Carnegie Mellon University, Software Engineering Insitute

Results per page

Assessing Opportunities for LLMs in Software Engineering and Acquisition

November 1, 2023 • White Paper

By Stephany Bellomo , Ipek Ozkaya , Julie B. Cohen , James Ivers , Shen Zhang

This white paper examines how decision makers, such as technical leads and program managers, can assess the fitness of large language models (LLMs) to address software engineering and acquisition needs.
DOWNLOAD this white paper examines how decision makers, such as technical leads and program managers, can assess the fitness of large language models (llms) to address software engineering and acquisition needs. Artificial Intelligence Engineering,Software Engineering Research and Development,Acquisition 2023
U.S. Leadership in Software Engineering & AI Engineering: Critical Needs & Priorities Workshop - Executive Summary

October 3, 2023 • White Paper

By Erin Harper , John E. Robert , Anita Carleton , Forrest Shull , Ipek Ozkaya , Douglas Schmidt (Vanderbilt University)

A joint SEI/NITRD workshop will advance U.S. national interests through software and AI engineering and accelerate progress across virtually all scientific domains.
DOWNLOAD a joint sei/nitrd workshop will advance u.s. national interests through software and ai engineering and accelerate progress across virtually all scientific domains. Software Engineering Research and Development 2023
Simulating Realistic Human Activity Using Large Language Model Directives

October 2, 2023 • Technical Report

By Dustin D. Updyke , Thomas G. Podnar , Sean Huff

The authors explore how activities generated from the GHOSTS Framework’s NPC client compare to activities produced by GHOSTS’ default behavior and LLMs.
DOWNLOAD the authors explore how activities generated from the ghosts framework’s npc client compare to activities produced by ghosts’ default behavior and llms. Cyber Workforce Development 2023
Why Your Software Cost Estimates Change Over Time and How DevSecOps Data Can Help Reduce Cost Risk

September 29, 2023 • White Paper

By Julie B. Cohen

Early software cost estimates are often off by over 40%; this paper discusses how programs must continually update estimates as more information becomes available.
DOWNLOAD early software cost estimates are often off by over 40%; this paper discusses how programs must continually update estimates as more information becomes available. Software Cost Estimates,DevSecOps 2023
A Retrospective in Engineering Large Language Models for National Security

September 29, 2023 • White Paper

By The Software Engineering Institute

This document discusses the findings, recommendations, and lessons learned from engineering a large language model for national security use cases.
DOWNLOAD this document discusses the findings, recommendations, and lessons learned from engineering a large language model for national security use cases. 2023
A Holistic View of Architecture Definition, Evolution, and Analysis

August 24, 2023 • Technical Report

By Sebastián Echeverría , James Ivers , Rick Kazman

This report focuses on performing architectural decisions and architectural analysis, spanning multiple quality attributes, in a sustainable and ongoing way.
DOWNLOAD this report focuses on performing architectural decisions and architectural analysis, spanning multiple quality attributes, in a sustainable and ongoing way. Software Architecture 2023
Emerging Technologies: Seven Themes Changing the Future of Software in the DoD

August 24, 2023 • White Paper

By Scott Hissam , Shen Zhang , Michael Abad-Santos

This report summarizes the SEI's Emerging Technologies Study (ETS) and identifies seven emerging technologies to watch in software engineering practices and technology.
DOWNLOAD this report summarizes the sei's emerging technologies study (ets) and identifies seven emerging technologies to watch in software engineering practices and technology. Advanced Computing,Artificial Intelligence Engineering,Cybersecurity Engineering,Quantum Computing 2023
Demonstrating the Practical Utility and Limitations of ChatGPT Through Case Studies

August 23, 2023 • White Paper

By Clarence Worrell , Alejandro Gomez , Dominic A. Ross , Matthew Walsh

In this study, SEI researchers conducted four case studies using GPT-3.5 to assess the practical utility of large language models such as ChatGPT.
DOWNLOAD in this study, sei researchers conducted four case studies using gpt-3.5 to assess the practical utility of large language models such as chatgpt. Artificial Intelligence Engineering 2023
Software Excellence Through the Agile High Velocity Development℠ Process

July 17, 2023 • Technical Report

By Barti K. Perini (Ishpi Information Technologies, Inc.) , Stephen Shook (Ishpi Information Technologies, Inc.)

The High Velocity Development℠ process earned Ishpi Information Technologies, Inc. the 2023 Watts Humphrey Software Quality Award.
DOWNLOAD the high velocity development℠ process earned ishpi information technologies, inc. the 2023 watts humphrey software quality award. Agile,Process Improvement 2023
Coding the Future: Recommendations for Defense Software R&D

July 13, 2023 • White Paper

By None

This report outlines the key recommendations from the November 2022 workshop "Software as a Modernization Priority."
DOWNLOAD this report outlines the key recommendations from the november 2022 workshop "software as a modernization priority." Acquisition,Governance,Mission Assurance,Manager,Executive,Researcher,Sponsor 2023
Engineering of Edge Software Systems: A Report from the November 2022 SEI Workshop on Software Systems at the Edge

June 30, 2023 • White Paper

By Ipek Ozkaya , Grace Lewis , Kevin A. Pitstick

Based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for engineering software systems at the edge.
DOWNLOAD based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for engineering software systems at the edge. Edge Computing 2023
Software Bill of Materials Framework: Leveraging SBOMs for Risk Reduction

June 14, 2023 • White Paper

By Carol Woody , Christopher J. Alberts , Charles M. Wallen , Michael S. Bandor

This paper is a Software Bill of Materials (SBOM) Framework that is a starting point for expanding the use of SBOMs for managing software and systems risk.
DOWNLOAD this paper is a software bill of materials (sbom) framework that is a starting point for expanding the use of sboms for managing software and systems risk. Cyber Risk and Resilience Management,Acquisition 2023
Generative AI: Key Opportunities and Research Challenges

June 9, 2023 • White Paper

By None

This 2023 workshop report identifies DoD use cases for generative AI and discusses meeting challenges and needs such as investing in guardrails and responsible AI amid a race to capability.
DOWNLOAD this 2023 workshop report identifies dod use cases for generative ai and discusses meeting challenges and needs such as investing in guardrails and responsible ai amid a race to capability. Artificial Intelligence Engineering 2023
Securing UEFI: An Underpinning Technology for Computing

May 30, 2023 • White Paper

By Vijay S. Sarvepalli

This paper highlights the technical efforts to secure the UEFI-based firmware that serves as a foundational piece of modern computing environments.
DOWNLOAD this paper highlights the technical efforts to secure the uefi-based firmware that serves as a foundational piece of modern computing environments. Security Vulnerabilities 2023
Using Model-Based Systems Engineering (MBSE) to Assure a DevSecOps Pipeline is Sufficiently Secure

May 23, 2023 • Technical Report

By Timothy A. Chick , Nataliya Shevchenko , Scott Pavetti

This report describes how analysts can use a model-based systems engineering (MBSE) approach to detect and mitigate cybersecurity risks to a DevSecOps pipeline.
DOWNLOAD this report describes how analysts can use a model-based systems engineering (mbse) approach to detect and mitigate cybersecurity risks to a devsecops pipeline. DevSecOps 2023
A Strategy for Component Product Lines: Report 2: Specification Modeling for Components in a Component Product Line

May 17, 2023 • Special Report

By Sholom G. Cohen , John McGregor , John J. Hudak

This report introduces the “model chain” concept for specifying a component product line and realizing architecture requirements through the creation–evolution process.
DOWNLOAD this report introduces the “model chain” concept for specifying a component product line and realizing architecture requirements through the creation–evolution process. 2023
A Strategy for Component Product Lines: Report 3: Component Product Line Governance

May 4, 2023 • Special Report

By Alfred Schenker , Sholom G. Cohen

This report provides guidance for the community involved with developing and sustaining product lines of components used by the U.S. government.
DOWNLOAD this report provides guidance for the community involved with developing and sustaining product lines of components used by the u.s. government. Governance 2023
Program Managers—The DevSecOps Pipeline Can Provide Actionable Data

April 24, 2023 • White Paper

By Julie B. Cohen , Bill Nichols

This paper describes the Automated Continuous Estimation for a Pipeline of Pipelines research project, which automates data collection to track program progress.
DOWNLOAD this paper describes the automated continuous estimation for a pipeline of pipelines research project, which automates data collection to track program progress. Acquisition,Measurement and Analysis,Agile,DevSecOps 2023
Zero Trust Industry Day 2022: Areas of Future Research

January 25, 2023 • White Paper

By Timothy Morrow , Matthew Nicolai , Trista Polaski

This paper describes the future research discussed at the 2022 Zero Trust Industry Day event.
DOWNLOAD this paper describes the future research discussed at the 2022 zero trust industry day event. Cyber Risk and Resilience Management 2023
Industry Best Practices for Zero Trust Architecture

December 13, 2022 • White Paper

By Matthew Nicolai , Timothy Morrow , Nathaniel Richmond

This paper describes best practices identified during the SEI’s Zero Trust Industry Day 2022, and provides ways to help organizations shift to zero trust.
DOWNLOAD this paper describes best practices identified during the sei’s zero trust industry day 2022, and provides ways to help organizations shift to zero trust. Cyber Risk and Resilience Management 2022
A Strategy for Component Product Lines: Report 1: Scoping, Objectives, and Rationale

December 8, 2022 • Special Report

By Alfred Schenker , John McGregor , Sholom G. Cohen , John J. Hudak , Gabriel Moreno

This report establishes a Component Product Line Strategy to address problems in systematically reusing and integrating components built to conform to component specification models.
DOWNLOAD this report establishes a component product line strategy to address problems in systematically reusing and integrating components built to conform to component specification models. Software Product Lines 2022
Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk

November 11, 2022 • Technical Note

By Charles M. Wallen , Michael S. Bandor , Christopher J. Alberts , Carol Woody

This report provides an overview of the Acquisition Security Framework (ASF), a description of the practices developed thus far, and a plan for completing the ASF body of work.
DOWNLOAD this report provides an overview of the acquisition security framework (asf), a description of the practices developed thus far, and a plan for completing the asf body of work. Cyber Risk and Resilience Management 2022
Zero Trust Industry Day Experience Paper

October 31, 2022 • White Paper

By Timothy Morrow , Rhonda Brown , Mary Popeck

This paper describes the results of the 2022 Zero Trust Industry Day event.
DOWNLOAD this paper describes the results of the 2022 zero trust industry day event. Cyber Risk and Resilience Management 2022
Challenge Development Guidelines for Cybersecurity Competitions

October 27, 2022 • Technical Report

By Josh Hammerstein , Matt Kaar , Jarrett Booz , Joseph Vessella , Leena Arora , Dennis M. Allen

This paper draws on the SEI’s experience to provide general-purpose guidelines and best practices for developing effective cybersecurity challenges.
DOWNLOAD this paper draws on the sei’s experience to provide general-purpose guidelines and best practices for developing effective cybersecurity challenges. Cyber Workforce Development 2022
Acquisition Security Framework (ASF): An Acquisition and Supplier Perspective on Managing Software-Intensive Systems’ Cybersecurity Risk

October 4, 2022 • White Paper

By Charles M. Wallen , Michael S. Bandor , Carol Woody , Christopher J. Alberts

The Acquisition Security Framework (ASF) contains practices that support programs acquiring/building a secure, resilient software-reliant system to manage risks.
DOWNLOAD the acquisition security framework (asf) contains practices that support programs acquiring/building a secure, resilient software-reliant system to manage risks. Cyber Risk and Resilience Management 2022
Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)

September 15, 2022 • Special Report

By Allen D. Householder

This report proposes a formal protocol specification for MPCVD to improve the interoperability of both CVD and MPCVD processes.
DOWNLOAD this report proposes a formal protocol specification for mpcvd to improve the interoperability of both cvd and mpcvd processes. Security Vulnerabilities,Cybersecurity 2022
Common Sense Guide to Mitigating Insider Threats, Seventh Edition

September 7, 2022 • White Paper

By None

The guide describes 22 best practices for mitigating insider threat based on the CERT Division's continued research and analysis of more than 3,000 insider threat cases.
DOWNLOAD the guide describes 22 best practices for mitigating insider threat based on the cert division's continued research and analysis of more than 3,000 insider threat cases. Insider Threat 2022
Coordinated Vulnerability Disclosure User Stories

August 25, 2022 • White Paper

By Allen D. Householder , Art Manion , Jonathan Spring , Timur D. Snoke , Vijay S. Sarvepalli , Laurie Tyzenhaus , Eric Hatleback , Brad Runyon , Charles G. Yarbrough

This paper provides user stories to guide the development of a technical protocol and application programming interface for Coordinated Vulnerability Disclosure.
DOWNLOAD this paper provides user stories to guide the development of a technical protocol and application programming interface for coordinated vulnerability disclosure. Cybersecurity Engineering 2022
LLVM Intermediate Representation for Code Weakness Identification

July 8, 2022 • White Paper

By Shannon Gallagher , William Klieber , David Svoboda

This paper examines whether intermediate representation used in Large Language Models can be useful to indicate the presence of software vulnerabilities.
DOWNLOAD this paper examines whether intermediate representation used in large language models can be useful to indicate the presence of software vulnerabilities. Artificial Intelligence Engineering 2022
Digital Engineering Effectiveness

May 19, 2022 • White Paper

By Bill Nichols , Alfred Schenker , Tyler Smith (Adventium Labs, Inc.)

This paper explores the reluctance of developers of cyber-physical systems to embrace digital engineering (DE), how DE methods should be tailored to achieve their stakeholders' goals, and how to measure …
DOWNLOAD this paper explores the reluctance of developers of cyber-physical systems to embrace digital engineering (de), how de methods should be tailored to achieve their stakeholders' goals, and how to measure the effectiveness of de-enabled workflows. Cyber-Physical Systems 2022
A Brief Introduction to the Evaluation of Learned Models for Aerial Object Detection

May 2, 2022 • White Paper

By Eric Heim

The SEI AI Division assembled guidance on the design, production, and evaluation of machine-learning models for aerial object detection.
DOWNLOAD the sei ai division assembled guidance on the design, production, and evaluation of machine-learning models for aerial object detection. Best Practices,Data Modeling and Analytics,Artificial Intelligence Engineering,Developer 2022
Guidance for Tailoring DoD Request for Proposals (RFPs) to Include Modeling

April 27, 2022 • Special Report

By Tom Merendino , Julie B. Cohen , Robert Wojcik

This report provides guidance for government program offices that are including digital engineering/modeling requirements into a request for proposal.
DOWNLOAD this report provides guidance for government program offices that are including digital engineering/modeling requirements into a request for proposal. Acquisition 2022
Modeling to Support DoD Acquisition Lifecycle Events (Version 1.4)

April 26, 2022 • White Paper

By Robert Wojcik , Julie B. Cohen , Tom Merendino

This document provides suggestions for producing requirement, system, and software models that will be used to support various DoD system acquisition lifecycle events.
DOWNLOAD this document provides suggestions for producing requirement, system, and software models that will be used to support various dod system acquisition lifecycle events. Acquisition 2022
Experiences with Deploying Mothra in Amazon Web Services (AWS)

April 26, 2022 • Technical Report

By John Stogoski , Daniel Ruef , Brad Powell

The authors describe development of an at-scale prototype of an on-premises system to test the performance of Mothra in the cloud and provide recommendations for similar deployments.
DOWNLOAD the authors describe development of an at-scale prototype of an on-premises system to test the performance of mothra in the cloud and provide recommendations for similar deployments. Cyber Risk and Resilience Management 2022
Extensibility

April 6, 2022 • Technical Report

By James Ivers , Sebastián Echeverría , Rick Kazman

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for extensibility.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for extensibility. Software Architecture 2022
TwinOps: Digital Twins Meets DevOps

March 24, 2022 • Technical Report

By Joe Yankel , Jerome Hugues , Anton Hristozov , John J. Hudak

This report describes ModDevOps, an approach that bridges model-based engineering and software engineering using DevOps concepts and code generation from models, and TwinOps, a specific ModDevOps pipeline.
DOWNLOAD this report describes moddevops, an approach that bridges model-based engineering and software engineering using devops concepts and code generation from models, and twinops, a specific moddevops pipeline. Cyber-Physical Systems 2022
Robustness

March 16, 2022 • Technical Report

By James Ivers , Philip Bianco , Sebastián Echeverría , Rick Kazman

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for robustness.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for robustness. Software Architecture 2022
An Analysis of How Many Undiscovered Vulnerabilities Remain in Information Systems

March 9, 2022 • White Paper

By Jonathan Spring

This paper examines the paradigm that the number of undiscovered vulnerabilities is manageably small through the lens of mathematical concepts from the theory of computing.
DOWNLOAD this paper examines the paradigm that the number of undiscovered vulnerabilities is manageably small through the lens of mathematical concepts from the theory of computing. Security Vulnerabilities 2022
Using XML to Exchange Floating Point Data

February 10, 2022 • White Paper

By John Klein

This paper explains issues of using XML to exchange floating point values, how to address them, and the limits of technology to enforce a correct implementation.
DOWNLOAD this paper explains issues of using xml to exchange floating point values, how to address them, and the limits of technology to enforce a correct implementation. System of Systems,Best Practices 2022
Using Machine Learning to Increase NPC Fidelity

December 1, 2021 • Technical Report

By Dustin D. Updyke , Thomas G. Podnar , Geoffrey B. Dobson , John Yarger

The authors describe how they used machine learning (ML) modeling to create decision-making preferences for non-player characters (NPCs).
DOWNLOAD the authors describe how they used machine learning (ml) modeling to create decision-making preferences for non-player characters (npcs). Cyber Workforce Development 2021
A Prototype Set of Cloud Adoption Risk Factors

