Software Engineering Institute (SEI) Podcast Series

Software Engineering Institute (SEI) Podcast Series episodes:

• 04.04.2024

  Developing and Using a Software Bill of Materials Framework

  With the increasing complexity of software systems, the use of third-party components has become a widespread practice. Cyber disruptions, such as SolarWinds and Log4j, demonstrate the harm that can occur when organizations fail to manage third-party components in their software...

  
• 03.21.2024

  The Importance of Diversity in Cybersecurity: Carol Ware

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Carol Ware, a senior cybersecurity engineer in the SEI’s CERT Division, discusses her career path, the value of mentorship, and the importance of diversity in cybersecurity.

  
• 03.21.2024

  The Importance of Diversity in Software Engineering: Suzanne Miller

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Suzanne Miller, a principal researcher in the SEI’s Software Solutions Division, discusses her career path, the value of mentorship, and the importance of diversity in software engineering.

  
• 03.15.2024

  The Importance of Diversity in Artificial Intelligence: Violet Turri

  Across the globe, women account for less than 30 percent of professionals in technical fields. That number drops to 22 percent in the field of Artificial Intelligence (AI). In this podcast from the Carnegie Mellon University Software Engineering Institute...

  
• 03.14.2024

  The Importance of Diversity in Cybersecurity: Carol Ware

  In this podcst from the Carnegie Mellon University Software Engineering Institute (SEI), Carol Ware, a senior cybersecurity engineer in the SEI's CERT Division, discusses her career path, the value of mentorship, and the importance of diversity in cybersecurity.

  
• 02.16.2024

  Using Large Language Models in the National Security Realm

  At the request of the White House, the Office of the Director of National Intelligence (ODNI) began exploring use cases for large language models (LLMs) within the Intelligence Community (IC). As part of this effort, ODNI sponsored the...

  
• 02.09.2024

  Atypical Applications of Agile and DevSecOps Principles

  Modern software engineering practices of Agile and DevSecOps have provided a foundation for producing working software products faster and more reliably than ever before. Far too often, however, these practices do not address the non-software concerns of business mission and...

  
• 01.31.2024

  When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction

  Increasingly in government acquisition of software-intensive systems, we are seeing programs using Agile development methodology and earned value management. While there are many benefits to using both Agile and EVM, there are important considerations that software program managers must first...

  
• 01.24.2024

  The Impact of Architecture on Cyber-Physical Systems Safety

  As developers continue to build greater autonomy into cyber-physical systems (CPSs), such as unmanned aerial vehicles (UAVs) and automobiles, these systems aggregate data from an increasing number of sensors. However, more sensors not only create more data and more precise data, but...

  
• 12.14.2023

  ChatGPT and the Evolution of Large Language Models: A Deep Dive into 4 Transformative Case Studies

  To better understand the potential uses of large language models (LLMs) and their impact, a team of researchers at the Carnegie Mellon University Software Engineering Institute CERT Division conducted four in-depth case studies. The case studies span multiple domains and...

  
• 11.28.2023

  The Cybersecurity of Quantum Computing: 6 Areas of Research

  Research and development of quantum computers continues to grow at a rapid pace. The U.S. government alone spent more than $800 million on quantum information science research in 2022. Thomas Scanlon, who leads the data science group in the SEI...

  
• 11.16.2023

  User-Centric Metrics for Agile

  Far too often software programs continue to collect metrics for no other reason than that is how it has always been done. This leads to situations where, for any given environment, a metrics program is defined by a list of...

  
• 11.10.2023

  The Product Manager’s Evolving Role in Software and Systems Development

  In working with software and systems teams developing technical products, Judy Hwang, a senior software engineer in the SEI CERT Division, observed that teams were not investing the time, resources and effort required to manage the product lifecycle of...

  
• 10.12.2023

  Measuring the Trustworthiness of AI Systems

  The ability of artificial intelligence (AI) to partner with the software engineer, doctor, or warfighter depends on whether these end users trust the AI system to partner effectively with them and deliver the outcome promised. To build appropriate...

  
• 09.13.2023

  Actionable Data in the DevSecOps Pipeline

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Bill Nichols and Julie Cohen talk with Suzanne Miller about how automation within DevSecOps product-development pipelines provides new opportunities for program managers (PMs) to confidently make decisions with the...

  
• 09.08.2023

  Insider Risk Management in the Post-Pandemic Workplace

  In the wake of the COVID pandemic, the workforce decentralized and shifted toward remote and hybrid environments. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dan Costa, technical manager of enterprise threat and vulnerability...

  
• 08.09.2023

  An Agile Approach to Independent Verification and Validation

  Independent verification and validation (IV&V;) is a significant step in the process of deploying systems for mission-critical applications in the Department of Defense (DoD). In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Justin Smith, senior Agile...

