter by

Counter AI: What Is It and What Can You Do About It?

August 27, 2024 • White Paper

By Nathan M. VanHoudnos, Shing-hon Lau, Carol J. Smith, Matt Churilla, Lauren McIlvenny, Greg Touhill

Lessons Learned in Coordinated Disclosure for Artificial Intelligence and Machine Learning Systems

August 20, 2024 • White Paper

By Matt Churilla, Jeff Havrilla, Vijay S. Sarvepalli, Andrew Kompanek, Lauren McIlvenny, Nathan M. VanHoudnos, Shing-hon Lau, Lena Pons, Allen D. Householder

On the Design, Development, and Testing of Modern APIs

July 30, 2024 • White Paper

By Alejandro Gomez, Alex Vesey

A Model Problem for Assurance Research: An Autonomous Humanitarian Mission Scenario

July 23, 2024 • Technical Note

By Anton Hristozov, John E. Robert, Mark H. Klein, Gabriel Moreno

Application Programming Interface (API) Vulnerabilities and Risks

June 24, 2024 • Special Report

By McKinley Sconiers-Hasan

Software Bill of Materials (SBOM) Considerations for Operational Test & Evaluation Activities

June 14, 2024 • White Paper

By Michael S. Bandor

Reachability of System Operation Modes in AADL

May 31, 2024 • Technical Report

By Lutz Wrage

Explainable Verification: Survey, Situations, and New Ideas

April 16, 2024 • White Paper

By Bjorn Andersson, Dionisio de Niz, Mark H. Klein

Zero Trust Industry Days 2024: Request for Information (RFI)

February 29, 2024 • White Paper

By The Software Engineering Institute

Zero Trust Industry Days 2024 Scenario: Secluded Semiconductors, Inc.

February 27, 2024 • White Paper

By Rhonda Brown

Considerations for Evaluating Large Language Models for Cybersecurity Tasks

February 20, 2024 • White Paper

By Girish Sastry (OpenAI), Samuel J. Perl, Joel Parish (OpenAI), Jeff Gennari, Shing-hon Lau

Navigating Capability-Based Planning: The Benefits, Challenges, and Implementation Essentials

February 7, 2024 • White Paper

By William Nichols, Anandi Hira

Encoding Verification Arguments to Analyze High-Level Design Certification Claims: Experiment Zero (E0)

January 18, 2024 • White Paper

The Measurement Challenges in Software Assurance and Supply Chain Risk Management

December 22, 2023 • White Paper

By Scott Hissam, Carol Woody, Nancy R. Mead

Report to the Congressional Defense Committees on National Defense Authorization Act (NDAA) for Fiscal Year 2022 Section 835 Independent Study on Technical Debt in Software-Intensive Systems

December 7, 2023 • Technical Report

By Brigid O'Hearn, Julie B. Cohen, Forrest Shull, Ipek Ozkaya

Assessing Opportunities for LLMs in Software Engineering and Acquisition

November 1, 2023 • White Paper

By James Ivers, Ipek Ozkaya, Julie B. Cohen, Shen Zhang, Stephany Bellomo

Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk (Expanded Set of Practices)

October 2, 2023 • Technical Note

By Christopher J. Alberts, Charles M. Wallen, Carol Woody, Michael S. Bandor

Simulating Realistic Human Activity Using Large Language Model Directives

October 2, 2023 • Technical Report

By Dustin D. Updyke, Sean Huff, Thomas G. Podnar

Why Your Software Cost Estimates Change Over Time and How DevSecOps Data Can Help Reduce Cost Risk

September 29, 2023 • White Paper

By Julie B. Cohen

A Retrospective in Engineering Large Language Models for National Security

September 29, 2023 • White Paper

By Angelique McDowell, Shannon Gallagher, Andrew O. Mellinger, Jasmine Ratchford, Nick Winski, Eric Heim, Nathan M. VanHoudnos, Hollen Barmer, Swati Rallapalli, William Nichols, Bryan Brown, Tyler Brooks

U.S. Leadership in Software Engineering and AI Engineering

August 25, 2023 • White Paper

By Anita Carleton, Forrest Shull, Douglas Schmidt (Vanderbilt University), Erin Harper, Ipek Ozkaya, John E. Robert

A Holistic View of Architecture Definition, Evolution, and Analysis

August 24, 2023 • Technical Report

By Sebastián Echeverría, James Ivers, Rick Kazman

Emerging Technologies: Seven Themes Changing the Future of Software in the DoD

August 24, 2023 • White Paper

By Shen Zhang, Michael Abad-Santos, Scott Hissam

Demonstrating the Practical Utility and Limitations of ChatGPT Through Case Studies

August 23, 2023 • White Paper

By Alejandro Gomez, Dominic A. Ross, Matthew Walsh, Clarence Worrell

Software Excellence Through the Agile High Velocity Development℠ Process

July 17, 2023 • Technical Report

By Stephen Shook (Ishpi Information Technologies, Inc.), Barti K. Perini (Ishpi Information Technologies, Inc.)

Coding the Future: Recommendations for Defense Software R&D

July 13, 2023 • White Paper

By Software Engineering Institute