October 27, 2021 • White Paper

By Christopher J. Alberts

Alberts discusses the results of a study to identify a prototype set of risk factors for adopting cloud technologies.
DOWNLOAD alberts discusses the results of a study to identify a prototype set of risk factors for adopting cloud technologies. Cyber Risk and Resilience Management 2021
Cloud Security Best Practices Derived from Mission Thread Analysis

September 2, 2021 • Technical Report

By Angel Luis Hueca , Nathaniel Richmond , Donald Faatz , Timothy Morrow , Vincent LaPiana

This report presents practices for secure, effective use of cloud computing and risk reduction in transitioning applications and data to the cloud, and considers the needs of limited-resource businesses.
DOWNLOAD this report presents practices for secure, effective use of cloud computing and risk reduction in transitioning applications and data to the cloud, and considers the needs of limited-resource businesses. Cloud Computing 2021
Accenture: An Automation Maturity Journey

July 29, 2021 • Technical Report

By Rajendra T. Prasad (Accenture)

This paper describes work in the area of automation that netted Accenture the 2020 Watts Humphrey Software Process Achievement Award.
DOWNLOAD this paper describes work in the area of automation that netted accenture the 2020 watts humphrey software process achievement award. 2021
Planning and Design Considerations for Data Centers

July 19, 2021 • Technical Note

By David Sweeney , Lyndsi A. Hughes , Mark Kasunic

This report shares important lessons learned from establishing small- to mid-size data centers.
DOWNLOAD this report shares important lessons learned from establishing small- to mid-size data centers. Cyber Risk and Resilience Management 2021
Integrating Zero Trust and DevSecOps

July 5, 2021 • White Paper

By Nathaniel Richmond , Geoff Sanders , Timothy Morrow , Carol Woody

This paper discusses the interdependent strategies of zero trust and DevSecOps in the context of application development.
DOWNLOAD this paper discusses the interdependent strategies of zero trust and devsecops in the context of application development. DevSecOps,Secure Development,Situational Awareness 2021
A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)

July 1, 2021 • Special Report

By Allen D. Householder , Jonathan Spring

This report discusses performance indicators that stakeholders in Coordinated Vulnerability Disclosure (CVD) can use to measure its effectiveness.
DOWNLOAD this report discusses performance indicators that stakeholders in coordinated vulnerability disclosure (cvd) can use to measure its effectiveness. Cybersecurity,Security Vulnerabilities 2021
Human-Centered AI

June 25, 2021 • White Paper

By Hollen Barmer , Rachel Dzombak , Jay Palat , Matt Gaston , Carol J. Smith , Tanisha Smith , Frank Redner

This white paper discusses Human-Centered AI: systems that are designed to work with, and for, people.
DOWNLOAD this white paper discusses human-centered ai: systems that are designed to work with, and for, people. Artificial Intelligence Engineering 2021
Robust and Secure AI

June 25, 2021 • White Paper

By Frank Redner , Tanisha Smith , Nathan M. VanHoudnos , Matt Gaston , Jay Palat , Rachel Dzombak , Hollen Barmer , Eric Heim

This white paper discusses Robust and Secure AI systems: AI systems that reliably operate at expected levels of performance, even when faced with uncertainty and in the presence of danger …
DOWNLOAD this white paper discusses robust and secure ai systems: ai systems that reliably operate at expected levels of performance, even when faced with uncertainty and in the presence of danger or threat. Artificial Intelligence Engineering 2021
Scalable AI

June 25, 2021 • White Paper

By Hollen Barmer , Rachel Dzombak , Jay Palat , Matt Gaston , Tanisha Smith , Frank Redner , John Wohlbier

This white paper discusses Scalable AI: the ability of AI algorithms, data, models, and infrastructure to operate at the size, speed, and complexity required for the mission.
DOWNLOAD this white paper discusses scalable ai: the ability of ai algorithms, data, models, and infrastructure to operate at the size, speed, and complexity required for the mission. Artificial Intelligence Engineering 2021
The Sector CSIRT Framework: Developing Sector-Based Incident Response Capabilities

June 8, 2021 • Technical Report

By David McIntire , Sharon Mudd , Justin Novak , Tracy Bills , Angel Luis Hueca , Brittany Manley

This framework guides the development and implementation of a sector CSIRT.
DOWNLOAD this framework guides the development and implementation of a sector csirt. Incident Management,CSIRT Development 2021
Foundation of Cyber Ranges

May 19, 2021 • Technical Report

By Bill Reed , Dustin D. Updyke , Thomas G. Podnar , Geoffrey B. Dobson

This report details the design considerations and execution plan for building high-fidelity, realistic virtual cyber ranges that deliver maximum training and exercise value for cyberwarfare participants.
DOWNLOAD this report details the design considerations and execution plan for building high-fidelity, realistic virtual cyber ranges that deliver maximum training and exercise value for cyberwarfare participants. Cyber Workforce Development 2021
Software Assurance Guidance and Evaluation (SAGE) Tool

May 3, 2021 • White Paper

By Robert Schiela , Ebonie McNeil , Luiz Antunes , Hasan Yasar

The Software Assurance Guidance and Evaluation (SAGE) tool helps an organization assess the security of its systems development and operations practices.
DOWNLOAD the software assurance guidance and evaluation (sage) tool helps an organization assess the security of its systems development and operations practices. Tools,Software Assurance 2021
Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)

April 30, 2021 • White Paper

By Eric Hatleback , Laurie Tyzenhaus , Jonathan Spring , Art Manion , Vijay S. Sarvepalli , Allen D. Householder , Charles G. Yarbrough , Madison Oliver

This paper presents version 2.0 of a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that takes the form of decision trees and that avoids some problems with the Common Vulnerability Scoring System …
DOWNLOAD this paper presents version 2.0 of a testable stakeholder-specific vulnerability categorization (ssvc) that takes the form of decision trees and that avoids some problems with the common vulnerability scoring system (cvss). Security Vulnerabilities 2021
Modeling and Validating Security and Confidentiality in System Architectures

March 19, 2021 • Technical Report

By Lutz Wrage , Jörgen Hansson (University of Skovde) , Aaron Greenhouse

This report presents an approach for modeling and validating conﬁdentiality using the Bell–LaPadula security model and the Architecture Analysis & Design Language.
DOWNLOAD this report presents an approach for modeling and validating conﬁdentiality using the bell–lapadula security model and the architecture analysis & design language. Software Architecture 2021
Overview of Practices and Processes of the CMMC 1.0 Assessment Guides (CMMC 1.0)

March 3, 2021 • White Paper

By Douglas Gardner

This document is intended to help anyone unfamiliar with cybersecurity standards get started with the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC).
DOWNLOAD this document is intended to help anyone unfamiliar with cybersecurity standards get started with the department of defense (dod) cybersecurity maturity model certification (cmmc). Tools,Supply Chain Assurance,Cyber Risk and Resilience Management 2021
Zero Trust: Risks and Research Opportunities

March 1, 2021 • White Paper

By Geoff Sanders , Timothy Morrow

This paper describes a zero trust vignette and three mission threads that highlight risks and research areas to consider for zero trust environments.
DOWNLOAD this paper describes a zero trust vignette and three mission threads that highlight risks and research areas to consider for zero trust environments. Cyber Risk and Resilience Management 2021
Artificial Intelligence (AI) and Machine Learning (ML) Acquisition and Policy Implications

February 26, 2021 • White Paper

By William E. Novak

This paper reports on a high-level survey of a set of both actual and potential acquisition and policy implications of the use of Artificial Intelligence (AI) and Machine Learning (ML) …
DOWNLOAD this paper reports on a high-level survey of a set of both actual and potential acquisition and policy implications of the use of artificial intelligence (ai) and machine learning (ml) technologies. Acquisition 2021
Security Engineering Risk Analysis (SERA) Threat Archetypes

December 16, 2020 • White Paper

By Christopher J. Alberts , Carol Woody

This report examines the concept of threat archetypes and how analysts can use them during scenario development.
DOWNLOAD this report examines the concept of threat archetypes and how analysts can use them during scenario development. Cyber Risk and Resilience Management 2020
Loss Magnitude Estimation in Support of Business Impact Analysis

December 15, 2020 • Technical Report

By David Tobar , Brett Tucker , Daniel J. Kambic , Andrew P. Moore

The authors describe a project to develop an estimation method that yields greater confidence in and improved ranges for estimates of potential cyber loss magnitude.
DOWNLOAD the authors describe a project to develop an estimation method that yields greater confidence in and improved ranges for estimates of potential cyber loss magnitude. Cyber Risk and Resilience Management 2020
Emerging Technologies 2020: Six Areas of Opportunity

December 14, 2020 • White Paper

By None

This study seeks to understand what the software engineering community perceives to be key emerging technologies. The six technologies described hold great promise and, in some cases, have already attracted …
DOWNLOAD this study seeks to understand what the software engineering community perceives to be key emerging technologies. the six technologies described hold great promise and, in some cases, have already attracted the interest of the department of defense. 2020
Maintainability

December 1, 2020 • Technical Report

By Rick Kazman , John Klein , Philip Bianco , James Ivers

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for maintainability.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for maintainability. Software Architecture 2020
Advancing Risk Management Capability Using the OCTAVE FORTE Process

November 17, 2020 • Technical Note

By Brett Tucker

OCTAVE FORTE is a process model that helps organizations evaluate their security risks and use ERM principles to bridge the gap between executives and practitioners.
DOWNLOAD octave forte is a process model that helps organizations evaluate their security risks and use erm principles to bridge the gap between executives and practitioners. Cyber Risk and Resilience Management,Enterprise Risk and Resilience Management,OCTAVE 2020
Analytic Capabilities for Improved Software Program Management

November 2, 2020 • White Paper

By Christopher Miller , David Zubrow

This white paper describes an update to the SEI Quantifying Uncertainty in Early Lifecycle Cost Estimation approach.
DOWNLOAD this white paper describes an update to the sei quantifying uncertainty in early lifecycle cost estimation approach. Measurement and Analysis 2020
AI Engineering for Defense and National Security: A Report from the October 2019 Community of Interest Workshop

October 29, 2020 • Special Report

By None

Based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for AI Engineering for Defense and National Security.
DOWNLOAD based on a workshop with thought leaders in the field, this report identifies recommended areas of focus for ai engineering for defense and national security. Artificial Intelligence Engineering 2020
NICE Framework Cybersecurity Evaluator

August 20, 2020 • White Paper

By Christopher Herr

This cybersecurity evaluator is designed to assess members of the cyber workforce within the scope of the NICE Cybersecurity Workforce Framework.
DOWNLOAD this cybersecurity evaluator is designed to assess members of the cyber workforce within the scope of the nice cybersecurity workforce framework. 2020
Current Ransomware Threats

August 19, 2020 • White Paper

By Kyle O'Meara , Marisa Midler

This report by Marisa Midler, Kyle O'Meara, and Alexandra Parisi discusses ransomware, including an explanation of its design, distribution, execution, and business model.
DOWNLOAD this report by marisa midler, kyle o'meara, and alexandra parisi discusses ransomware, including an explanation of its design, distribution, execution, and business model. Cybersecurity 2020
An Updated Framework of Defenses Against Ransomware

August 18, 2020 • White Paper

By Timothy J. Shimeall , Timur D. Snoke

This report, loosely structured around the NIST Cybersecurity Framework, seeks to frame an approach for defending against Ransomware-as-a-Service (RaaS) as well as direct ransomware attacks.
DOWNLOAD this report, loosely structured around the nist cybersecurity framework, seeks to frame an approach for defending against ransomware-as-a-service (raas) as well as direct ransomware attacks. Cybersecurity 2020
Historical Analysis of Exploit Availability Timelines

August 13, 2020 • White Paper

By Jonathan Spring , Allen D. Householder , David Warren , Jeff Chrabaszcz (Govini) , Trent Novelly

This paper analyzes when and how known exploits become associated with the vulnerabilities that made them possible.
DOWNLOAD this paper analyzes when and how known exploits become associated with the vulnerabilities that made them possible. Measurement and Analysis,CERT/CC 2020
Architecture Evaluation for Universal Command and Control

August 3, 2020 • White Paper

By Patrick Donohoe , John Klein , Harry L. Levinson , Reed Little , Jason Popowski , Philip Bianco

The SEI developed an analysis method to assess function allocations in existing C2 systems and reason about design choices and tradeoffs during the design of new C2 systems.
DOWNLOAD the sei developed an analysis method to assess function allocations in existing c2 systems and reason about design choices and tradeoffs during the design of new c2 systems. Software Architecture 2020
A Risk Management Perspective for AI Engineering

June 10, 2020 • White Paper

By Brett Tucker

This paper describes several steps of OCTAVE FORTE in the context of adopting AI technology.
DOWNLOAD this paper describes several steps of octave forte in the context of adopting ai technology. Cyber Risk and Resilience Management,Cybersecurity,Artificial Intelligence Engineering,OCTAVE,Resilience Management Model (RMM) 2020
Attack Surface Analysis - Reduce System and Organizational Risk

June 8, 2020 • White Paper

By Carol Woody , Robert J. Ellison

This paper offers system defenders an overview of how threat modeling can provide a systematic way to identify potential threats and prioritize mitigations.
DOWNLOAD this paper offers system defenders an overview of how threat modeling can provide a systematic way to identify potential threats and prioritize mitigations. Cybersecurity Engineering 2020
Guide to Implementing DevSecOps for a System of Systems in Highly Regulated Environments

April 8, 2020 • Technical Report

By Jose A. Morales , Peter Capell , David James Shepard , Richard Turner , Patrick R. Place , Suzanne Miller

This Technical Report provides guidance to projects interested in implementing DevSecOps (DSO) in defense or other highly regulated environments, including those involving systems of systems.
DOWNLOAD this technical report provides guidance to projects interested in implementing devsecops (dso) in defense or other highly regulated environments, including those involving systems of systems. Agile,Acquisition 2020
Integrability

February 7, 2020 • Technical Report

By Rick Kazman , John Klein , Philip Bianco , James Ivers

This report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for integrability.
DOWNLOAD this report summarizes how to systematically analyze a software architecture with respect to a quality attribute requirement for integrability. Software Architecture 2020
Comments on NISTIR 8269 (A Taxonomy and Terminology of Adversarial Machine Learning)

February 4, 2020 • White Paper

By Nathan M. VanHoudnos , April Galyardt , Jonathan Spring

Feedback to the U.S. National Institute of Standards and Technology (NIST) about NIST IR 8269, a draft report detailing the proposed taxonomy and terminology of Adversarial Machine Learning (AML).
DOWNLOAD feedback to the u.s. national institute of standards and technology (nist) about nist ir 8269, a draft report detailing the proposed taxonomy and terminology of adversarial machine learning (aml). Best Practices 2020
Penetration Tests Are The Check Engine Light On Your Security Operations

January 7, 2020 • White Paper

By Dan J. Klinedinst , Allen D. Householder

A penetration test serves as a lagging indicator of a network security operations problem. Organizations should implement and document several security controls before a penetration test can be useful.
DOWNLOAD a penetration test serves as a lagging indicator of a network security operations problem. organizations should implement and document several security controls before a penetration test can be useful. Security Vulnerabilities 2020
Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization

December 4, 2019 • White Paper

By Allen D. Householder , Jonathan Spring , Art Manion , Deana Shick , Eric Hatleback

This paper presents a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that takes the form of decision trees and that avoids some problems with the Common Vulnerability Scoring System (CVSS).
DOWNLOAD this paper presents a testable stakeholder-specific vulnerability categorization (ssvc) that takes the form of decision trees and that avoids some problems with the common vulnerability scoring system (cvss). Security Vulnerabilities 2019
AI Engineering: 11 Foundational Practices

September 12, 2019 • White Paper

By None

This initial set of recommendations can help organizations that are beginning to build, acquire, and integrate artificial intelligence capabilities into business and mission systems.
DOWNLOAD this initial set of recommendations can help organizations that are beginning to build, acquire, and integrate artificial intelligence capabilities into business and mission systems. 2019
Machine Learning in Cybersecurity: A Guide

September 5, 2019 • Technical Report

By Leigh B. Metcalf , Jonathan Spring , Joshua Fallon , Angela Horneman , April Galyardt , Ed Stoner

This report suggests seven key questions that managers and decision makers should ask about machine learning tools to effectively use those tools to solve cybersecurity problems.
DOWNLOAD this report suggests seven key questions that managers and decision makers should ask about machine learning tools to effectively use those tools to solve cybersecurity problems. Artificial Intelligence Engineering,Cybersecurity,CERT/CC 2019
Operational Test & Evaluation (OT&E) Roadmap for Cloud-Based Systems

September 2, 2019 • White Paper

By Carol Woody , John Klein , Christopher J. Alberts , Charles M. Wallen

This paper provides an overview of the preparation and work that the AEC needs to perform to successfully transition the Army to cloud computing.
DOWNLOAD this paper provides an overview of the preparation and work that the aec needs to perform to successfully transition the army to cloud computing. Cloud Computing 2019
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award 2018: U.S. Army Combat Capabilities Development Command Armaments Center, Fire Control Systems and Technology Directorate

August 1, 2019 • Technical Report

By Victor A. Elias (U.S. Army CCDC Armaments Center, Fire Control Systems and Technology Directorate)