  
• 07.26.2023

  Zero Trust Architecture: Best Practices Observed in Industry

  Zero trust architecture has the potential to improve an enterprise’s security posture. There is still considerable uncertainty about the zero trust transformation process, however, as well as how zero trust architecture will ultimately appear in practice. Recent executive orders have...

  
• 07.10.2023

  Automating Infrastructure as Code with Ansible and Molecule

  In Ansible, roles allow system administrators to automate the loading of certain variables, tasks, files, templates, and handlers based on a known file structure. Grouping content by roles allows for easy sharing and reuse. When developing roles, users must deal...

  
• 06.20.2023

  Identifying and Preventing the Next SolarWinds

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Gregory J. Touhill, director of the SEI CERT Division, talks with principal researcher Suzanne Miller about the 2020 attack on Solar Winds software and how to prevent a...

  
• 06.13.2023

  A Penetration Testing Findings Repository

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI)  Marisa Midler and Samantha Chaves, penetration testers with the SEI’s CERT Division, talk with Suzanne Miller about a penetration-testing repository that they helped to build. The repository...

  
• 06.08.2023

  Understanding Vulnerabilities in the Rust Programming Language

  While the memory safety and security features of the Rust programming language can be effective in many situations, Rust’s compiler is very particular on what constitutes good software design practices. Whenever design assumptions disagree with real-world data...

  
• 06.06.2023

  Rust Vulnerability Analysis and Maturity Challenges

  While the memory safety and security features of the Rust programming language can be effective in many situations, Rust’s compiler is very particular on what constitutes good software design practices. Whenever design assumptions disagree with real-world data and assumptions,...

  
• 05.18.2023

  We Live in Software: Engineering Societal-Scale Systems

  Societal-scale software systems, such as today’s commercial social media platforms, are among the most widely used software systems in the world, with some platforms reporting billions of daily active users. These systems have created new mechanisms for global communication and...

  
• 05.10.2023

  Secure by Design, Secure by Default

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI) Gregory J. Touhill, director of the SEI CERT Division, talks with Suzanne Miller about secure by design, secure by default, a longstanding tenet of the work of the SEI...

  
• 05.02.2023

  Key Steps to Integrate Secure by Design into Acquisition and Development

  Secure by design means performing more security and assurance activities earlier in the product and system lifecycles. A secure-by-design mindset addresses the security of systems during the requirements, design, and development phases of lifecycles rather than waiting until the system...

  
• 04.18.2023

  An Exploration of Enterprise Technical Debt

  Like all technical debt, enterprise technical debt consists of choices expedient in the short term, but often problematic over the long term. In enterprise technical debt, the impact reaches beyond the scope of a single system or project. Because ignoring...

  
• 03.29.2023

  The Messy Middle of Large Language Models

  The recent growth of applications that leverage large language models, including ChatGPT and Copilot, has spurred reactions ranging from fear and uncertainty to adoration and lofty expectations. In this podcast from the Carnegie Mellon University Software Engineering Institute, Jay Palat,...

  
• 03.21.2023

  An Infrastructure-Focused Framework for Adopting DevSecOps

  DevSecOps practices, including continuous-integration/continuous-delivery (CI/CD) pipelines, enable organizations to respond to security and reliability events quickly and efficiently and to produce resilient and secure software on a predictable schedule and budget. Despite growing evidence and recognition of the efficacy and...

  
• 03.15.2023

  Software Security in Rust

  Rust is growing in popularity. Its unique security model promises memory safety and concurrency safety, while providing the performance of C/C++. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), David Svoboda and Joe Sible, both engineers...

  
• 02.24.2023

  Improving Interoperability in Coordinated Vulnerability Disclosure with Vultron

  Coordinated vulnerability disclosure (CVD) begins when at least one individual becomes aware of a vulnerability, but it can’t proceed without the cooperation of many. Software supply chains, software libraries, and component vulnerabilities have evolved in complexity and have become...

  
• 02.07.2023

  Asking the Right Questions to Coordinate Security in the Supply Chain

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dr. Carol Woody, a principal researcher in the SEI's CERT Division, talks with Suzanne Miller about the SEI’s newly released Acquisition Security Framework, which helps programs coordinate the...

  
• 01.26.2023

  Securing Open Source Software in the DoD

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Scott Hissam, a researcher within the SEI’s Software Solutions Division who works on software assurance in Department of Defense (DoD) systems, talks with Linda Parker Gates, initiative lead...

  
• 12.13.2022

  A Model-Based Tool for Designing Safety-Critical Systems

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dr. Sam Procter and Lutz Wrage, researchers with the SEI, discuss the Guided Architecture Trade Space Explorer (GATSE), a new SEI-developed model-based tool to help with the design...

