Software Engineering Institute (SEI) Webcast Series

Sound cyber intelligence practices can help organizations prevent or mitigate major security breaches. For several years, researchers at the SEI have been examining methodologies, processes, technology, and training to help organizations understand what it means to perform the work of cyber intelligence. To spur further development and advance understanding in this important area, the SEI launched the Cyber Intelligence Research Consortium, aimed at helping organizations make better judgments and quicker decisions related to cyber intelligence. The consortium's membership consists of practitioners and decision makers from multiple sectors, including government, energy, banking, defense contracting, and academia. At this webinar SEI practitioners will provide a detailed overview of the consortium's work during this inaugural year. Efforts for this year include how-to guides for navigating key analytical practices and technologies, tradecraft labs, and an in-person crisis simulation event. Webinar participants will also receive a guide for evaluating intelligence they can use in their own organizations.

Soldiers and front-line personnel operating in tactical environments increasingly make use of handheld devices to help with tasks such as face recognition, language translation, decision making, and mission planning. These resource-constrained edge environments are characterized by dynamic context, limited computing resources, high levels of stress, and intermittent network connectivity. Cyber-foraging leverages external resource-rich surrogates to augment the capabilities of resource-limited devices. In cloudlet-based cyber-foraging, resource-intensive computation and data are offloaded to cloudlets. Forward-deployed, discoverable, virtual-machine-based tactical cloudlets can be hosted on vehicles or other platforms to provide infrastructure to offload computation, provide forward data staging for a mission, perform data filtering to remove unnecessary data from streams intended for dismounted users, and serve as collection points for data heading for enterprise repositories. This webinar presents the tactical cloudlet concept and experimentation results for five different cloudlet provisioning mechanisms. The goal is to demonstrate that cyber-foraging in tactical environments is possible by moving cloud computing concepts and technologies closer to the edge so that tactical cloudlets, even if disconnected from the enterprise, can provide capabilities that enable enhanced situational awareness and decision making at the edge.

Most software systems have "defects" identified by users or developers. For most systems, it is too costly to fix all of the concerns in the near term, and indeed some issues may never be addressed. The government program office (or other procuring organization) has an obligation to choose wisely among a set of competing defects to be repaired, especially in a financially constrained environment. RPN can help by quantifying three distinct attributes of failure in a composite measure which helps to structure objective analysis and decision making. This webinar will explain the component used in RPN and how it can help a program select between competing defects to best utilize constrained resources to help lower overall system risk.

Safety-critical systems, such as those used in avionics and the medical and aerospace domains, are becoming increasingly reliant on software. Malfunctions in these systems can have significant consequences, including mission failure and loss of life. As a result, they must be designed, verified, and validated carefully to ensure that they comply with system specifications and requirements. A car contains many electronic control units (ECUs)—today's standard vehicles can contain up to 30 ECUs—that communicate to control systems such as airbag deployment, antilock brakes, and power steering. The design of tightly coupled software components distributed across so many nodes may introduce problems, such as early or late data delivery, loss of operation, or concurrent control of the same resource. In addition, errors introduced during the software design phase, such as mismatched timing requirements and values beyond boundaries, are propagated in the implementation and may not be caught by testing efforts. If these problems escape detection during testing, they can lead to serious errors and injuries. Also, because such systems are designed to be operational for many years, errors are often found when reviewing code from legacy systems designed and built more than 20 years ago and still operating, as in the avionics and aerospace domains. Unfortunately, late discovery of errors leads to major rework efforts and often postpones product delivery. Such issues are not specific to a particular domain and may occur in all in safety-critical systems. During the last 10 years, SEI researchers have been working on methods, languages, and tools to design safety-critical systems, find potential issues at the earliest phase in the development process, and avoid potential re-engineering efforts. Our techniques help system architects design the system and check requirements enforcement without having to implement the system. This webinar introduces the Architecture Analysis and Design Language (AADL), the architecture modeling language used to specify safety-critical systems. We show its use in the Open Source AADL Tool Environment (OSATE) to design and validate a generic automotive application—a speed-regulation system. In particular, this webinar will demonstrate analysis capabilities of the tool for different perspectives, including resources budgets, performance/latency, and safety.

On April 25, 2014, technical staff from the Software Engineering Institute (SEI) and Codenomicon participated in a live-streamed panel discussion on the impact of the Heartbleed OpenSSL vulnerability along with methods to mitigate and even prevent crises like this in the future. Chris Clark, Security Engineer from Codenomicon, one of the cybersecurity organizations that discovered the Heartbleed vulnerability, joined members of SEI's technical staff from the CERT and Software Solutions divisions and from the SEI's Information Technology department. They will be discussing how software vulnerabilities like Heartbleed can be mitigated through the different phases of the secure software lifecycle using techniques available today. They will also discuss how changes to our current software development and management techniques need to be managed to more effectively reduce the effects of incidents like Heartbleed.

Watch Ipek Ozkaya discuss "Why Should Government Care about Technical Debt and Software Architecture?" at the Agile for Government Summit. The purpose of this event was to: • foster better understanding of how agile software development methods are providing the basis for incremental and modular acquisition across Government, and • to discuss the changing technology of modern information-intensive businesses and the implications these have for evolving Government approaches to streamlining IT. This Summit is a partnership between the AFEI ADAPT and the Carnegie Mellon University Software Engineering Institute.

Watch Randy Trzeciak and David Mundie discuss an "Overview of the Threat Posed by Insiders to Critical Assets" from the virtual event Managing the Insider Threat: What Every Organization Should Know. About the Speaker(s) Randy Trzeciak is Technical Manager of CERT's Enterprise Threat and Vulnerability Management Team and the CERT Insider Threat Center at Carnegie Mellon University's Software Engineering Institute. The team's mission is to assist organizations in improving their security posture and incident response capability by researching technical threat areas, developing and conducting information security assessments, and providing information, solutions and training for preventing, detecting, and responding to illicit activity. David Mundie is a member of the CSIRT Development Team within the CERT® Program at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh, PA. He has been at CERT since 2000 and has worked in a variety of areas including insider threat, malware analysis, and incident management capability metrics. From 2006 to 2009, he was a member of the Q-CERT project, which established a national information security team for the country of Qatar.