This report presents a systemic approach to software development process improvement and its impact for the U.S. Army Combat Capabilities Development Command Armaments Center, Fire Control Systems and Technology Directorate …
DOWNLOAD this report presents a systemic approach to software development process improvement and its impact for the u.s. army combat capabilities development command armaments center, fire control systems and technology directorate (fcstd) and its stakeholders. CMMI,Process Improvement 2019
Overview of Risks, Threats, and Vulnerabilities Faced in Moving to the Cloud

July 11, 2019 • Technical Report

By Kelwyn Pender , Carrie Lee (U.S. Department of Veteran Affairs) , Timothy Morrow , Donald Faatz

This report, updated in October 2020, examines the changes to risks, threats, and vulnerabilities when applications are deployed to cloud services.
DOWNLOAD this report, updated in october 2020, examines the changes to risks, threats, and vulnerabilities when applications are deployed to cloud services. Cloud Computing,Cybersecurity,Situational Awareness 2019
Automatically Detecting Technical Debt Discussions

June 24, 2019 • White Paper

By Zachary Kurtz , Robert Nord , Ipek Ozkaya , Raghvinder Sangwan

This study introduces (1) a dataset of expert labels of technical debt in developer comments and (2) a classifier trained on those labels.
DOWNLOAD this study introduces (1) a dataset of expert labels of technical debt in developer comments and (2) a classifier trained on those labels. Technical Debt 2019
Multi-Method Modeling and Analysis of the Cybersecurity Vulnerability Management Ecosystem

June 24, 2019 • White Paper

By Andrew P. Moore , Allen D. Householder

This paper presents modeling and analysis of two critical foundational processes of the cybersecurity vulnerability management ecosystem using a combination of system dynamics and agent-based modeling techniques.
DOWNLOAD this paper presents modeling and analysis of two critical foundational processes of the cybersecurity vulnerability management ecosystem using a combination of system dynamics and agent-based modeling techniques. Cybersecurity,Security Vulnerabilities 2019
SCAIFE API Definition Beta Version 0.0.2 for Developers

June 14, 2019 • White Paper

By Lori Flynn , Ebonie McNeil

This paper provides the SCAIFE API definition for beta version 0.0.2. SCAIFE is an architecture that supports static analysis alert classification and prioritization.
DOWNLOAD this paper provides the scaife api definition for beta version 0.0.2. scaife is an architecture that supports static analysis alert classification and prioritization. Secure Coding,Secure Development 2019
Creating xBD: A Dataset for Assessing Building Damage from Satellite Imagery

May 21, 2019 • White Paper

By None

We present a preliminary report for xBD, a new large-scale dataset for the advancement of change detection and building damage assessment for humanitarian assistance and disaster recovery research.
DOWNLOAD we present a preliminary report for xbd, a new large-scale dataset for the advancement of change detection and building damage assessment for humanitarian assistance and disaster recovery research. 2019
Integration of Automated Static Analysis Alert Classification and Prioritization with Auditing Tools: Special Focus on SCALe

May 13, 2019 • Technical Report

By David Svoboda , Lori Flynn , Ebonie McNeil , Zachary Kurtz , Derek Leung , Jiyeon Lee (Carnegie Mellon University)

This report summarizes progress and plans for developing a system to perform automated classification and advanced prioritization of static analysis alerts.
DOWNLOAD this report summarizes progress and plans for developing a system to perform automated classification and advanced prioritization of static analysis alerts. Cybersecurity,Secure Coding,Secure Development 2019
Cybersecurity Career Paths and Progression

May 7, 2019 • White Paper

By Marie Baker , Dennis M. Allen , Nicholas Giruzzi , Melissa Burns

This paper explores the current state of cybersecurity careers, from the importance of early exposure, to methods of entry into the field, to career progression.
DOWNLOAD this paper explores the current state of cybersecurity careers, from the importance of early exposure, to methods of entry into the field, to career progression. Cybersecurity 2019
Cybersecurity Talent Identification and Assessment

May 7, 2019 • White Paper

By Christopher Herr , Dennis M. Allen , Marie Baker

To help fill cybersecurity roles, this paper explores how organizations identify talent, discusses assessment capabilities, and provides recommendations on recruitment and talent evaluations.
DOWNLOAD to help fill cybersecurity roles, this paper explores how organizations identify talent, discusses assessment capabilities, and provides recommendations on recruitment and talent evaluations. Cybersecurity 2019
Cybersecurity Careers of the Future

May 7, 2019 • White Paper

By Dennis M. Allen

Using workforce data analysis, this paper identifies key cybersecurity skills the workforce needs to close the cybersecurity workforce gap.
DOWNLOAD using workforce data analysis, this paper identifies key cybersecurity skills the workforce needs to close the cybersecurity workforce gap. Cybersecurity 2019
A Targeted Improvement Plan for Service Continuity

April 8, 2019 • Technical Note

By Gavin Jurecko , Philip A. Scolieri , Andrew F. Hoover , Jeffrey Pinckard , Robert A. Vrtis

Describes how an organization can leverage the results of a Cyber Resilience Review to create a Targeted Improvement Plan for its service continuity management.
DOWNLOAD describes how an organization can leverage the results of a cyber resilience review to create a targeted improvement plan for its service continuity management. Cyber Risk and Resilience Management 2019
Exploring the Use of Metrics for Software Assurance

March 7, 2019 • Technical Note

By Carol Woody , Charlie Ryan , Robert J. Ellison

This report proposes measurements for each Software Assurance Framework (SAF) practice that a program can select to monitor and manage the progress it's making toward software assurance.
DOWNLOAD this report proposes measurements for each software assurance framework (saf) practice that a program can select to monitor and manage the progress it's making toward software assurance. software engineering and information assurance,CERT/CC 2019
Common Sense Guide to Mitigating Insider Threats, Sixth Edition

February 27, 2019 • Technical Report

By Tracy Cassidy , Sarah Miller , Michael C. Theis , William R. Claycomb , Daniel L. Costa , Randall F. Trzeciak , Andrew P. Moore

The guide presents recommendations for mitigating insider threat based on the CERT Division's continued research and analysis of more than 1,500 insider threat cases.
DOWNLOAD the guide presents recommendations for mitigating insider threat based on the cert division's continued research and analysis of more than 1,500 insider threat cases. Insider Threat,Best Practices,Cybersecurity 2019
An Approach for Integrating the Security Engineering Risk Analysis (SERA) Method with Threat Modeling

February 6, 2019 • White Paper

By Carol Woody , Christopher J. Alberts

This report examines how cybersecurity data generated by a threat modeling method can be integrated into a mission assurance context using the SERA Method.
DOWNLOAD this report examines how cybersecurity data generated by a threat modeling method can be integrated into a mission assurance context using the sera method. Cybersecurity Engineering,Mission Assurance 2019
Infrastructure as Code: Final Report

January 28, 2019 • White Paper

By John Klein , Doug Reynolds

This project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated IaC scripts from the model.
DOWNLOAD this project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated iac scripts from the model. Tools,Software Architecture 2019
Incident Management Capability Assessment

December 19, 2018 • Technical Report

By Samuel J. Perl , Mark Zajicek , Robin Ruefle , Christopher J. Alberts , Pennie Walters , David McIntire , Audrey J. Dorofee , Carly L. Huth

The capabilities presented in this report provide a benchmark of incident management practices.
DOWNLOAD the capabilities presented in this report provide a benchmark of incident management practices. Incident Handling,Incident Management,Cybersecurity 2018
Program Manager's Guidebook for Software Assurance

December 14, 2018 • Special Report

By Kenneth Nidiffer , Timothy A. Chick , Carol Woody

This guidebook helps program managers address the software assurance responsibilities critical in defending software-intensive systems, including mission threads and cybersecurity.
DOWNLOAD this guidebook helps program managers address the software assurance responsibilities critical in defending software-intensive systems, including mission threads and cybersecurity. Software Assurance,software engineering and information assurance 2018
DoD Developer’s Guidebook for Software Assurance

December 14, 2018 • Special Report

By Tom Scanlon , Bill Nichols

This guidebook helps software developers for DoD programs understand expectations for software assurance and standards and requirements that affect assurance.
DOWNLOAD this guidebook helps software developers for dod programs understand expectations for software assurance and standards and requirements that affect assurance. Software Assurance,software engineering and information assurance 2018
Towards Improving CVSS

December 4, 2018 • White Paper

By Art Manion , Jonathan Spring , Allen D. Householder , Eric Hatleback , Deana Shick

This paper outlines challenges with the Common Vulnerability Scoring System (CVSS).
DOWNLOAD this paper outlines challenges with the common vulnerability scoring system (cvss). Security Vulnerabilities 2018
GHOSTS in the Machine: A Framework for Cyber-Warfare Exercise NPC Simulation

December 3, 2018 • Technical Report

By Dustin D. Updyke , Thomas G. Podnar , Geoffrey B. Dobson , Luke J. Osterritter , Benjamin L. Earl , Adam D. Cerini

This report outlines how the GHOSTS (General HOSTS) framework helps create realism in cyber-warfare simulations and discusses how it was used in a case study.
DOWNLOAD this report outlines how the ghosts (general hosts) framework helps create realism in cyber-warfare simulations and discusses how it was used in a case study. Cyber Workforce Development 2018
Composing Effective Software Security Assurance Workflows

October 18, 2018 • Technical Report

By William Snavely , David Sweeney , Aaron Volkmann , Jim McHale , Bill Nichols

In an effort to determine how to make secure software development more cost effective, the SEI conducted a research study to empirically measure the effects that security tools—primarily automated static …
DOWNLOAD in an effort to determine how to make secure software development more cost effective, the sei conducted a research study to empirically measure the effects that security tools—primarily automated static analysis tools—had on costs and benefits. Software Assurance,Process Improvement,Performance and Dependability 2018
FedCLASS: A Case Study of Agile and Lean Practices in the Federal Government

October 5, 2018 • Special Report

By Linda Parker Gates , Nanette Brown , Tamara Marshall-Keim , Jeff Davenport

This study reports the successes and challenges of using Agile and Lean methods and cloud-based technologies in a government software development environment.
DOWNLOAD this study reports the successes and challenges of using agile and lean methods and cloud-based technologies in a government software development environment. Agile,Acquisition 2018
Threat Modeling for Cyber-Physical System-of-Systems: Methods Evaluation

September 25, 2018 • White Paper

By Brent Frye , Carol Woody , Nataliya Shevchenko

This paper compares threat modeling methods for cyber-physical systems and recommends which methods (and combinations of methods) to use.
DOWNLOAD this paper compares threat modeling methods for cyber-physical systems and recommends which methods (and combinations of methods) to use. 2018
Software Architecture Publications

September 17, 2018 • White Paper

By None

The SEI compiled this bibliography of publications about software architecture as a resource for information about system architecture throughout its lifecycle.
DOWNLOAD the sei compiled this bibliography of publications about software architecture as a resource for information about system architecture throughout its lifecycle. Software Architecture 2018
Practical Precise Taint-flow Static Analysis for Android App Sets

August 27, 2018 • White Paper

By Lori Flynn , William Klieber , William Snavely , Michael Zheng

This paper describes how to detect taint flow in Android app sets with a static analysis method that is fast and uses little disk and memory space.
DOWNLOAD this paper describes how to detect taint flow in android app sets with a static analysis method that is fast and uses little disk and memory space. Secure Coding,Secure Development 2018
Threat Modeling: A Summary of Available Methods

August 9, 2018 • White Paper

By Paige O'Riordan , Carol Woody , Nataliya Shevchenko , Tom Scanlon , Timothy A. Chick

This paper discusses twelve threat modeling methods from a variety of sources that target different parts of the development process.
DOWNLOAD this paper discusses twelve threat modeling methods from a variety of sources that target different parts of the development process. Cyber-Physical Systems,Cybersecurity Engineering,Software Assurance,Science of Cybersecurity,OCTAVE,SQUARE,Cybersecurity,Mission Assurance,software engineering and information assurance,Insider Threat,Enterprise Risk and Resilience Management 2018
Navigating the Insider Threat Tool Landscape: Low-Cost Technical Solutions to Jump-Start an Insider Threat Program

July 3, 2018 • White Paper

By Michael J. Albrethsen , Derrick Spooner , Daniel L. Costa , George Silowash

This paper explores low cost technical solutions that can help organizations prevent, detect, and respond to insider incidents.
DOWNLOAD this paper explores low cost technical solutions that can help organizations prevent, detect, and respond to insider incidents. Insider Threat 2018
Blacklist Ecosystem Analysis: July - December 2017

April 19, 2018 • White Paper

By Leigh B. Metcalf , Eric Hatleback

This short report provides a summary of the various analyses of the blacklist ecosystem performed from July 1, 2017, through December 31, 2017.
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed from july 1, 2017, through december 31, 2017. Situational Awareness 2018
ROI Analysis of the System Architecture Virtual Integration Initiative

April 12, 2018 • Technical Report

By Peter H. Feiler , Jörgen Hansson (University of Skovde) , Steve Helton (The Boeing Company)

This report presents an analysis of the economic effects of the System Architecture Virtual Integration approach on the development of software-reliant systems for aircraft compared to existing development paradigms.
DOWNLOAD this report presents an analysis of the economic effects of the system architecture virtual integration approach on the development of software-reliant systems for aircraft compared to existing development paradigms. Software Architecture 2018
Implementing DevOps Practices in Highly Regulated Environments

April 2, 2018 • White Paper

By Aaron Volkmann , Hasan Yasar , Jose A. Morales

In this paper, the authors layout the process with insights on performing a DevOps assessment in a highly regulated environment.
DOWNLOAD in this paper, the authors layout the process with insights on performing a devops assessment in a highly regulated environment. CERT/CC 2018
A Mapping of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule to the Cyber Resilience Review (CRR)

March 29, 2018 • Technical Note

By Robert A. Vrtis , Matthew Trevors , Greg Porter (Heinz College at Carnegie Mellon University)

This technical note describes mapping of HIPAA Security Rule requirements to practice questions found in the CERT Cyber Resilience Review for organizations' use in HIPAA compliance.
DOWNLOAD this technical note describes mapping of hipaa security rule requirements to practice questions found in the cert cyber resilience review for organizations' use in hipaa compliance. Cyber Risk and Resilience Management 2018
A Hybrid Threat Modeling Method

March 27, 2018 • Technical Note

By Krishnamurthy Vemuru (University of Virginia) , Ole Villadsen (Carnegie Mellon University) , Forrest Shull , Nancy R. Mead

Presents a hybrid method of threat modeling that attempts to meld the desirable features of three methods: Security Cards, Persona non Grata, and STRIDE.
DOWNLOAD presents a hybrid method of threat modeling that attempts to meld the desirable features of three methods: security cards, persona non grata, and stride. Cybersecurity Engineering,Software Assurance 2018
Cyber Mutual Assistance Workshop Report

February 13, 2018 • Special Report

By Katie C. Stewart , Jonathon Monken (PJM Interconnection) , Fernando Maymi, PhD (Army Cyber Institute) , Dan Bennett, PhD (Army Cyber Institute) , Dan Huynh (Army Cyber Institute) , Blake Rhoades (Army Cyber Institute) , Matt Hutchison (Army Cyber Institute) , Judy Esquibel (Army Cyber Institute) , Bill Lawrence (North American Electric Reliability Corporation)

The Army Cyber Institute hosted a Cyber Mutual Assistance Workshop to identify challenges in defining cyber requirements for Regional Mutual Assistance Groups.
DOWNLOAD the army cyber institute hosted a cyber mutual assistance workshop to identify challenges in defining cyber requirements for regional mutual assistance groups. Cyber Risk and Resilience Management 2018
Embedded Device Vulnerability Analysis Case Study Using Trommel

December 6, 2017 • White Paper

By Madison Oliver , Kyle O'Meara

This document provides security researchers with a repeatable methodology to produce more thorough and actionable results when analyzing embedded devices for vulnerabilities.
DOWNLOAD this document provides security researchers with a repeatable methodology to produce more thorough and actionable results when analyzing embedded devices for vulnerabilities. Security Vulnerabilities 2017
2017 Emerging Technology Domains Risk Survey

October 5, 2017 • Technical Report

By Kyle O'Meara , Dan J. Klinedinst , Joel Land

This report describes our understanding of future technologies and helps US-CERT identify vulnerabilities, promote security practices, and understand vulnerability risk.
DOWNLOAD this report describes our understanding of future technologies and helps us-cert identify vulnerabilities, promote security practices, and understand vulnerability risk. Cyber-Physical Systems,Security Vulnerabilities,Artificial Intelligence Engineering,Insider Threat,Enterprise Risk and Resilience Management 2017
R-EACTR: A Framework for Designing Realistic Cyber Warfare Exercises

September 29, 2017 • Technical Report

By Adam D. Cerini , Luke J. Osterritter , Thomas G. Podnar , Geoffrey B. Dobson

R-EACTR is a design framework for cyber warfare exercises. It ensures that designs of team-based exercises factor realism into all aspects of the participant experience.
DOWNLOAD r-eactr is a design framework for cyber warfare exercises. it ensures that designs of team-based exercises factor realism into all aspects of the participant experience. Cybersecurity Engineering 2017
Architecture Practices for Complex Contexts

September 26, 2017 • White Paper

By John Klein

This doctoral thesis, completed at Vrije Universiteit Amsterdam, focuses on software architecture practices for systems of systems, including data-intensive systems.
DOWNLOAD this doctoral thesis, completed at vrije universiteit amsterdam, focuses on software architecture practices for systems of systems, including data-intensive systems. Software Architecture,Artificial Intelligence Engineering 2017
Defining a Progress Metric for CERT-RMM Improvement

