Software Engineering Institute (SEI) Webcast Series

In 2011, the Office of Management and Budget (OMB) issued the "Cloud First" policy to reform federal information technology management, which required agencies to evaluate cloud computing options. In 2012, the DoD Cloud Computing Strategy evolved to identify the most effective ways for the department to capitalize on opportunities and take advantage of cloud computing benefits that accelerate IT delivery, efficiency, and innovation as an enterprise. In the years since, many cloud transition efforts in both federal agencies and the DoD have experienced significant issues. This webinar will address a few of the causes for the transition issues, as well as identify some practices that will assist organizations as they plan to transition assets and capabilities to the cloud. The webinar will wrap up with a brief discussion of the 2019 Federal Cloud Computing Strategy – Cloud Smart, an updated cloud policy to improve cloud adoption for federal agencies developed by OMB.

As every software engineer knows, writing secure software is an incredibly difficult task. There are many techniques available to assist developers in finding bugs hiding in their code, but none are perfect, and an adversary only needs one to cause problems. In this talk, we'll discuss how a branch of artificial intelligence called Natural Language Processing, or NLP, is being applied to computer code. Using NLP, we can find bugs that aren't visible to existing techniques, and we can start to understand better what our computers are creating. While this field is still young, advances are coming rapidly, and we talk about the current state of the art and what we expect to see in the near future.

Today's DoD software development and deployment is not responsive to warfighter needs. As a result, the DoD's ability to keep pace with potential adversaries is falling behind. In this webcast, panelists discuss potential enablers of and barriers to using modern software development techniques and processes in the DoD or similar segregated environments. These software development techniques and processes are as commonly known as DevSecOps.

In 2017, the Software Engineering Institute (SEI) Webcast, What Makes a Good Software Architect? (https://www.youtube.com/watch?v=CbLJC...) explored the skills and knowledge needed by successful software architects. The architect's role continues to evolve; in this webcast we revisited the question in the context of today's role and responsibilities. We explored the challenges of working in an environment with rapidly evolving technology options, such as the serverless architecture style, and the role of the architect in Agile organizations using DevSecOps and Agile architecture practices to shorten iterations and deliver software faster.

Cybersecurity operators have to keep up with a world that's constantly changing, and they may lack the tools, time, and access to learn how to face actual threats. Simulated environments may not appear or behave the way they do in real life, and classroom-based approaches don't provide the big picture. Throughout this talk, our team of researchers and engineers discuss the solutions we developed to help achieve a new level of realism in simulated cyber environments. Specific solutions include better Internet emulation, improved live network traffic, and human-like behavior of host systems. This set of tools recreates the real world in a controlled environment, providing the platform where cyber operators can enhance their security skills.

Attendees will learn how to

• enhance a bare-bones, cyber-emulation environment using open source tools • provide the best training possible by simulating your own networks so that employees can learn how to respond to real-world threats • get help from the SEI to implement these tools in your own environment

In this webcast, Lori Flynn, a CERT senior software security researcher, describes the new features in SCALe v3, a research prototype tool. SCALe v2, available on GitHub, offers a subset of features available in SCALe v3. Over the last three years, as part of alert classification and prioritization research projects she has led, her team has added new features to the (privately released) 2015 version of SCALe (v1) that are intended to assist with automated static analysis alert classification and advanced alert prioritization. Flynn invites people in other organizations to collaborate with her team, including testing SCALe v3 and providing sanitized audit archives. Collaborators also might have an opportunity to become involved in developing a version of SCALe that would be usable in production, not just as a research prototype tool.

In this webcast, we explain how the technology works and what makes it fundamentally different than its predecessors. We discuss where it fits (and where it doesn't fit) and help set a rubric to help you determine if you need this technology.