SEI Shorts: Recent Episodes
Members of Technical Staff at the Software Engineering Institute
In these short videos, experts from the Software Engineering Institute (SEI) deliver informative snapshots of our latest research on the changing world of all things cyber. The SEI is a federally funded research and development center sponsored by the U.S. Department of Defense and operated by Carnegie Mellon University.
In this SEI Cyber Minute, Alex Corn discusses how to protect systems using Secure Shell (SSH). SSH supports keys, which provide efficiency and security benefits.
In this SEI Cyber Minute, Bobbie Stempfley explains how in our increasingly complex world, the SEI is redefining approaches to security to address the transformative technologies being adopted throughout government and industry.
In this SEI Cyber Minute, Suzanne Miller explains a pitfall that can occur when trying to use Agile and Lean methods when developing and implementing complex, embedded systems. In such projects, development traditionally proceeds in a model shaped like a “V,” where the completion of requirements definition, architecture, and design occurs along the left branch of the “V” and leads to implementation at the bottom point. Then, the right branch of the “V” represents verification and validation activities. The difficulty is that these projects usually reap the benefits of the iterative, incremental aspects of Agile development only during implementation, after requirements, architecture, and design work are deemed to be finished. At that point, it becomes difficult to apply the lessons learned during implementation and to make necessary changes to the work that occurred before implementation began. Suzanne Miller explains the dynamics of this pitfall, and she describes a more agile and responsive mindset that teams can use to make sure they reap the benefits of Agile and lean approaches throughout development. In addition, she shares reference material that can help interested parties learn more.
September 2019 has been designated “National Insider Threat Awareness Month.” A number of federal agencies—including the FBI, Office of the Under Secretary of Defense for Intelligence, and Department of Homeland Security—have chosen September to spotlight the risks that insiders pose to national security.
Since 2001, the SEI’s CERT Division has been helping government, industry, and academic entities identify and mitigate insider threats. The CERT Division’s research spans multiple domains, from the technical, including an exploration of tool sets for insider threat programs, to the behavioral and organizational, including a study on positive incentives for reducing insider threat in the workplace.
Static analysis (SA) alerts about software code flaws require costly manual effort to validate (e.g., determine True or False) and repair. As a result, organizations often severely limit the types of alerts they manually examine to the types of code flaws they most worry about. That approach results in a tradeoff where many True flaws may never get fixed. To make alert handling more efficient, the SEI developed and tested novel software that enables the rapid deployment of a method to classify alerts automatically and accurately. We are implementing our solution in a new version of the SEI’s SCALe – the Source Code Analysis Lab – application.
In this SEI Cyber Minute, Ebonie McNeil explains how the Source Code Analysis Integrated Framework Environment or (SCAIFE) prototype is intended to be used by developers and analysts who manually audit alerts.
SCAIFE provides automatic alert classification using machine learning which gives a level of confidence that the alert is true or false.
The SCAIFE prototype also enables organizations to apply formulas that prioritize static analysis alerts by using factors they care about.
Threat-modeling methods provide an approach for identifying possible threats to a system and mitigating them. In this SEI Cyber Minute, Chris Alberts discusses the Security Engineering Risk Analysis (SERA) Method and the threats and risks that organizations can use it to model and plan for. In addition, Chris discusses the threat-modeling methods the SEI recently integrated into the SERA Method.
Chuck Weinstock introduces confidence maps and explains how they work to determine how much confidence someone can have in a claim.
Confidence maps collect arguments or doubts about a claim, to which one can then apply a process of elimination to establish how much confidence someone can have that the claim is true. This SEI Cyber Minute gives an example that provides a practical explanation of the information that confidence maps take into consideration and how they work. It also provides a few examples of how the SEI has used them in the past to support certain projects.
Elli Kanal describes the work that the SEI does to train computers to learn about stored content and find pertinent information without the help of an analyst.
The Software Engineering Institute (SEI) works on projects that help computers (1) learn about the content that they store and (2) find pertinent information based on what they learn. One particular SEI project involves teaching computers to find clues in specification documents that can lead to the discovery of vulnerabilities without the help of analysts. This SEI Cyber Minute provides a quick overview of these kinds of projects and gives you information about how you can contact the SEI to collaborate on them.
At the SEI, we built an implementation of tactical cloudlets that we call KD-Cloudlet. Soldiers, emergency workers, field researchers, medics – really anyone who needs to be a cyber forager for computing resources -- can now use KD-Cloudlet to support mobile applications that:
•contain computation-intensive code
•collect large amounts of data in the field, or
•use large amounts of data in the cloud
KD-Cloudlet is freely available on GitHub: https://github.com/SEI-AMS/pycloud/
The SEI has conducted research on the issues associated with sustaining legacy systems and migrating them, such as trying to sustain a system when there is a lack of documentation and minimal Infrastructure as Code. This SEI Cyber Minute describes a prototype that the SEI has developed in light of this research and how it functions to generate code that can be used by Infrastructure as Code tools to help organizations sustain and migrate their systems.
Suzanne Miller discusses why the use of Agile methods can vary so much from one contractor to another.
Because the Agile methodology is based on a set of principles, contractors sometimes apply Agile methods differently depending on the scope and nature of the work they’re doing. This SEI Cyber Minute explains why these variations occur when practicing Agile methods, and it discusses current work that aims to help organizations establish which variations of Agile are most useful and appropriate in government settings.