September 8, 2017 • Technical Note

By Nader Mehravari , David Tobar , Gregory Crabb (United States Postal Service)

Describes the Cybersecurity Program Progress Metric and how its implementation in a large, diverse U.S. national organization can serve to indicate progress toward improving cybersecurity and resilience capabilities.
DOWNLOAD describes the cybersecurity program progress metric and how its implementation in a large, diverse u.s. national organization can serve to indicate progress toward improving cybersecurity and resilience capabilities. Cyber Risk and Resilience Management 2017
Blacklist Ecosystem Analysis: January - June, 2017

August 22, 2017 • White Paper

By Eric Hatleback , Leigh B. Metcalf

This short report provides a summary of the various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data …
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from january through june 2017. Situational Awareness 2017
The CERT Guide to Coordinated Vulnerability Disclosure

August 15, 2017 • Special Report

By Art Manion , Allen D. Householder , Christopher King , Garret Wassermann

This guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful Coordinated Vulnerability Disclosure process. It also provides insights into how CVD can go …
DOWNLOAD this guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful coordinated vulnerability disclosure process. it also provides insights into how cvd can go awry and how to respond when it does so. Tools,Security Vulnerabilities,CSIRT Development,CERT/CC 2017
Systemic Vulnerabilities in Customer-Premises Equipment (CPE) Routers

July 11, 2017 • Special Report

By Joel Land

This report describes a test framework that the CERT/CC developed to identify systemic and other vulnerabilities in CPE routers.
DOWNLOAD this report describes a test framework that the cert/cc developed to identify systemic and other vulnerabilities in cpe routers. Security Vulnerabilities 2017
Department of Defense Software Factbook

July 11, 2017 • Technical Report

By James McCurley , Rhonda Brown , Christopher Miller , David Zubrow , Mike Zuccher (No Affiliation) , Brad Clark

In this report, the Software Engineering Institute has analyzed data related to DoD software projects and translated it into information that is frequently sought-after across the DoD.
DOWNLOAD in this report, the software engineering institute has analyzed data related to dod software projects and translated it into information that is frequently sought-after across the dod. Measurement and Analysis 2017
DidFail: Coverage and Precision Enhancement

July 6, 2017 • Technical Report

By Karan Dwivedi (No Affiliation) , Hongli Yin (No Affiliation) , Pranav Bagree (No Affiliation) , Xiaoxiao Tang (No Affiliation) , Lori Flynn , William Klieber , William Snavely

This report describes recent enhancements to Droid Intent Data Flow Analysis for Information Leakage (DidFail), the CERT static taint analyzer for sets of Android apps.
DOWNLOAD this report describes recent enhancements to droid intent data flow analysis for information leakage (didfail), the cert static taint analyzer for sets of android apps. Secure Coding,Secure Development 2017
The Hard Choices Game Explained

June 26, 2017 • White Paper

By Philippe Kruchten , Robert Nord , Nanette Brown , Ipek Ozkaya , Erin Lim

The Hard Choices game is a simulation of the software development cycle meant to communicate the concepts of uncertainty, risk, and technical debt.
DOWNLOAD the hard choices game is a simulation of the software development cycle meant to communicate the concepts of uncertainty, risk, and technical debt. Software Architecture,Technical Debt 2017
Federal Virtual Training Environment (FedVTE)

June 5, 2017 • White Paper

By April Galyardt , Dominic A. Ross , Marie Baker

The Federal Virtual Training Environment (FedVTE) is an online, on‐demand training system containing cybersecurity and certification prep courses, at no cost to federal, state, and local government employees.
DOWNLOAD the federal virtual training environment (fedvte) is an online, on‐demand training system containing cybersecurity and certification prep courses, at no cost to federal, state, and local government employees. 2017
Blacklist Ecosystem Analysis: July – December 2016

June 1, 2017 • White Paper

By Eric Hatleback , Leigh B. Metcalf

This report provides a summary of various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data in this …
DOWNLOAD this report provides a summary of various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from july 1 through december 31, 2016. 2017
Guide to Software Architecture Tools

May 22, 2017 • White Paper

By None

This document discusses tools and methods for analyzing the architecture, establishing requirements, evaluating the architecture, and defining the architecture.
DOWNLOAD this document discusses tools and methods for analyzing the architecture, establishing requirements, evaluating the architecture, and defining the architecture. 2017
System-of-Systems Software Architecture Evaluation

May 15, 2017 • White Paper

By None

System-of-Systems Software Architecture Evaluation
DOWNLOAD system-of-systems software architecture evaluation Artificial Intelligence Engineering 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award

May 15, 2017 • White Paper

By None

IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award
DOWNLOAD ieee computer society/software engineering institute watts s. humphrey software process achievement award Process Improvement 2017
SEI-Certified PSP Developer Examination: Sample Questions

May 15, 2017 • White Paper

By None

This page contains sample questions similar to those found on the PSP Developer examination.
DOWNLOAD this page contains sample questions similar to those found on the psp developer examination. 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement Award 2016: Raytheon Integrated Defense Systems

April 28, 2017 • Technical Report

By Neal Mackertich (Raytheon) , Peter Kraus (Raytheon) , Kurt Mittelstaedt (Raytheon) , Brian Foley (Raytheon) , Dan Bardsley (Raytheon) , Kelli Grimes (Raytheon) , Mike Nolan (Raytheon)

The Raytheon Integrated Defense Systems DFSS team has been recognized with the 2016 Watts Humphrey Software Process Achievement Award.
DOWNLOAD the raytheon integrated defense systems dfss team has been recognized with the 2016 watts humphrey software process achievement award. Process Improvement,Best Practices 2017
IEEE Computer Society/Software Engineering Institute Watts S. Humphrey Software Process Achievement (SPA) Award 2016: Nationwide

April 13, 2017 • Technical Report

By Will J.M. Pohlman (Nationwide IT)

This report describes the 10-year history of Nationwide's software process improvement journey. Nationwide received the 2016 Watts Humphrey Software Process Achievement Award from the SEI and IEEE.
DOWNLOAD this report describes the 10-year history of nationwide's software process improvement journey. nationwide received the 2016 watts humphrey software process achievement award from the sei and ieee. Process Improvement 2017
Prototype Software Assurance Framework (SAF): Introduction and Overview

April 6, 2017 • Technical Note

By Carol Woody , Christopher J. Alberts

In this report, the authors discuss the Software Assurance Framework (SAF), a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain.
DOWNLOAD in this report, the authors discuss the software assurance framework (saf), a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain. Cybersecurity Engineering 2017
15 Tips for Preparing and Delivering a Great Presentation at SATURN

March 14, 2017 • White Paper

By None

You submitted a proposal to SATURN, and it got accepted. Congratulations! Here are 15 tips for creating and giving a great presentation at SATURN.
DOWNLOAD you submitted a proposal to saturn, and it got accepted. congratulations! here are 15 tips for creating and giving a great presentation at saturn. SATURN 2017
The CISO Academy

February 23, 2017 • White Paper

By David Tobar , Summer C. Fowler , Pamela D. Curtis , David Ulicne

In this paper, the authors describe the project that led to the creation of the U.S. Postal Service's CISO Academy.
DOWNLOAD in this paper, the authors describe the project that led to the creation of the u.s. postal service's ciso academy. Cyber Risk and Resilience Management,Cybersecurity 2017
Agile Acquisition and Milestone Reviews

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 4
DOWNLOAD acquisition & management concerns for agile use in government series - 4 Acquisition,Agile 2017
Management and Contracting Practices for Agile Programs

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 3
DOWNLOAD acquisition & management concerns for agile use in government series - 3 Acquisition,Agile 2017
Estimating in Agile Acquisition

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 5
DOWNLOAD acquisition & management concerns for agile use in government series - 5 Acquisition,Agile 2017
Agile Development and DoD Acquisitions

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 1
DOWNLOAD acquisition & management concerns for agile use in government series - 1 Acquisition,Agile 2017
Agile Culture in the DoD

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 2
DOWNLOAD acquisition & management concerns for agile use in government series - 2 Acquisition,Agile 2017
Adopting Agile in DoD IT Acquisitions

February 15, 2017 • White Paper

By None

Acquisition & Management Concerns for Agile Use in Government Series - 6
DOWNLOAD acquisition & management concerns for agile use in government series - 6 Acquisition,Agile 2017
Supply Chain and Commercial-off-the-Shelf (COTS) Assurance

January 24, 2017 • White Paper

By None

The Software Engineering Institute can help your organization apply techniques to reduce software supply chain risk.
DOWNLOAD the software engineering institute can help your organization apply techniques to reduce software supply chain risk. Cybersecurity Engineering,software engineering and information assurance 2017
COTS-Based Systems

January 24, 2017 • White Paper

By None

This paper presents a summary of SEI commercial off-the-shelf (COTS) software documents and COTS tools.
DOWNLOAD this paper presents a summary of sei commercial off-the-shelf (cots) software documents and cots tools. Acquisition 2017
Create a CSIRT

January 18, 2017 • White Paper

By None

This white paper discusses the issues and decisions organizations should address when planning, implementing, and building a CSIRT.
DOWNLOAD this white paper discusses the issues and decisions organizations should address when planning, implementing, and building a csirt. Cybersecurity 2017
Skills Needed When Staffing Your CSIRT

January 18, 2017 • White Paper

By None

This white paper describes a set of skills that CSIRT staff members should have to provide basic incident-handling services.
DOWNLOAD this white paper describes a set of skills that csirt staff members should have to provide basic incident-handling services. 2017
CSIRT Frequently Asked Questions (FAQ)

January 18, 2017 • White Paper

By None

This FAQ addresses CSIRTS, organizations responsible for receiving, reviewing, and responding to computer security incident reports and activity.
DOWNLOAD this faq addresses csirts, organizations responsible for receiving, reviewing, and responding to computer security incident reports and activity. Cybersecurity 2017
CERT-RMM Capability Appraisals

January 17, 2017 • White Paper

By None

The white paper describe CERT-RMM appraisals and the benefits they offer organizations.
DOWNLOAD the white paper describe cert-rmm appraisals and the benefits they offer organizations. Mission Assurance 2017
A Technical History of the SEI

January 6, 2017 • Special Report

By Larry Druffel

This report chronicles the technical accomplishments of the Software Engineering Institute and its impact on the Department of Defense software community, as well as on the broader software engineering community.
DOWNLOAD this report chronicles the technical accomplishments of the software engineering institute and its impact on the department of defense software community, as well as on the broader software engineering community. 2017
SQUARE Frequently Asked Questions (FAQ)

January 5, 2017 • White Paper

By None

This paper contains information about SQUARE, a process that helps organizations build security into the early stages of the software production lifecycle.
DOWNLOAD this paper contains information about square, a process that helps organizations build security into the early stages of the software production lifecycle. Cybersecurity Engineering,SQUARE 2017
Common Sense Guide to Mitigating Insider Threats, Fifth Edition

December 21, 2016 • Technical Report

By Andrew P. Moore , Randall F. Trzeciak , Daniel L. Costa , Jason W. Clark , Michael J. Albrethsen , Michael C. Theis , Tracy Cassidy , Matthew L. Collins , Jeremy R. Strozer

Presents recommendations for mitigating insider threat based on CERT's continued research and analysis of over 1,000 cases.
DOWNLOAD presents recommendations for mitigating insider threat based on cert's continued research and analysis of over 1,000 cases. Insider Threat 2016
Architecture-Led Safety Process

December 21, 2016 • Technical Report

By David P. Gluch , John McGregor , Julien Delange , Peter H. Feiler

Architecture-Led Safety Analysis (ALSA) is a safety analysis method that uses early architecture knowledge to supplement traditional safety analysis techniques to identify faults as early as possible.
DOWNLOAD architecture-led safety analysis (alsa) is a safety analysis method that uses early architecture knowledge to supplement traditional safety analysis techniques to identify faults as early as possible. Software Architecture 2016
The Critical Role of Positive Incentives for Reducing Insider Threats

December 15, 2016 • Technical Report

By Andrew P. Moore , Palma Buttles-Valdez , Nathan M. VanHoudnos , Tracy Cassidy , Samuel J. Perl , Allison Parshall , Jennifer Cowley , Daniel Bauer , Jeff Savinda , Matthew L. Collins , Elizabeth A. Monaco , Jamie L. Moyes , Denise M. Rousseau (Carnegie Mellon University)

This report describes how positive incentives complement traditional practices to provide a better balance for organizations' insider threat programs.
DOWNLOAD this report describes how positive incentives complement traditional practices to provide a better balance for organizations' insider threat programs. Insider Threat 2016
Update 2016: Considerations for Using Agile in DoD Acquisition

December 14, 2016 • Technical Note

By Dan Ward (Dan Ward Consulting) , Daniel Burton , Charles (Bud) Hammons , Ray C. Williams , Alfred Schenker , Suzanne Miller , Mary Ann Lapham

This report updates a 2010 technical note, addressing developments in commercial Agile practices as well as the Department of Defense (DoD) acquisition environment.
DOWNLOAD this report updates a 2010 technical note, addressing developments in commercial agile practices as well as the department of defense (dod) acquisition environment. Acquisition 2016
Scaling Agile Methods for Department of Defense Programs

December 13, 2016 • Technical Note

By Mary Ann Lapham , Suzanne Miller , Peter Capell , Eileen Wrubel , Will Hayes

This report discusses methods for scaling Agile processes to larger software development programs in the Department of Defense.
DOWNLOAD this report discusses methods for scaling agile processes to larger software development programs in the department of defense. Acquisition 2016
Low Cost Technical Solutions to Jump Start an Insider Threat Program

December 12, 2016 • Technical Note

By Michael J. Albrethsen , Derrick Spooner , Daniel L. Costa , George Silowash

This technical note explores free and low cost technical solutions to help organizations prevent, detect, and respond to malicious insiders.
DOWNLOAD this technical note explores free and low cost technical solutions to help organizations prevent, detect, and respond to malicious insiders. Insider Threat 2016
RFP Patterns and Techniques for Successful Agile Contracting

December 2, 2016 • Special Report

By Mary Ann Lapham , Peter Capell , Keith Korzec , Larri Ann Rosser (Raytheon Intelligence Information and Services) , Steven Martin (Space and Missile Systems Center) , Thomas E. Friend (Agile On Target) , Greg Howard (MITRE) , Michael Ryan (BTAS) , John H. Norton III (Raytheon Integrated Defense Systems)

This report discusses request-for-proposal patterns and techniques for successfully contracting a federal Agile project.
DOWNLOAD this report discusses request-for-proposal patterns and techniques for successfully contracting a federal agile project. Acquisition 2016
Ultra-Large-Scale Systems: Socio-adaptive Systems

December 1, 2016 • White Paper

By Lutz Wrage , Mark H. Klein , Scott Hissam , Linda M. Northrop , Gabriel Moreno

Ultra-large-scale systems are interdependent webs of software, people, policies, and economics. In socio-adaptive systems, humans and software interact as peers.
DOWNLOAD ultra-large-scale systems are interdependent webs of software, people, policies, and economics. in socio-adaptive systems, humans and software interact as peers. Artificial Intelligence Engineering,Ultra-Large-Scale Systems 2016
Cyber-Physical Systems

December 1, 2016 • White Paper

By Gabriel Moreno , John J. Hudak , Jeffrey Hansen , Scott Hissam , Mark H. Klein , Bjorn Andersson , Sagar Chaki , Dionisio de Niz , David Kyle

Cyber-physical systems (CPS) integrate computational algorithms and physical components. SEI promotes the efficient development of high-confidence, distributed CPS.
DOWNLOAD cyber-physical systems (cps) integrate computational algorithms and physical components. sei promotes the efficient development of high-confidence, distributed cps. Artificial Intelligence Engineering,Cyber-Physical Systems 2016
Pervasive Mobile Computing

December 1, 2016 • White Paper

By Ben W. Bradshaw , James Root , Grace Lewis , Edwin J. Morris , Marc Novakouski , James Edmondson , William Anderson , Jeff Boleng

Pervasive mobile computing focuses on how soldiers and first responders can use smartphones, tablets, and other mobile/wearable devices at the tactical edge.
DOWNLOAD pervasive mobile computing focuses on how soldiers and first responders can use smartphones, tablets, and other mobile/wearable devices at the tactical edge. Pervasive Mobile Computing 2016
Predictability by Construction

December 1, 2016 • White Paper

By Scott Hissam , Gabriel Moreno , Linda M. Northrop , Kurt C. Wallnau , Sagar Chaki

Predictability by construction (PBC) makes the behavior of a component-based system predictable before implementation, based on known properties of components.
DOWNLOAD predictability by construction (pbc) makes the behavior of a component-based system predictable before implementation, based on known properties of components. Process Improvement 2016
Blacklist Ecosystem Analysis: January – June, 2016

December 1, 2016 • White Paper

By Leigh B. Metcalf , Eric Hatleback

This short report provides a summary of the various analyses of the blacklist ecosystem performed to date. It also appends the latest additional data to those analyses; the added data …
DOWNLOAD this short report provides a summary of the various analyses of the blacklist ecosystem performed to date. it also appends the latest additional data to those analyses; the added data in this report covers the time period from january through june 2016. Situational Awareness 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Testing the Identified Metrics

November 30, 2016 • White Paper

By Michael D. Konrad , Sarah Sheard , Bill Nichols , Charles Weinstock

This report describes a test of an algorithm for estimating the complexity of a safety argument.
DOWNLOAD this report describes a test of an algorithm for estimating the complexity of a safety argument. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Estimating Complexity of a Safety Argument