  
• 12.07.2022

  Managing Developer Velocity and System Security with DevSecOps

  In aiming for correctness and security of product, as well as for development speed, software development teams often face tension in their objectives. During a recent customer engagement that involved the development of a continuous-integration (CI) pipeline, developers wanted to...

  
• 12.07.2022

  Managing Developer Velocity and System Security with DevSecOps

  In aiming for correctness and security of product, as well as for development speed, software development teams often face tension in their objectives. During a recent customer engagement that involved the development of a continuous-integration (CI) pipeline, developers wanted to...

  
• 11.17.2022

  A Method for Assessing Cloud Adoption Risks

  The shift to a cloud environment provides significant benefits. Cloud resources can be scaled quickly, updated frequently, and widely accessed without geographic limitations. Realizing these benefits, however, requires organizations to manage associated organizational and technical risks. In this podcast from...

  
• 11.15.2022

  Software Architecture Patterns for Deployability

  Competitive pressures in many domains, as well as development paradigms such as Agile and DevSecOps, have led to the increasingly common practice of continuous delivery or continuous deployment where frequent updates to software systems are rapidly and reliably fielded. In...

  
• 10.13.2022

  ML-Driven Decision Making in Realistic Cyber Exercises

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Thomas Podnar and Dustin Updyke, both senior cybersecurity engineers with the SEI’s CERT Division, discuss their work to apply machine learning to increase the realism of non-player characters (NPCs)...

  
• 10.06.2022

  A Roadmap for Creating and Using Virtual Prototyping Software

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Douglass Post and Richard Kendall, authors of "Creating and Using Virtual Prototyping Software: Principles and Practices" discuss with principal researcher Suzanne Miller experiences and insights that they gleaned from...

  
• 09.23.2022

  A Roadmap for Creating and Using Virtual Prototyping Software

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Douglass Post and Richard Kendall, authors of Creating and Using Virtual Prototyping Software: Principles, and Practices, discuss with SEI principal researcher Suzanne Miller experiences and insights that they...

  
• 09.15.2022

  Software Architecture Patterns for Robustness

  In this podcast from the Carnegie Mellon University Software Engineering Institute, visiting scientist Rick Kazman and principal researcher Suzanne Miller discuss software architecture patterns and the effect that certain architectural patterns have on quality attributes, such as availability and robustness....

  
• 09.08.2022

  A Platform-Independent Model for DevSecOps

  DevSecOps encompasses all the best software engineering principles known today with an emphasis on faster delivery through increased collaboration of all stakeholders resulting in more secure, useable, and higher-quality software systems. In this podcast from the Carnegie Mellon University Software...

  
• 08.18.2022

  Using the Quantum Approximate Optimization Algorithm (QAOA) to Solve Binary-Variable Optimization Problems

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Jason Larkin and Daniel Justice, researchers in the SEI’s AI Division, discuss a paper outlining their efforts to simulate the performance of Quantum Approximate Optimization Algorithm (QAOA) for the...

  
• 08.05.2022

  Trust and AI Systems

  To ensure trust, artificial intelligence systems need to be built with fairness, accountability, and transparency at each step of the development cycle. In this podcast from the Carnegie Mellon University Software Engineering Institute, Carol Smith, a senior research scientist in...

  
• 07.28.2022

  A Dive into Deepfakes

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Shannon Gallagher, a data scientist with SEI’s CERT Division, and Dominic Ross, multimedia team lead for the SEI, discuss deepfakes, their exponential growth in recent years, their increasing...

  
• 07.13.2022

  Challenges and Metrics in Digital Engineering

  Digital engineering uses digital tools and representations in the process of developing, sustaining, and maintaining systems, including requirements, design, analysis, implementation, and test. The digital modeling approach is intended to establish an authoritative source of truth for the system, in...

  
• 07.05.2022

  The 4 Phases of the Zero Trust Journey

  Over the past several years, zero trust architecture has emerged as an important topic within the field of cybersecurity. Heightened federal requirements and pandemic-related challenges have accelerated the timeline for zero trust adoption within the federal sector. Private sector organizations...

  
• 06.21.2022

  DevSecOps for AI Engineering

  In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Hasan Yasar, technical director, Continuous Deployment of Capability at the SEI, and Jay Palat, interim director of AI for Mission in the SEI’s AI Division, discuss how to...

  
• 06.02.2022

  Undiscovered Vulnerabilities: Not Just for Critical Software

  In this podcast from the Carnegie Mellon University Software Engineering Institute, Jonathan Spring, a senior vulnerability researcher, discusses with Suzanne Miller the findings in a paper he published recently analyzing the number of ...