November 30, 2016 • White Paper

By Charles Weinstock , Bill Nichols , Sarah Sheard , Michael D. Konrad

This report presents a formula for estimating the complexity of an avionics system and directly connects that complexity to the size of its safety argument.
DOWNLOAD this report presents a formula for estimating the complexity of an avionics system and directly connects that complexity to the size of its safety argument. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Identifying the Impact of Complexity on Safety

November 30, 2016 • White Paper

By Sarah Sheard , Michael D. Konrad , Donald Firesmith , Charles Weinstock

This report organizes our work on the impact of software complexity on aircraft safety by asking, “How can complexity complicate safety and, thus, certification?”
DOWNLOAD this report organizes our work on the impact of software complexity on aircraft safety by asking, “how can complexity complicate safety and, thus, certification?” Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Candidate Complexity Metrics

November 30, 2016 • White Paper

By Bill Nichols , Sarah Sheard

This special report identifies candidate measures of complexity for systems with embedded software that relate to safety, assurance, or both.
DOWNLOAD this special report identifies candidate measures of complexity for systems with embedded software that relate to safety, assurance, or both. Measurement and Analysis 2016
FAA Research Project on System Complexity Effects on Aircraft Safety: Literature Search to Define Complexity for Avionics Systems

November 30, 2016 • White Paper

By Sarah Sheard , Michael D. Konrad

This special report describes the results of a literature review sampling what is known about complexity for application in the context of safety and assurance.
DOWNLOAD this special report describes the results of a literature review sampling what is known about complexity for application in the context of safety and assurance. Measurement and Analysis 2016
Seven Proposal-Writing Tips That Make Conference Program Committees Smile

November 30, 2016 • White Paper

By Mike Petock , Bill Pollak

Writing a great session proposal for a conference is difficult. Here are seven tips for writing a session proposal that will make reviewers go from frown to smile.
DOWNLOAD writing a great session proposal for a conference is difficult. here are seven tips for writing a session proposal that will make reviewers go from frown to smile. SATURN 2016
Definition and Measurement of Complexity in the Context of Safety Assurance

October 27, 2016 • Technical Report

By Bill Nichols , Michael D. Konrad , Sarah Sheard , Charles Weinstock

This report describes research to define complexity measures for avionics systems to help the FAA identify when systems are too complex to assure their safety.
DOWNLOAD this report describes research to define complexity measures for avionics systems to help the faa identify when systems are too complex to assure their safety. Performance and Dependability 2016
Establishing Trusted Identities in Disconnected Edge Environments

October 27, 2016 • White Paper

By Keegan M. Williams , Sebastián Echeverría , Dan J. Klinedinst

he goal of this paper is to present a solution for establishing trusted identities in disconnected environments based on secure key generation and exchange in the field.
DOWNLOAD he goal of this paper is to present a solution for establishing trusted identities in disconnected environments based on secure key generation and exchange in the field. Cloud Computing,Edge Computing 2016
A Mapping of the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT) to the Cyber Resilience Review (CRR)

October 25, 2016 • Technical Note

By Jeffrey Pinckard , Robert A. Vrtis , Michael Rattigan

To help financial organizations assess cyber resilience, we map FFIEC Cybersecurity Assessment Tool (CAT) statements to Cyber Resilience Review (CRR) questions.
DOWNLOAD to help financial organizations assess cyber resilience, we map ffiec cybersecurity assessment tool (cat) statements to cyber resilience review (crr) questions. Cyber Risk and Resilience Management 2016
Managing Third Party Risk in Financial Services Organizations: A Resilience-Based Approach

September 27, 2016 • White Paper

By John Haller , Charles M. Wallen

A resilience-based approach can help financial services organizations to manage cybersecurity risks from outsourcing and comply with federal regulations.
DOWNLOAD a resilience-based approach can help financial services organizations to manage cybersecurity risks from outsourcing and comply with federal regulations. Cyber Risk and Resilience Management 2016
Agile Development in Government: Myths, Monsters, and Fables

September 21, 2016 • White Paper

By Suzanne Miller , Mary Ann Lapham , David J. Carney

This volume is a reflection on attitudes toward Agile software development now current in the government workplace.
DOWNLOAD this volume is a reflection on attitudes toward agile software development now current in the government workplace. Acquisition,Agile 2016
Striving for Effective Cyber Workforce Development

September 12, 2016 • White Paper

By Marie Baker

This paper reviews the issue of cyber awareness and identify efforts to combat this deficiency and concludes with strategies moving forward.
DOWNLOAD this paper reviews the issue of cyber awareness and identify efforts to combat this deficiency and concludes with strategies moving forward. Cyber Workforce Development 2016
Segment-Fixed Priority Scheduling for Self-Suspending Real-Time Tasks

August 18, 2016 • Technical Report

By Ragunathan (Raj) Rajkumar , Dionisio de Niz , Bjorn Andersson , Junsung Kim , Jian-Jia Chen , Wen-Hung Huang , Geoffrey Nelissen

This report describes schedulability analyses and proposes segment-fixed priority scheduling for self-suspending tasks.
DOWNLOAD this report describes schedulability analyses and proposes segment-fixed priority scheduling for self-suspending tasks. Cyber-Physical Systems,Performance and Dependability 2016
Creating Centralized Reporting for Microsoft Host Protection Technologies: The Enhanced Mitigation Experience Toolkit (EMET)

August 18, 2016 • Technical Note

By Craig Lewis , Joseph Tammariello

This report describes how to set up a centralized reporting console for the Windows Enhanced Mitigation Experience Toolkit.
DOWNLOAD this report describes how to set up a centralized reporting console for the windows enhanced mitigation experience toolkit. 2016
The QUELCE Method: Using Change Drivers to Estimate Program Costs

August 17, 2016 • Technical Note

By Sarah Sheard

This technical note introduces Quantifying Uncertainty in Early Lifecycle Cost Estimation (QUELCE), a method for estimating program costs early in development.
DOWNLOAD this technical note introduces quantifying uncertainty in early lifecycle cost estimation (quelce), a method for estimating program costs early in development. Measurement and Analysis 2016
Blacklist Ecosystem Analysis: 2016 Update

August 15, 2016 • White Paper

By Eric Hatleback , Leigh B. Metcalf , Jonathan Spring

This white paper, which is the latest in a series of regular updates, builds upon the analysis of blacklists presented in our 2013 and 2014 reports.
DOWNLOAD this white paper, which is the latest in a series of regular updates, builds upon the analysis of blacklists presented in our 2013 and 2014 reports. Situational Awareness 2016
Architecture Fault Modeling and Analysis with the Error Model Annex, Version 2

June 22, 2016 • Technical Report

By Peter H. Feiler , Julien Delange , John J. Hudak , David P. Gluch

This report describes the Error Model Annex, Version 2 (EMV2), notation for architecture fault modeling, which supports safety, reliability, and security analyses.
DOWNLOAD this report describes the error model annex, version 2 (emv2), notation for architecture fault modeling, which supports safety, reliability, and security analyses. Software Architecture 2016
A Requirement Specification Language for AADL

June 22, 2016 • Technical Report

By Lutz Wrage , Julien Delange , Peter H. Feiler

This report describes a textual requirement specification language, called ReqSpec, for the Architecture Analysis & Design Language (AADL) and demonstrates its use.
DOWNLOAD this report describes a textual requirement specification language, called reqspec, for the architecture analysis & design language (aadl) and demonstrates its use. Software Architecture 2016
DMPL: Programming and Verifying Distributed Mixed-Synchrony and Mixed-Critical Software

June 21, 2016 • Technical Report

By Sagar Chaki , David Kyle

DMPL is a language for programming distributed real-time, mixed-criticality software. It supports distributed systems in which each node executes a set of periodic real-time threads that are scheduled by priority …
DOWNLOAD dmpl is a language for programming distributed real-time, mixed-criticality software. it supports distributed systems in which each node executes a set of periodic real-time threads that are scheduled by priority and criticality. Cyber-Physical Systems 2016
Wireless Emergency Alerts Commercial Mobile Service Provider (CMSP) Cybersecurity Guidelines

June 9, 2016 • Special Report

By Audrey J. Dorofee , Carol Woody , Christopher J. Alberts

This report provides members of the Commercial Mobile Service Provider (CMSP) community with practical guidance for better managing cybersecurity risk exposure, based on an SEI study of the CMSP element …
DOWNLOAD this report provides members of the commercial mobile service provider (cmsp) community with practical guidance for better managing cybersecurity risk exposure, based on an sei study of the cmsp element of the wireless emergency alert pipeline. Pervasive Mobile Computing 2016
Report Writer and Security Requirements Finder: User and Admin Manuals

June 7, 2016 • Special Report

By Nancy R. Mead , Anand Sankalp (Carnegie Mellon University) , Gupta Anurag (Carnegie Mellon) , Priyam Swati (Carnegie Mellon University) , Yaobin Wen (Carnegie Mellon University) , Walid El Baroni (Carnegie Mellon University)

This report presents instructions for using the Malware-driven Overlooked Requirements (MORE) website applications.
DOWNLOAD this report presents instructions for using the malware-driven overlooked requirements (more) website applications. Tools,Software Assurance,Reverse Engineering for Malware Analysis 2016
Applying the Goal-Question-Indicator-Metric (GQIM) Method to Perform Military Situational Analysis

May 23, 2016 • Technical Note

By Douglas Gray

This report describes how to use the goal-question-indicator-metric method in tandem with the military METT-TC method (mission, enemy, time, terrain, troops available, and civil-military considerations).
DOWNLOAD this report describes how to use the goal-question-indicator-metric method in tandem with the military mett-tc method (mission, enemy, time, terrain, troops available, and civil-military considerations). Cyber Risk and Resilience Management 2016
An Insider Threat Indicator Ontology

May 10, 2016 • Technical Report

By Michael J. Albrethsen , Samuel J. Perl , George Silowash , Daniel L. Costa , Derrick Spooner , Matthew L. Collins

This report presents an ontology for insider threat indicators, describes how the ontology was developed, and outlines the process by which it was validated.
DOWNLOAD this report presents an ontology for insider threat indicators, describes how the ontology was developed, and outlines the process by which it was validated. Insider Threat 2016
Using Honeynets and the Diamond Model for ICS Threat Analysis

May 6, 2016 • Technical Report

By John Kotheimer , Kyle O'Meara , Deana Shick

This report presents an approach to analyzing approximately 16 gigabytes of full packet capture data collected from an industrial control system honeynet—a network of seemingly vulnerable machines designed to lure …
DOWNLOAD this report presents an approach to analyzing approximately 16 gigabytes of full packet capture data collected from an industrial control system honeynet—a network of seemingly vulnerable machines designed to lure attackers. Security Vulnerabilities,Critical Infrastructure Protection,Enterprise Risk and Resilience Management 2016
2016 State of Cybercrime Survey

May 2, 2016 • White Paper

By None

This paper examines the current state of cybercrime and explores how organizations and individuals respond to cybercrime threats.
DOWNLOAD this paper examines the current state of cybercrime and explores how organizations and individuals respond to cybercrime threats. Insider Threat,Critical Infrastructure Protection,Cybersecurity 2016
The QUELCE Method: Using Change Drivers to Estimate Program Costs

April 19, 2016 • White Paper

By Sarah Sheard

This report introduces the Quantifying Uncertainty in Early Lifecycle Cost Estimation (QUELCE) method for estimating program costs early in a development lifecycle.
DOWNLOAD this report introduces the quantifying uncertainty in early lifecycle cost estimation (quelce) method for estimating program costs early in a development lifecycle. Measurement and Analysis 2016
A Unique Approach to Threat Analysis Mapping: A Malware-Centric Methodology

April 19, 2016 • Technical Report

By Deana Shick , Kyle O'Meara

As they constantly change network infrastructure, adversaries consistently use and update their tools. This report presents a way for researchers to begin threat analysis with those tools rather than with …
DOWNLOAD as they constantly change network infrastructure, adversaries consistently use and update their tools. this report presents a way for researchers to begin threat analysis with those tools rather than with network or incident data alone. Insider Threat 2016
On Board Diagnostics: Risks and Vulnerabilities of the Connected Vehicle

April 13, 2016 • White Paper

By Christopher King , Dan J. Klinedinst

This report describes cybersecurity risks and vulnerabilities in modern connected vehicles.
DOWNLOAD this report describes cybersecurity risks and vulnerabilities in modern connected vehicles. Security Vulnerabilities 2016
2016 Emerging Technology Domains Risk Survey

April 8, 2016 • Technical Report

By Todd Lewellen , Dan J. Klinedinst , Christopher King , Garret Wassermann

This 2016 report provides a snapshot of our current understanding of future technologies.
DOWNLOAD this 2016 report provides a snapshot of our current understanding of future technologies. Pervasive Mobile Computing,Cloud Computing 2016
Malware Capability Development Patterns Respond to Defenses: Two Case Studies

March 7, 2016 • White Paper

By Deana Shick , Kyle O'Meara , Jonathan Spring , Ed Stoner

In this paper, the authors describe their analysis of two case studies to outline the relationship between adversaries and network defenders.
DOWNLOAD in this paper, the authors describe their analysis of two case studies to outline the relationship between adversaries and network defenders. Reverse Engineering for Malware Analysis 2016
Cyber-Foraging for Improving Survivability of Mobile Systems

February 18, 2016 • Technical Report

By James Root , Ben W. Bradshaw , Grace Lewis , Sebastián Echeverría

This report presents an architecture and experimental results that demonstrate that cyber-foraging using tactical cloudlets increases the survivability of mobile systems.
DOWNLOAD this report presents an architecture and experimental results that demonstrate that cyber-foraging using tactical cloudlets increases the survivability of mobile systems. Pervasive Mobile Computing,Cloud Computing 2016
CERT-RMM Version 1.2 Release Notes

February 14, 2016 • White Paper

By None

This document contains the release notes for CERT-RMM Version 1.2, released February 2014.
DOWNLOAD this document contains the release notes for cert-rmm version 1.2, released february 2014. Cyber Risk and Resilience Management 2016
DoD Software Factbook

December 31, 2015 • White Paper

By David Zubrow , James McCurley , Brad Clark

This DoD Factbook is an initial analysis of software engineering data from the perspective of policy and management questions about software projects.
DOWNLOAD this dod factbook is an initial analysis of software engineering data from the perspective of policy and management questions about software projects. Acquisition,Best Practices,Measurement and Analysis 2015
Architecture-Led Safety Analysis of the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By Peter H. Feiler

This report summarizes an architecture-led safety analysis of the aircraft-survivability situation-awareness system for the Joint Multi-Role vertical lift program.
DOWNLOAD this report summarizes an architecture-led safety analysis of the aircraft-survivability situation-awareness system for the joint multi-role vertical lift program. Software Architecture 2015
Requirements and Architecture Specification of the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By Peter H. Feiler

This report describes a method for capturing information from requirements documents in AADL and the draft Requirement Definition & Analysis Language Annex.
DOWNLOAD this report describes a method for capturing information from requirements documents in aadl and the draft requirement definition & analysis language annex. Software Architecture 2015
Potential System Integration Issues in the Joint Multi-Role (JMR) Joint Common Architecture (JCA) Demonstration System

December 31, 2015 • Special Report

By Peter H. Feiler , John J. Hudak

This report describes a method for capturing information from requirements documents in AADL to identify potential integration problems early in system development.
DOWNLOAD this report describes a method for capturing information from requirements documents in aadl to identify potential integration problems early in system development. Software Architecture 2015
Extending AADL for Security Design Assurance of Cyber-Physical Systems

December 16, 2015 • Technical Report

By John J. Hudak , Robert J. Ellison , Carol Woody , Allen D. Householder , Rick Kazman

This report demonstrates the viability and limitations of using the Architecture Analysis and Design Language (AADL) through an extended example that allows for specifying and analyzing the security properties of …
DOWNLOAD this report demonstrates the viability and limitations of using the architecture analysis and design language (aadl) through an extended example that allows for specifying and analyzing the security properties of an automotive electronics system. Cyber-Physical Systems 2015
Cybersecurity Considerations for Vehicles

December 10, 2015 • White Paper

By Mark Sherman , Jens Palluch (Method Park)

In this paper the authors discuss the number of ECUs and software in modern vehicles and the need for cybersecurity to include vehicles.
DOWNLOAD in this paper the authors discuss the number of ecus and software in modern vehicles and the need for cybersecurity to include vehicles. Cybersecurity Engineering 2015
Analytic Approaches to Detect Insider Threats

December 9, 2015 • White Paper

By None

This paper identifies steps that organizations can use to enhance their security posture to detect potential insider threats.
DOWNLOAD this paper identifies steps that organizations can use to enhance their security posture to detect potential insider threats. Insider Threat 2015
Intelligence Preparation for Operational Resilience (IPOR)

December 7, 2015 • Special Report

By Douglas Gray

The author describes Intelligence Preparation for Operational Resilience (IPOR), a framework for preparing intelligence that complements commonly used intelligence frameworks such as Intelligence Preparation of the Battlefield (IPB).
DOWNLOAD the author describes intelligence preparation for operational resilience (ipor), a framework for preparing intelligence that complements commonly used intelligence frameworks such as intelligence preparation of the battlefield (ipb). Cyber Risk and Resilience Management 2015
Evaluating and Mitigating the Impact of Complexity in Software Models

December 3, 2015 • Technical Report

By John J. Hudak , Julien Delange , Bill Nichols , Jim McHale , Min-Young Nam

This report defines software complexity, metrics for complexity, and the effects of complexity on cost and presents an analysis tool to measure complexity in models.
DOWNLOAD this report defines software complexity, metrics for complexity, and the effects of complexity on cost and presents an analysis tool to measure complexity in models. Software Architecture 2015
Cyber + Culture Early Warning Study

November 30, 2015 • Special Report

By Char Sample

This study was designed to profile cyber actors, and to examine the time interval between cyber and kinetic events in order to gain greater insights into nation-state cyber responses to …
DOWNLOAD this study was designed to profile cyber actors, and to examine the time interval between cyber and kinetic events in order to gain greater insights into nation-state cyber responses to kinetic events. CERT/CC 2015
Effective Insider Threat Programs: Understanding and Avoiding Potential Pitfalls

October 16, 2015 • White Paper

By Matthew L. Collins , William E. Novak , Randall F. Trzeciak , Andrew P. Moore , Michael C. Theis

In this paper, the authors describe the potential ways an insider threat program (InTP) could go wrong and engage the community to discuss its concerns.
DOWNLOAD in this paper, the authors describe the potential ways an insider threat program (intp) could go wrong and engage the community to discuss its concerns. Insider Threat 2015
Structuring the Chief Information Security Officer Organization

October 6, 2015 • Technical Note

By David Tobar , Nader Mehravari , Julia H. Allen , Pamela D. Curtis , Gregory Crabb (United States Postal Service) , Brendan Fitzpatrick

The authors describe how they defined a CISO team structure and functions for a national organization using sources such as CISOs, policies, and lessons learned from cybersecurity incidents.
DOWNLOAD the authors describe how they defined a ciso team structure and functions for a national organization using sources such as cisos, policies, and lessons learned from cybersecurity incidents. Cyber Risk and Resilience Management 2015
Improving Federal Cybersecurity Governance Through Data-Driven Decision Making and Execution

September 16, 2015 • Technical Report

By Brian D. Wisniewski , Erik Ebel (Veris Group) , William Gulley (Veris Group) , Marie Vaughn (Veris Group) , Julia H. Allen , Robert W. Stoddard , Anne Connell , C. Aaron Cois , Douglas Gray , Michael Riley (Veris Group)

This technical report focuses on cybersecurity at the indirect, strategic level. It discusses how cybersecurity decision makers at the tactical or implementation level can establish a supportive contextual environment to …
DOWNLOAD this technical report focuses on cybersecurity at the indirect, strategic level. it discusses how cybersecurity decision makers at the tactical or implementation level can establish a supportive contextual environment to help enable their success. Cybersecurity Engineering,Governance 2015
Secure Coding Analysis of an AADL Code Generator's Runtime System

September 12, 2015 • White Paper

By David Keaton

This paper describes a secure coding analysis of the PolyORB-HI-C runtime system used by C language code output from the Ocarina AADL code generator.
DOWNLOAD this paper describes a secure coding analysis of the polyorb-hi-c runtime system used by c language code output from the ocarina aadl code generator. Cybersecurity Engineering 2015
Contracting for Agile Software Development in the Department of Defense: An Introduction

August 18, 2015 • Technical Note

By Eileen Wrubel , Jon Gross

This technical note addresses effective contracting for Agile software development and offers a primer on Agile based on a contracting officer's goals.
DOWNLOAD this technical note addresses effective contracting for agile software development and offers a primer on agile based on a contracting officer's goals. Acquisition,Agile 2015
CND Equities Strategy

July 22, 2015 • White Paper

By Ed Stoner , Jonathan Spring

In this paper, the authors discuss strategies for successful computer network defense (CND) based on considering the adversaries' responses.
DOWNLOAD in this paper, the authors discuss strategies for successful computer network defense (cnd) based on considering the adversaries' responses. CERT/CC,Security Vulnerabilities,Situational Awareness 2015
Comments on Bureau of Industry and Security (BIS) Proposed Rule Regarding Wassenaar Arrangement 2013 Plenary Agreements Implementation for Intrusion and Surveillance Items

July 22, 2015 • White Paper

By Art Manion , Allen D. Householder

In this paper, CERT researchers comment on the proposed rule, Wassenaar Arrangement 2013 Plenary Agreements Implementation: Intrusion and Surveillance Items.
DOWNLOAD in this paper, cert researchers comment on the proposed rule, wassenaar arrangement 2013 plenary agreements implementation: intrusion and surveillance items. Security Vulnerabilities 2015
Enabling Incremental Iterative Development at Scale: Quality Attribute Refinement and Allocation in Practice

June 4, 2015 • Technical Report

By Stephany Bellomo , Ipek Ozkaya , Robert Nord , Neil Ernst

This report describes industry practices used to develop business capabilities and suggests approaches to enable large-scale iterative development, or agile at scale.
DOWNLOAD this report describes industry practices used to develop business capabilities and suggests approaches to enable large-scale iterative development, or agile at scale. Software Architecture 2015
State of Practice Report: Essential Technical and Nontechnical Issues Related to Designing SoS Platform Architectures

May 13, 2015 • Technical Report

By John Klein , Sholom G. Cohen

This report analyzes the state of the practice in system-of-systems (SoS) development, based on 12 interviews of leading SoS developers in the DoD and industry.
DOWNLOAD this report analyzes the state of the practice in system-of-systems (sos) development, based on 12 interviews of leading sos developers in the dod and industry. System of Systems,Software Architecture 2015
Emerging Technology Domains Risk Survey

April 30, 2015 • Technical Note

By Jonathan Chu , Christopher King , Andrew O. Mellinger

This report provides a snapshot in time of our current understanding of future technologies.
DOWNLOAD this report provides a snapshot in time of our current understanding of future technologies. Cloud Computing,Pervasive Mobile Computing 2015
SCALe Analysis of JasPer Codebase

April 1, 2015 • White Paper

By David Svoboda

In this paper, David Svoboda provides the findings of a SCALe audit on a codebase.
DOWNLOAD in this paper, david svoboda provides the findings of a scale audit on a codebase. Secure Coding,Secure Development 2015
Model-Driven Engineering: Automatic Code Generation and Beyond

March 25, 2015 • Technical Note

By Harry L. Levinson , John Klein , Jay Marchetti

This report offers guidance on selecting, analyzing, and evaluating model-driven engineering tools for automatic code generation in acquired systems.
DOWNLOAD this report offers guidance on selecting, analyzing, and evaluating model-driven engineering tools for automatic code generation in acquired systems. Software Architecture,Acquisition 2015
Defining a Maturity Scale for Governing Operational Resilience

March 19, 2015 • Technical Note

By Katie C. Stewart , Julia H. Allen , Lisa R. Young , Michelle A. Valdez , Audrey J. Dorofee

Governing operational resilience requires the appropriate level of sponsorship, a commitment to strategic planning that includes resilience objectives, and proper oversight of operational resilience activities.
DOWNLOAD governing operational resilience requires the appropriate level of sponsorship, a commitment to strategic planning that includes resilience objectives, and proper oversight of operational resilience activities. Cyber Risk and Resilience Management 2015
SEI SPRUCE Project: Curating Recommended Practices for Software Producibility

March 16, 2015 • White Paper

By B. Craig Meyers , Bill Pollak , Mike Petock , Michael D. Konrad , Tamara Marshall-Keim , Gerald W. Miller

This paper describes the Systems and Software Producibility Collaboration Environment (SPRUCE) project and the resulting recommended practices on five software topics.
DOWNLOAD this paper describes the systems and software producibility collaboration environment (spruce) project and the resulting recommended practices on five software topics. Software Architecture,Measurement and Analysis,Cyber Risk and Resilience Management 2015
Improving Quality Using Architecture Fault Analysis with Confidence Arguments

March 10, 2015 • Technical Report

By John B. Goodenough , Neil Ernst , Julien Delange , Peter H. Feiler , Ari Z. Klein , Charles Weinstock

The case study shows that by combining an analytical approach with confidence maps, we can present a structured argument that system requirements have been met and problems in the design …
DOWNLOAD the case study shows that by combining an analytical approach with confidence maps, we can present a structured argument that system requirements have been met and problems in the design have been addressed adequately. Software Architecture 2015
Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets

March 4, 2015 • Technical Report

By William Snavely , Lori Flynn , William Klieber , Jonathan Burket , Jonathan Lim , Wei Shen

In this report, the authors describe how the DidFail tool was enhanced to improve its effectiveness.
DOWNLOAD in this report, the authors describe how the didfail tool was enhanced to improve its effectiveness. Secure Coding,Secure Development 2015
Eliminative Argumentation: A Basis for Arguing Confidence in System Properties

February 25, 2015 • Technical Report

By John B. Goodenough , Ari Z. Klein , Charles Weinstock

This report defines the concept of eliminative argumentation and provides a basis for assessing how much confidence one should have in an assurance case argument.
DOWNLOAD this report defines the concept of eliminative argumentation and provides a basis for assessing how much confidence one should have in an assurance case argument. Software Architecture,Software Assurance 2015
A Proven Method for Meeting Export Control Objectives in Postal and Shipping Sectors

February 10, 2015 • Technical Note

By Gregory Crabb (United States Postal Service) , Pamela D. Curtis , Nader Mehravari , Julia H. Allen

This report describes how the CERT-RMM enabled the USPIS to implement an innovative approach for achieving complex international mail export control objectives.
DOWNLOAD this report describes how the cert-rmm enabled the uspis to implement an innovative approach for achieving complex international mail export control objectives. Cyber Risk and Resilience Management 2015
Measuring What Matters Workshop Report

February 9, 2015 • Technical Note

By Julia H. Allen , Katie C. Stewart , Michelle A. Valdez , Lisa R. Young

This report describes the inaugural Measuring What Matters Workshop conducted in November 2014, and the team's experiences in planning and executing the workshop and identifying improvements for future offerings.
DOWNLOAD this report describes the inaugural measuring what matters workshop conducted in november 2014, and the team's experiences in planning and executing the workshop and identifying improvements for future offerings. Enterprise Risk and Resilience Management,Cyber Risk and Resilience Management 2015
A Dynamic Model of Sustainment Investment

February 5, 2015 • Technical Report

By Sarah Sheard , Mike Phillips , Robert Ferguson , Andrew P. Moore

This paper describes a dynamic sustainment model that shows how budgeting, allocation of resources, mission performance, and strategic planning are interrelated and how they affect each other over time.
DOWNLOAD this paper describes a dynamic sustainment model that shows how budgeting, allocation of resources, mission performance, and strategic planning are interrelated and how they affect each other over time. Process Improvement,Measurement and Analysis 2015
Cybersecurity Assurance

January 15, 2015 • White Paper

By None

This paper describes the SEI research and solutions that help organizations gain justified confidence in their cybersecurity posture.
DOWNLOAD this paper describes the sei research and solutions that help organizations gain justified confidence in their cybersecurity posture. Cybersecurity Engineering,Cybersecurity 2015
Blacklist Ecosystem Analysis Update: 2014

January 7, 2015 • White Paper

By Leigh B. Metcalf , Jonathan Spring

This white paper compares the contents of 85 different Internet blacklists to discover patterns in shared entries.
DOWNLOAD this white paper compares the contents of 85 different internet blacklists to discover patterns in shared entries. Situational Awareness 2015
Predicting Software Assurance Using Quality and Reliability Measures

December 22, 2014 • Technical Note

By Bill Nichols , Carol Woody , Robert J. Ellison

In this report, the authors discuss how a combination of software development and quality techniques can improve software security.
DOWNLOAD in this report, the authors discuss how a combination of software development and quality techniques can improve software security. Cybersecurity Engineering,Software Assurance,Measurement and Analysis 2014
Regional Use of Social Networking Tools

December 17, 2014 • Technical Report

By Kate Meeuf

This paper explores the regional use of social networking services (SNSs) to determine if participation with a subset of SNSs can be applied to identify a user's country of origin.
DOWNLOAD this paper explores the regional use of social networking services (snss) to determine if participation with a subset of snss can be applied to identify a user's country of origin. Situational Awareness 2014
Domain Parking: Not as Malicious as Expected

December 10, 2014 • White Paper

By Leigh B. Metcalf , Jonathan Spring

In this paper we discuss scalable detection methods for domain names parking on reserved IP address space, and then using this data set, evaluate whether this behavior appears to be …
DOWNLOAD in this paper we discuss scalable detection methods for domain names parking on reserved ip address space, and then using this data set, evaluate whether this behavior appears to be indicative of malicious behavior. Cybersecurity Engineering 2014
Pattern-Based Design of Insider Threat Programs

December 9, 2014 • Technical Note

By Dave Mundie , Andrew P. Moore , Robin Ruefle , Matthew L. Collins , David McIntire

In this report, the authors describe a pattern-based approach to designing insider threat programs that could provide a better defense against insider threats.
DOWNLOAD in this report, the authors describe a pattern-based approach to designing insider threat programs that could provide a better defense against insider threats. Insider Threat 2014
Introduction to the Security Engineering Risk Analysis (SERA) Framework

December 4, 2014 • Technical Note

By Audrey J. Dorofee , Christopher J. Alberts , Carol Woody

This report introduces the SERA Framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle.
DOWNLOAD this report introduces the sera framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle. Cybersecurity Engineering 2014
Using Malware Analysis to Tailor SQUARE for Mobile Platforms

November 18, 2014 • Technical Note

By Nancy R. Mead , Gregory Paul Alice

This technical note explores the development of security requirements for the K-9 Mail application, an open source email client for the Android operating system.
DOWNLOAD this technical note explores the development of security requirements for the k-9 mail application, an open source email client for the android operating system. Cybersecurity Engineering,Reverse Engineering for Malware Analysis 2014
A Method for Aligning Acquisition Strategies and Software Architectures

October 29, 2014 • Technical Note

By David J. Carney , Cecilia Albert , Patrick R. Place , Lisa Brownsword

This report describes the third year of the SEI's research into aligning acquisition strategies and software architecture.
DOWNLOAD this report describes the third year of the sei's research into aligning acquisition strategies and software architecture. Acquisition 2014
Agile Methods in Air Force Sustainment: Status and Outlook

October 23, 2014 • Technical Note

By Mary Ann Lapham , Stephen Beck , Eileen Wrubel , Michael S. Bandor , Colleen Regan

This paper examines using Agile techniques in the software sustainment arena—specifically Air Force programs. The intended audience is the staff of DoD programs and related personnel who intend to use …
DOWNLOAD this paper examines using agile techniques in the software sustainment arena—specifically air force programs. the intended audience is the staff of dod programs and related personnel who intend to use agile methods during software sustainment. Acquisition,Agile 2014
Development of an Intellectual Property Strategy: Research Notes to Support Department of Defense Programs

October 14, 2014 • Special Report

By Charlene Gross

This report is intended to help program managers understand categories of intellectual property, various intellectual property challenges, and approaches to assessing the license rights that the program needs for long-term …
DOWNLOAD this report is intended to help program managers understand categories of intellectual property, various intellectual property challenges, and approaches to assessing the license rights that the program needs for long-term execution and sustainment. Acquisition 2014
AADL Fault Modeling and Analysis Within an ARP4761 Safety Assessment

October 10, 2014 • Technical Report

By David P. Gluch , John J. Hudak , Julien Delange , Peter H. Feiler

This report describes how the Architecture Analysis and Design Language (AADL) Error Model Annex supports the safety-assessment methods in SAE Standard ARP4761.
DOWNLOAD this report describes how the architecture analysis and design language (aadl) error model annex supports the safety-assessment methods in sae standard arp4761. Software Architecture 2014
CERT Resilience Management Model—Mail-Specific Process Areas: International Mail Transportation (Version 1.0)

September 18, 2014 • Technical Note

By Julia H. Allen , Nader Mehravari , Gregory Crabb (United States Postal Service) , Pamela D. Curtis , Sam Lin , Dawn Wilkes

This report describes a new process area that ensures that international mail is transported according to Universal Postal Union standards.
DOWNLOAD this report describes a new process area that ensures that international mail is transported according to universal postal union standards. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
CERT Resilience Management Model—Mail-Specific Process Areas: Mail Revenue Assurance (Version 1.0)

September 18, 2014 • Technical Note

By Pamela D. Curtis , Gregory Crabb (United States Postal Service) , Nader Mehravari , Julia H. Allen , David W. White

This report describes a new process area that ensures that the USPS is compensated for mail that is accepted, transported, and delivered.
DOWNLOAD this report describes a new process area that ensures that the usps is compensated for mail that is accepted, transported, and delivered. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
CERT Resilience Management Model—Mail-Specific Process Areas: Mail Induction (Version 1.0)

September 18, 2014 • Technical Note

By David W. White , Julia H. Allen , Nader Mehravari , Pamela D. Curtis , Gregory Crabb (United States Postal Service)

This report describes a new process area that ensures that mail is inducted into the U.S. domestic mail stream according to USPS standards and requirements.
DOWNLOAD this report describes a new process area that ensures that mail is inducted into the u.s. domestic mail stream according to usps standards and requirements. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
Smart Collection and Storage Method for Network Traffic Data

September 15, 2014 • Technical Report

By Nathan Dell , Angela Horneman

This report discusses considerations and decisions to be made when designing a tiered network data storage solution.
DOWNLOAD this report discusses considerations and decisions to be made when designing a tiered network data storage solution. Situational Awareness 2014
A Systematic Approach for Assessing Workforce Readiness

August 18, 2014 • Technical Report

By Christopher J. Alberts , David McIntire

In this report, the authors present the Competency Lifecycle Roadmap and the readiness test development method, both used to maintain workforce readiness.
DOWNLOAD in this report, the authors present the competency lifecycle roadmap and the readiness test development method, both used to maintain workforce readiness. Incident Management 2014
Assuring Software Reliability

August 15, 2014 • Special Report

By Robert J. Ellison

This report describes ways to incorporate the analysis of the potential impact of software failures--regardless of their cause--into development and acquisition practices through the use of software assurance.
DOWNLOAD this report describes ways to incorporate the analysis of the potential impact of software failures--regardless of their cause--into development and acquisition practices through the use of software assurance. Acquisition 2014
Patterns and Practices for Future Architectures

August 15, 2014 • Technical Note

By Eric Werner , Scott McMillan , Jonathan Chu

This report discusses best practices and patterns that will make high-performance graph analytics on new and emerging architectures more accessible to users.
DOWNLOAD this report discusses best practices and patterns that will make high-performance graph analytics on new and emerging architectures more accessible to users. Ultra-Large-Scale Systems 2014
Abuse of Customer Premise Equipment and Recommended Actions

August 7, 2014 • White Paper

By Jonathan Spring , Paul Vixie , Chris Hallenbeck

In this paper, the authors provide recommendations for addressing problems related to poor management of Consumer Premise Equipment (CPE).
DOWNLOAD in this paper, the authors provide recommendations for addressing problems related to poor management of consumer premise equipment (cpe). Reverse Engineering for Malware Analysis,Security Vulnerabilities 2014
Performance of Compiler-Assisted Memory Safety Checking

July 31, 2014 • Technical Note

By David Keaton , Robert C. Seacord

This technical note describes the criteria for deploying a compiler-based memory safety checking tool and the performance that can be achieved with two such tools whose source code is freely …
DOWNLOAD this technical note describes the criteria for deploying a compiler-based memory safety checking tool and the performance that can be achieved with two such tools whose source code is freely available. Secure Coding,Secure Development 2014
Unintentional Insider Threats: A Review of Phishing and Malware Incidents by Economic Sector

July 18, 2014 • Technical Note

By CERT Insider Threat Team

This report analyzes unintentional insider threat cases of phishing and other social engineering attacks involving malware.
DOWNLOAD this report analyzes unintentional insider threat cases of phishing and other social engineering attacks involving malware. 2014
Evaluation of the Applicability of HTML5 for Mobile Applications in Resource-Constrained Edge Environments

July 2, 2014 • Technical Note

By Bryan Yan (Carnegie Mellon University – Institute for Software Research) , Grace Lewis

This technical note presents an analysis of the feasibility of using HTML5 for developing mobile applications, for "edge" environments where resources and connectivity are uncertain, such as in battlefield or …
DOWNLOAD this technical note presents an analysis of the feasibility of using html5 for developing mobile applications, for "edge" environments where resources and connectivity are uncertain, such as in battlefield or natural disaster situations. Pervasive Mobile Computing,Edge Computing 2014
Agile Software Teams: How They Engage with Systems Engineering on DoD Acquisition Programs

July 1, 2014 • Technical Note

By Mary Ann Lapham , Suzanne Miller , Eileen Wrubel , Timothy A. Chick

This technical note addresses issues with Agile software teams engaging systems engineering functions in developing and acquiring software-reliant systems.
DOWNLOAD this technical note addresses issues with agile software teams engaging systems engineering functions in developing and acquiring software-reliant systems. Acquisition,Agile 2014
Improving the Automated Detection and Analysis of Secure Coding Violations

June 27, 2014 • Technical Note

By Daniel Plakosh , Robert C. Seacord , Robert W. Stoddard , David Zubrow , David Svoboda

This technical note describes the accuracy analysis of the Source Code Analysis Laboratory (SCALe) tools and the characteristics of flagged coding violations.
DOWNLOAD this technical note describes the accuracy analysis of the source code analysis laboratory (scale) tools and the characteristics of flagged coding violations. Secure Coding,Secure Development 2014
CERT® Resilience Management Model (CERT®-RMM) V1.1: NIST Special Publication Crosswalk Version 2

June 11, 2014 • Technical Note

By Mary Popeck , Kevin G. Partridge , Lisa R. Young

This update to Version 1 of this same title (CMU/SEI-2011-TN-028) maps CERT-RMM process areas to certain NIST 800-series special publications.
DOWNLOAD this update to version 1 of this same title (cmu/sei-2011-tn-028) maps cert-rmm process areas to certain nist 800-series special publications. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2014
The Business Case for Systems Engineering: Comparison of Defense Domain and Non-defense Projects

June 10, 2014 • Special Report

By Dennis Goldenson , Joseph P. Elm

This report analyzes differences in systems-engineering activities for defense and non-defense projects and finds differences in both deployment and effectiveness.
DOWNLOAD this report analyzes differences in systems-engineering activities for defense and non-defense projects and finds differences in both deployment and effectiveness. Measurement and Analysis 2014
Job Analysis Results for Malicious-Code Reverse Engineers: A Case Study

June 3, 2014 • Technical Report

By Jennifer Cowley

This report describes individual and team factors that enable, encumber, or halt the development of malicious-code reverse engineering expertise.
DOWNLOAD this report describes individual and team factors that enable, encumber, or halt the development of malicious-code reverse engineering expertise. Cyber Risk and Resilience Management,Reverse Engineering for Malware Analysis,Science of Cybersecurity,Enterprise Risk and Resilience Management,Cyber Workforce Development 2014
An Introduction to the Mission Risk Diagnostic for Incident Management Capabilities (MRD-IMC)

May 30, 2014 • Technical Note

By Audrey J. Dorofee , Christopher J. Alberts , Robin Ruefle , Mark Zajicek

The Mission Risk Diagnostic for Incident Management Capabilities revises the Incident Management Mission Diagnostic Method with updated and expanded drivers.
DOWNLOAD the mission risk diagnostic for incident management capabilities revises the incident management mission diagnostic method with updated and expanded drivers. Incident Management,Cybersecurity Engineering,Incident Handling,Enterprise Risk and Resilience Management 2014
A Taxonomy of Operational Cyber Security Risks Version 2

May 21, 2014 • Technical Note

By James J. Cebula , Mary Popeck , Lisa R. Young

This second version of the 2010 report presents a taxonomy of operational cyber security risks and harmonizes it with other risk and security activities.
DOWNLOAD this second version of the 2010 report presents a taxonomy of operational cyber security risks and harmonizes it with other risk and security activities. OCTAVE,Insider Threat,Cybersecurity Engineering,Cyber Risk and Resilience Management 2014
An Evaluation of A-SQUARE for COTS Acquisition

May 13, 2014 • Technical Note

By Sidhartha Mani , Nancy R. Mead

An evaluation of the effectiveness of Software Quality Requirements Engineering for Acquisition (A-SQUARE) in a project to select a COTS product for the advanced metering infrastructure of a smart grid.
DOWNLOAD an evaluation of the effectiveness of software quality requirements engineering for acquisition (a-square) in a project to select a cots product for the advanced metering infrastructure of a smart grid. SQUARE,Cybersecurity Engineering 2014
Investigating Advanced Persistent Threat 1 (APT1)

May 12, 2014 • Technical Report

By Deana Shick , Angela Horneman

This report analyzes unclassified data sets in an attempt to understand APT1's middle infrastructure.
DOWNLOAD this report analyzes unclassified data sets in an attempt to understand apt1's middle infrastructure. Measurement and Analysis 2014
Precise Static Analysis of Taint Flow for Android Application Sets

May 9, 2014 • White Paper

By Amar S. Bhosale (No Affiliation)

This thesis describes a static taint analysis for Android that combines the FlowDroid and Epicc analyses to track inter- and intra-component data flow.
DOWNLOAD this thesis describes a static taint analysis for android that combines the flowdroid and epicc analyses to track inter- and intra-component data flow. Secure Development,Secure Coding 2014
Data-Driven Software Assurance: A Research Study

May 9, 2014 • Technical Report

By Julia L. Mullaney , Michael D. Konrad , Erin Harper , Art Manion , Bill Nichols , Andrew P. Moore , Michael F. Orlando

In 2012, Software Engineering Institute (SEI) researchers began investigating vulnerabilities reported to the SEI's CERT Division. A research project was launched to investigate design-related vulnerabilities and quantify their effects.
DOWNLOAD in 2012, software engineering institute (sei) researchers began investigating vulnerabilities reported to the sei's cert division. a research project was launched to investigate design-related vulnerabilities and quantify their effects. Software Assurance,Performance and Dependability,Process Improvement,Measurement and Analysis 2014
ALTernatives to Signatures (ALTS)

April 30, 2014 • White Paper

By George Jones , John Stogoski

This paper presents the results of a study of non-signature-based approaches to detecting malicious activity in computer network traffic.
DOWNLOAD this paper presents the results of a study of non-signature-based approaches to detecting malicious activity in computer network traffic. Situational Awareness,CERT/CC,Researcher,System Administrator 2014
Potential Use of Agile Methods in Selected DoD Acquisitions: Requirements Development and Management

April 29, 2014 • Technical Note

By Suzanne Miller , David J. Carney , Kenneth Nidiffer

This report explores issues that practitioners in the field who are actively adopting Agile methods have identified in our interviews about their experience in defining and managing requirements.
DOWNLOAD this report explores issues that practitioners in the field who are actively adopting agile methods have identified in our interviews about their experience in defining and managing requirements. Acquisition,Agile 2014
The Readiness & Fit Analysis: Is Your Organization Ready for Agile?

April 28, 2014 • White Paper

By Suzanne Miller

This paper summarizes the Readiness & Fit Analysis and describes its extension to support risk identification for organizations that are adopting agile methods.
DOWNLOAD this paper summarizes the readiness & fit analysis and describes its extension to support risk identification for organizations that are adopting agile methods. Acquisition,Agile 2014
International Implementation of Best Practices for Mitigating Insider Threat: Analyses for India and Germany

April 16, 2014 • Technical Report

By Lori Flynn , Randall F. Trzeciak , George Silowash , Palma Buttles-Valdez , Tracy Cassidy , Michael C. Theis , Carly L. Huth , Travis Wright (Carnegie Mellon University, Master of Science in Information Security Policy and Management Program)

This report analyzes insider threat mitigation in India and Germany, using the new framework for international cybersecurity analysis described in the paper titled “Best Practices Against Insider Threats in All …
DOWNLOAD this report analyzes insider threat mitigation in india and germany, using the new framework for international cybersecurity analysis described in the paper titled “best practices against insider threats in all nations.” Insider Threat 2014
Wireless Emergency Alerts (WEA) Cybersecurity Risk Management Strategy for Alert Originators

March 31, 2014 • Special Report

By The WEA Project Team

In this report, the authors describe a cybersecurity risk management (CSRM) strategy that alert originators can use throughout WEA adoption, operations, and sustainment, as well as a set of governance …
DOWNLOAD in this report, the authors describe a cybersecurity risk management (csrm) strategy that alert originators can use throughout wea adoption, operations, and sustainment, as well as a set of governance activities for developing a plan to execute the csrm. Enterprise Risk and Resilience Management,Cybersecurity Engineering 2014
Maximizing Trust in the Wireless Emergency Alerts (WEA) Service

February 28, 2014 • Special Report

By Carol Woody , Robert J. Ellison

This 2014 report presents recommendations for stakeholders of the Wireless Emergency Alerts (WEA) service that resulted from the development of two trust models, focusing on how to increase both alert …
DOWNLOAD this 2014 report presents recommendations for stakeholders of the wireless emergency alerts (wea) service that resulted from the development of two trust models, focusing on how to increase both alert originators' and the public's trust in wea. Measurement and Analysis 2014
Wireless Emergency Alerts: Trust Model Simulations

February 26, 2014 • Special Report

By Timothy Morrow , Robert W. Stoddard , Joseph P. Elm

This report presents four types of simulations run on the public trust model and the alert originator trust model developed for the Wireless Emergency Alerts (WEA) service, focusing on how …
DOWNLOAD this report presents four types of simulations run on the public trust model and the alert originator trust model developed for the wireless emergency alerts (wea) service, focusing on how to increase both alert originators' and the public's trust in wea. Measurement and Analysis 2014
Commercial Mobile Alert Service (CMAS) Alerting Pipeline Taxonomy

February 24, 2014 • Technical Report

By The WEA Project Team

This report presents the Commercial Mobile Alert Service (CMAS) Alerting Pipeline Taxonomy, a hierarchical classification that encompasses four elements of the alerting pipeline, to help stakeholders understand and reason about …
DOWNLOAD this report presents the commercial mobile alert service (cmas) alerting pipeline taxonomy, a hierarchical classification that encompasses four elements of the alerting pipeline, to help stakeholders understand and reason about required cmas operations. Software Architecture 2014
Best Practices in Wireless Emergency Alerts

February 19, 2014 • Special Report

By Elizabeth Trocki Stark (SRA International, Inc.) , Jennifer Lavan (SRA International, Inc.) , Joseph P. Elm , Rita C. Creel , Carol Woody , Christopher J. Alberts , Robert J. Ellison , Tamara Marshall-Keim , John McGregor

This report presents four best practices for the Wireless Emergency Alerts (WEA) service, including implementing WEA in a local jurisdiction, training emergency staff in using WEA, cross-jurisdictional governance of WEA, …
DOWNLOAD this report presents four best practices for the wireless emergency alerts (wea) service, including implementing wea in a local jurisdiction, training emergency staff in using wea, cross-jurisdictional governance of wea, and cybersecurity risk management. Enterprise Risk and Resilience Management,Cyber Risk and Resilience Management,Best Practices 2014
Study of Integration Strategy Considerations for Wireless Emergency Alerts

February 19, 2014 • Special Report

By The WEA Project Team

This report identifies key challenges and offers recommendations for alert originators navigating the process of adopting and integrating the Wireless Emergency Alerts (WEA) service into their emergency management systems.
DOWNLOAD this report identifies key challenges and offers recommendations for alert originators navigating the process of adopting and integrating the wireless emergency alerts (wea) service into their emergency management systems. Software Architecture,Enterprise Risk and Resilience Management 2014
Results in Relating Quality Attributes to Acquisition Strategies

February 4, 2014 • Technical Note

By David J. Carney , Patrick R. Place , Cecilia Albert , Lisa Brownsword

This technical note describes the second phase of a study that focuses on the relationships between software architecture and acquisition strategy -- more specifically, their alignment or misalignment.
DOWNLOAD this technical note describes the second phase of a study that focuses on the relationships between software architecture and acquisition strategy -- more specifically, their alignment or misalignment. Acquisition 2014
Agile Metrics: Progress Monitoring of Agile Contractors

January 27, 2014 • Technical Note

By Suzanne Miller , Mary Ann Lapham , Eileen Wrubel , Will Hayes , Timothy A. Chick

This technical note offers a reference for those working to oversee software development on the acquisition of major systems from developers using Agile methods.
DOWNLOAD this technical note offers a reference for those working to oversee software development on the acquisition of major systems from developers using agile methods. Agile 2014
Agile Methods and Request for Change (RFC): Observations from DoD Acquisition Programs

January 24, 2014 • Technical Note

By Michael S. Bandor , Eileen Wrubel , Mary Ann Lapham

This technical note looks at the evaluation and negotiation of technical proposals that reflect iterative development approaches that in turn leverage Agile methods.
DOWNLOAD this technical note looks at the evaluation and negotiation of technical proposals that reflect iterative development approaches that in turn leverage agile methods. Agile 2014
Unintentional Insider Threats: Social Engineering

January 21, 2014 • Technical Note

By CERT Insider Threat Center

In this report, the authors explore the unintentional insider threat (UIT) that derives from social engineering.
DOWNLOAD in this report, the authors explore the unintentional insider threat (uit) that derives from social engineering. Insider Threat 2014
Improving the Security and Resilience of U.S. Postal Service Mail Products and Services Using the CERT® Resilience Management Model

January 17, 2014 • Technical Note

By Julia H. Allen , Nader Mehravari , Pamela D. Curtis , Gregory Crabb (United States Postal Service)

In this report, the authors describe how to improve the resilience of U.S. Postal Service products and services
DOWNLOAD in this report, the authors describe how to improve the resilience of u.s. postal service products and services Cyber Risk and Resilience Management,Critical Infrastructure Protection,Resilience Management Model (RMM),Supply Chain Assurance 2014
A Proven Method for Identifying Security Gaps in International Postal and Transportation Critical Infrastructure

January 17, 2014 • Technical Note

By Gregory Crabb (United States Postal Service) , Pamela D. Curtis , Nader Mehravari , Julia H. Allen

In this report, the authors describe a method of identifying physical security gaps in international mail processing centers and similar facilities.
DOWNLOAD in this report, the authors describe a method of identifying physical security gaps in international mail processing centers and similar facilities. Cyber Risk and Resilience Management,Critical Infrastructure Protection,Supply Chain Assurance 2014
Cloud Service Provider Methods for Managing Insider Threats: Analysis Phase II, Expanded Analysis and Recommendations

January 8, 2014 • Technical Note

By Lori Flynn , Greg Porter (Heinz College at Carnegie Mellon University) , Chas DiFatta (No Affiliation)

In this report, the authors discuss the countermeasures that cloud service providers use and how they understand the risks posed by insiders.
DOWNLOAD in this report, the authors discuss the countermeasures that cloud service providers use and how they understand the risks posed by insiders. Insider Threat,Cloud Computing 2014
TSP Symposium 2013 Proceedings

January 8, 2014 • Special Report

By Fernanda Grazioli (Universidad de la República) , Silvana Moreno (Universidad de la República) , Diego Vallespir (Universidad de la República) , Sergio Cardona (Universidad del Quindío) , Leticia Pérez (Universidad de la República) , Rafael Rincón (Universidad EAFIT) , Mushtaq Raza (University of Porto) , Pedro C. Henriques (Strongstep – Innovation in Software Quality) , João Pascoal Faria (University of Porto) , Jim McHale , Bill Nichols

This special report contains proceedings of the 2013 TSP Symposium. The conference theme was “When Software Really Matters,” which explored the idea that when product quality is critical, high-quality practices …
DOWNLOAD this special report contains proceedings of the 2013 tsp symposium. the conference theme was “when software really matters,” which explored the idea that when product quality is critical, high-quality practices are the best way to achieve it. TSP Symposium 2014
Understanding Patterns for System-of-Systems Integration

December 17, 2013 • Technical Report

By Rick Kazman , Klaus Schmid , Claus Nielsen (No Affiliation)

This report discusses how a software architect can address the system-of-systems integration challenge from an architectural perspective.
DOWNLOAD this report discusses how a software architect can address the system-of-systems integration challenge from an architectural perspective. Software Architecture 2013
Foundations for Software Assurance

December 16, 2013 • White Paper

By Dan Shoemaker (University of Detroit Mercy) , Carol Woody , Nancy R. Mead

In this paper, the authors highlight efforts to address the principles of software assurance and its educational curriculum.
DOWNLOAD in this paper, the authors highlight efforts to address the principles of software assurance and its educational curriculum. Cybersecurity Engineering,Curricula,Educator,Executive,Software Assurance 2013
The Topological Properties of the Local Clustering Coefficient

December 9, 2013 • White Paper

By Leigh B. Metcalf

In this paper, Leigh Metcalf examines the local clustering coefficient for and provides a new formula to generate the local clustering coefficient.
DOWNLOAD in this paper, leigh metcalf examines the local clustering coefficient for and provides a new formula to generate the local clustering coefficient. Situational Awareness 2013
Using Software Development Tools and Practices in Acquisition

December 3, 2013 • Technical Note

By Harry L. Levinson , Richard Librizzi

This technical note provides an introduction to key automation and analysis techniques.
DOWNLOAD this technical note provides an introduction to key automation and analysis techniques. Acquisition 2013
Spotlight On: Programmers as Malicious Insiders–Updated and Revised

December 2, 2013 • White Paper

By Thomas C. Caron (John Heinz III College, School of Information Systems Management, Carnegie Mellon University) , Dawn Cappelli , Matthew L. Collins , Randall F. Trzeciak , Andrew P. Moore

In this paper, the authors describe the who, what, when, where, and how of attacks by insiders using programming techniques and includes case examples.
DOWNLOAD in this paper, the authors describe the who, what, when, where, and how of attacks by insiders using programming techniques and includes case examples. Insider Threat,Manager,System Administrator 2013
Software Assurance Measurement – State of the Practice

November 29, 2013 • Technical Note

By Nancy R. Mead , Dan Shoemaker (University of Detroit Mercy)

In this report, the authors describe the current state of the practice and emerging trends in software assurance measurement.
DOWNLOAD in this report, the authors describe the current state of the practice and emerging trends in software assurance measurement. Software Assurance,Measurement and Analysis 2013
A Defect Prioritization Method Based on the Risk Priority Number

November 26, 2013 • White Paper

By Julie B. Cohen , Will Hayes , Robert Ferguson

This paper describes a technique that helps organizations address and resolve conflicting views and create a better value system for defining releases.
DOWNLOAD this paper describes a technique that helps organizations address and resolve conflicting views and create a better value system for defining releases. Acquisition 2013
Agile Security - Review of Current Research and Pilot Usage

November 21, 2013 • White Paper

By Carol Woody

This white paper was produced to focus attention on the opportunities and challenges for embedding information assurance considerations into Agile development and acquisition.
DOWNLOAD this white paper was produced to focus attention on the opportunities and challenges for embedding information assurance considerations into agile development and acquisition. Acquisition 2013
Cloud Service Provider Methods for Managing Insider Threats: Analysis Phase I

November 15, 2013 • Technical Note

By Greg Porter (Heinz College at Carnegie Mellon University)

In this report, Greg Porter documents preliminary findings from interviews with cloud service providers on their insider threat controls.
DOWNLOAD in this report, greg porter documents preliminary findings from interviews with cloud service providers on their insider threat controls. Cloud Computing,Controls,Insider Threat 2013
Mobile SCALe: Rules and Analysis for Secure Java and Android Coding

November 8, 2013 • Technical Report

By Fred Long , Limin Jia (Carnegie Mellon University, Department of Electrical and Computer Engineering) , Lujo Bauer (Carnegie Mellon University, Department of Electrical and Computer Engineering) , William Klieber , Dean Sutherland , David Svoboda , Lori Flynn

In this report, the authors describe Android secure coding rules, guidelines, and static analysis developed as part of the Mobile SCALe project.
DOWNLOAD in this report, the authors describe android secure coding rules, guidelines, and static analysis developed as part of the mobile scale project. Secure Coding,Tools,Secure Development 2013
Advancing Cybersecurity Capability Measurement Using the CERT-RMM Maturity Indicator Level Scale

November 7, 2013 • Technical Note

By Matthew J. Butkovic , Richard A. Caralli

In this report, the authors review the specific and generic goals and practices in CERT-RMM to determine if a better scale could be developed.
DOWNLOAD in this report, the authors review the specific and generic goals and practices in cert-rmm to determine if a better scale could be developed. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2013
CERT® Resilience Management Model (CERT®-RMM) V1.1: NIST Special Publication 800-66 Crosswalk

October 28, 2013 • Technical Note

By Lisa R. Young , Ma-Nyahn Kromah (SunGard Availability Services)

In this report, the authors map CERT-RMM process areas to key activities in NIST Special Publication 800-66 Revision 1.
DOWNLOAD in this report, the authors map cert-rmm process areas to key activities in nist special publication 800-66 revision 1. Cyber Risk and Resilience Management,Resilience Management Model (RMM) 2013
Passive Detection of Misbehaving Name Servers

October 4, 2013 • Technical Report

By Leigh B. Metcalf , Jonathan Spring

In this report, the authors explore name-server flux and two types of data that can reveal it.
DOWNLOAD in this report, the authors explore name-server flux and two types of data that can reveal it. Situational Awareness 2013
Insider Threat Control: Using Plagiarism Detection Algorithms to Prevent Data Exfiltration in Near Real Time

October 3, 2013 • Technical Note

By Todd Lewellen , Daniel L. Costa , George Silowash

In this report, the authors describe how an insider threat control can monitor an organization's web request traffic for text-based data exfiltration.
DOWNLOAD in this report, the authors describe how an insider threat control can monitor an organization's web request traffic for text-based data exfiltration. Controls,Insider Threat 2013
Introduction to the Mission Thread Workshop

October 1, 2013 • Technical Report

By Timothy Morrow , Michael J. Gagliardi , William Wood

This report introduces the Mission Thread Workshop, a method for understanding architectural and engineering considerations for developing and sustaining systems of systems. It describes the three phases of the workshop …
DOWNLOAD this report introduces the mission thread workshop, a method for understanding architectural and engineering considerations for developing and sustaining systems of systems. it describes the three phases of the workshop and explains the steps of each. Tools,System of Systems,Software Architecture 2013
Parallel Worlds: Agile and Waterfall Differences and Similarities

October 1, 2013 • Technical Note

By Timothy A. Chick , Ipek Ozkaya , Suzanne Miller , Mary Ann Lapham , Steve Palmquist

This report helps readers understand Agile. The report assembles terms and concepts from both the traditional world of waterfall-based development and the Agile environment to show the many similarities and …
DOWNLOAD this report helps readers understand agile. the report assembles terms and concepts from both the traditional world of waterfall-based development and the agile environment to show the many similarities and differences. Acquisition,Agile 2013
Everything You Wanted to Know About Blacklists But Were Afraid to Ask

September 30, 2013 • White Paper

By Leigh B. Metcalf , Jonathan Spring

This document compares the contents of 25 different common public-internet blacklists in order to discover any patterns in the shared entries.
DOWNLOAD this document compares the contents of 25 different common public-internet blacklists in order to discover any patterns in the shared entries. Situational Awareness 2013
Roadmap to Software Assurance Competency

September 23, 2013 • White Paper

By None

This white paper describes the Software Assurance (SwA) Core Body of Knowledge and SwA competency levels.
DOWNLOAD this white paper describes the software assurance (swa) core body of knowledge and swa competency levels. Software Assurance,Curricula,software engineering and information assurance 2013
TSP Performance and Capability Evaluation (PACE): Customer Guide

September 1, 2013 • Special Report

By Mark Kasunic , Bill Nichols , Timothy A. Chick

This guide describes the evaluation process and lists the steps organizations and programs must complete to earn a TSP-PACE certification.
DOWNLOAD this guide describes the evaluation process and lists the steps organizations and programs must complete to earn a tsp-pace certification. Process Improvement,TSP 2013
TSP Performance and Capability Evaluation (PACE): Team Preparedness Guide

September 1, 2013 • Special Report

By Timothy A. Chick , Bill Nichols , Mark Kasunic

This document describes the TSP team data that teams normally produce and that are required as input to the TSP-PACE process.
DOWNLOAD this document describes the tsp team data that teams normally produce and that are required as input to the tsp-pace process. Process Improvement,TSP 2013
Best Practices Against Insider Threats in All Nations

August 27, 2013 • Technical Note

By Randall F. Trzeciak , Lori Flynn , Palma Buttles-Valdez , Carly L. Huth

In this report, the authors summarize best practices for mitigating insider threats in international contexts.
DOWNLOAD in this report, the authors summarize best practices for mitigating insider threats in international contexts. Best Practices,Insider Threat 2013
The Role of Computer Security Incident Response Teams in the Software Development Life Cycle

August 20, 2013 • White Paper

By Robin Ruefle

In this paper, Robin Ruefle describes how an incident management can provide input to the software development process.
DOWNLOAD in this paper, robin ruefle describes how an incident management can provide input to the software development process. Cybersecurity Engineering,Software Assurance 2013
State of Cyber Workforce Development

August 15, 2013 • White Paper

By Marie Baker

This paper summarizes the current posture of the cyber workforce and several initiatives designed to strengthen, grow, and retain cybersecurity professionals.
DOWNLOAD this paper summarizes the current posture of the cyber workforce and several initiatives designed to strengthen, grow, and retain cybersecurity professionals. Cyber Workforce Development 2013
Training and Awareness

August 7, 2013 • White Paper

By Carol Sledge , Ken Van Wyk (No Affiliation)

In this paper, the authors provide guidance on training and awareness opportunities in the field of software security.
DOWNLOAD in this paper, the authors provide guidance on training and awareness opportunities in the field of software security. Cybersecurity Engineering,Curricula,Software Assurance 2013
Evidence of Assurance: Laying the Foundation for a Credible Security Case

August 7, 2013 • White Paper

By Charles Weinstock , Howard F. Lipson

In this paper, the authors provide examples of several of the kinds of evidence that can contribute to a security case.
DOWNLOAD in this paper, the authors provide examples of several of the kinds of evidence that can contribute to a security case. Cybersecurity Engineering,Software Assurance 2013
Security and Project Management

August 6, 2013 • White Paper

By Robert J. Ellison

In this paper, Robert Ellison explains what project managers should consider because they relate to security needs.
DOWNLOAD in this paper, robert ellison explains what project managers should consider because they relate to security needs. Cybersecurity Engineering,Software Assurance 2013
An Evaluation of Cost-Benefit Using Security Requirements Prioritization Methods

August 5, 2013 • White Paper

By Nancy R. Mead , Travis Christian

In this paper, the authors provide background information on penetration testing processes and practices.
DOWNLOAD in this paper, the authors provide background information on penetration testing processes and practices. Cybersecurity Engineering,Software Assurance 2013
Unintentional Insider Threats: A Foundational Study

August 1, 2013 • Technical Note

By CERT Insider Threat Team

In this report, the CERT Insider Threat team examines unintentional insider threat (UIT), a largely unrecognized problem.
DOWNLOAD in this report, the cert insider threat team examines unintentional insider threat (uit), a largely unrecognized problem. Insider Threat,Science of Cybersecurity 2013
Teaching Security Requirements Engineering Using SQUARE

July 31, 2013 • White Paper

By Jeff Ingalsbe (University of Detroit Mercy) , Dan Shoemaker (University of Detroit Mercy) , Nancy R. Mead

In this paper, the authors detail the validation of a teaching model for security requirements engineering that ensures that security is built into software.
DOWNLOAD in this paper, the authors detail the validation of a teaching model for security requirements engineering that ensures that security is built into software. Curricula,Cybersecurity Engineering,Software Assurance 2013
Trustworthy Composition: The System Is Not Always the Sum of Its Parts

July 31, 2013 • White Paper

By Robert J. Ellison

In this paper, Robert Ellison surveys several profound technical problems faced by practitioners assembling and integrating secure and survivable systems.
DOWNLOAD in this paper, robert ellison surveys several profound technical problems faced by practitioners assembling and integrating secure and survivable systems. Cybersecurity Engineering,Software Assurance 2013

Software Engineering Institute

Technical Papers

Filter by

Assessing Opportunities for LLMs in Software Engineering and Acquisition

November 1, 2023 • White Paper

By Stephany Bellomo , Ipek Ozkaya , Julie B. Cohen , James Ivers , Shen Zhang

U.S. Leadership in Software Engineering & AI Engineering: Critical Needs & Priorities Workshop - Executive Summary

October 3, 2023 • White Paper

By Erin Harper , John E. Robert , Anita Carleton , Forrest Shull , Ipek Ozkaya , Douglas Schmidt (Vanderbilt University)

Simulating Realistic Human Activity Using Large Language Model Directives

October 2, 2023 • Technical Report

By Dustin D. Updyke , Thomas G. Podnar , Sean Huff

Why Your Software Cost Estimates Change Over Time and How DevSecOps Data Can Help Reduce Cost Risk

September 29, 2023 • White Paper

By Julie B. Cohen

A Retrospective in Engineering Large Language Models for National Security

September 29, 2023 • White Paper

By The Software Engineering Institute

A Holistic View of Architecture Definition, Evolution, and Analysis

August 24, 2023 • Technical Report

By Sebastián Echeverría , James Ivers , Rick Kazman

Emerging Technologies: Seven Themes Changing the Future of Software in the DoD

August 24, 2023 • White Paper

By Scott Hissam , Shen Zhang , Michael Abad-Santos

Demonstrating the Practical Utility and Limitations of ChatGPT Through Case Studies

August 23, 2023 • White Paper

By Clarence Worrell , Alejandro Gomez , Dominic A. Ross , Matthew Walsh

Software Excellence Through the Agile High Velocity Development℠ Process

July 17, 2023 • Technical Report

By Barti K. Perini (Ishpi Information Technologies, Inc.) , Stephen Shook (Ishpi Information Technologies, Inc.)

Coding the Future: Recommendations for Defense Software R&D

July 13, 2023 • White Paper

By None

Engineering of Edge Software Systems: A Report from the November 2022 SEI Workshop on Software Systems at the Edge

June 30, 2023 • White Paper

By Ipek Ozkaya , Grace Lewis , Kevin A. Pitstick

Software Bill of Materials Framework: Leveraging SBOMs for Risk Reduction

June 14, 2023 • White Paper

By Carol Woody , Christopher J. Alberts , Charles M. Wallen , Michael S. Bandor

Generative AI: Key Opportunities and Research Challenges

June 9, 2023 • White Paper

By None

Securing UEFI: An Underpinning Technology for Computing

May 30, 2023 • White Paper

By Vijay S. Sarvepalli

Using Model-Based Systems Engineering (MBSE) to Assure a DevSecOps Pipeline is Sufficiently Secure

May 23, 2023 • Technical Report

By Timothy A. Chick , Nataliya Shevchenko , Scott Pavetti

A Strategy for Component Product Lines: Report 2: Specification Modeling for Components in a Component Product Line

May 17, 2023 • Special Report

By Sholom G. Cohen , John McGregor , John J. Hudak

A Strategy for Component Product Lines: Report 3: Component Product Line Governance

May 4, 2023 • Special Report

By Alfred Schenker , Sholom G. Cohen

Program Managers—The DevSecOps Pipeline Can Provide Actionable Data

April 24, 2023 • White Paper

By Julie B. Cohen , Bill Nichols

Zero Trust Industry Day 2022: Areas of Future Research

January 25, 2023 • White Paper

By Timothy Morrow , Matthew Nicolai , Trista Polaski

Industry Best Practices for Zero Trust Architecture

December 13, 2022 • White Paper

By Matthew Nicolai , Timothy Morrow , Nathaniel Richmond

A Strategy for Component Product Lines: Report 1: Scoping, Objectives, and Rationale

December 8, 2022 • Special Report

By Alfred Schenker , John McGregor , Sholom G. Cohen , John J. Hudak , Gabriel Moreno

Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk

November 11, 2022 • Technical Note

By Charles M. Wallen , Michael S. Bandor , Christopher J. Alberts , Carol Woody

Zero Trust Industry Day Experience Paper

October 31, 2022 • White Paper

By Timothy Morrow , Rhonda Brown , Mary Popeck

Challenge Development Guidelines for Cybersecurity Competitions

October 27, 2022 • Technical Report

By Josh Hammerstein , Matt Kaar , Jarrett Booz , Joseph Vessella , Leena Arora , Dennis M. Allen

Acquisition Security Framework (ASF): An Acquisition and Supplier Perspective on Managing Software-Intensive Systems’ Cybersecurity Risk

October 4, 2022 • White Paper

By Charles M. Wallen , Michael S. Bandor , Carol Woody , Christopher J. Alberts

Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)

September 15, 2022 • Special Report