Mary Catherine Ward explains the unique work that the SEI does for the Department of Defense as a federally funded research and development center (FFRDC). Federally funded research and development centers (FFRDCs) perform research to meet the specialized needs of the U.S. government.
The SEI is an FFRDC sponsored by the Department of Defense and housed at Carnegie Mellon University. This SEI Cyber Minute explains the work that FFRDCs do for the government and how the SEI is unique in its support of the Department of Defense.
Self-driving cars, drones, or missiles that use computer systems to interact with the physical world are examples of cyber-physical systems. As these systems become more complex and unpredictable, establishing confidence that they work correctly becomes challenging. To address these challenges, the Software Solutions Division of the SEI conducted research to develop programs that focus on enforcing that cyber-physical systems perform only safe actions. This SEI Cyber Minute explains how these programs work to prevent cyber-physical systems from violating their safety conditions, and how use of these programs can reduce development time and cost.
Eileen Wrubel discusses getting your agile program started.
Agile relies on small batches of work and fast learning cycles, instead of specifying extensive big-batch requirements up front. Programs need to extend this thinking beyond the software they are building, to the development and acquisition processes themselves.
Alex Corn discusses how cross-origin resource sharing (CORS) works to resolve network problems caused by same-origin policy, and how it should be configured.
Same-origin policy is a feature of modern web browsers that restricts scripts hosted on one website from making calls to another website. While useful from a security perspective, this policy can restrict certain legitimate use cases in which there is no security threat. The best solution to allow those legitimate cases to function properly is to employ cross-origin resource sharing (CORS). This Cyber Minute discusses how CORS works and how it should be configured to avoid risk.
Watch Mark Sherman in this SEI Cyber Minute as he discusses "Influence Attacks on Machine Learning".
Shane Ficorilli explains some of the requirements for successfully implementing DevOps in your organization, including how to establish a complete deployment pipeline.
Watch Bob Schiela and Jeff Boleng discuss "Where dynamic and static code analysis merge".
Watch Bob Schiela discuss "Why aren’t DoD Programs using static analysis as commercial firms do?"
Eliezer Kanal explains deep learning, a subfield of artificial intelligence, and how the SEI is conducting research to learn how it might be used to advance cybersecurity.
Watch SEI Researchers Andrew Kotov and John Klein respond to "Should a software architect be concerned with risk analysis?"
Watch Bob Schiela and Jeff Boleng discuss "How can automated code repair help DoD with legacy code vulnerability analysis?
Watch SEI Researchers Andrew Kotov and John Klein respond to "How do you integrate software architecture into Agile/DevOps environments?"
Here at the Software Engineering Institute, we have created a new tool prototype that helps explore a system’s design tradespace. The tradespace is the possible combinations of system software, hardware, and configuration options. Our prototype – which combines previous work here at the SEI with software developed at Penn State University – enables system designers to evaluate design options in the tradespace rapidly and automatically. You can find more on guided design tradespace exploration in these SEI resources: SEI Cyber Minutes video • Safety-Critical Design by Shopping https://www.youtube.com/watch?v=M8hcV... Poster • Guided Architecture Trade Space Exploration for Safety-Critical Software Systems -- https://resources.sei.cmu.edu/library... Blog • AADL: Four Real-World Perspectives -- https://insights.sei.cmu.edu/sei_blog... real-world-perspectives.htmlhttps://insights.sei.cmu.edu/sei_blog... moving-cloud-computing-to-the-edge.html
Pat Place discusses the forces that influence how often your organization is able to perform system updates.
Manually fixing coding errors is time- and money-consuming. As a result, teams charged to make the fixes can eliminate few vulnerabilities; and fixing errors often breaks the working code, adding unwanted delay in testing. The SEI has developed a tool to detect and automatically repair integer overflow and reads of stale sensitive data, two pervasive software flaws. You can find more on SEI’s technique for automated code repair in “Inference of Memory Bounds: Preventing the Next Heartbleed” at https://insights.sei.cmu.edu/sei_blog....
For more information, write to info@sei.cmu.edu.
Watch Hasan Yasar discuss how to "Build Secure Applications with DevSecOps." DevSecOps is a model on integrating the software development and operational process that considers security activities throughout DevOps pipeline with practicing collaboration and communication between software development teams , IT operations staff along with acquirers, suppliers, security teams, and other stakeholders in the lifecycle of a software system.
Rob Cunningham discusses the promise of Quantum Computing and highlights some of the remaining scientific and engineering challenges.
Watch SuZ Miller discuss four things for government acquisition agents to include or watch for as they prepare a request for proposal that will attract bidders who work using Agile and lean principles.
Malfaces from the Software Engineering Institute is a two-tool process that visualizes similarities between malware input files. The first tool uses binary code comparison techniques and a transform function to determine which input files match. Then, using statistical analysis, the second tool draws Chernoff faces for each file and delivers an estimate of how many unique programs are in the input files set. Together, these tools reduce file analysis to a differential analysis task—saving time and money in reverse engineering after a cyber incident. You can find more on the Malfaces concept in “This Malware Looks Familiar: Laymen Identify Malware Run-time Similarity with Chernoff faces and Stick Figures” at http://eudl.eu/doi/10.4108/eai.22-3-2017.152417
Alex Corn describes how SQL injection can occur and how you can prevent attackers from exploiting these potentially serious vulnerabilities.
SQL injection vulnerabilities are common, and attackers can use them to carry out harmful attacks. This SEI Cyber Minute explains how these attacks can be prevented by using database abstraction libraries or prepared statements.
Watch Luiz Antunes in this SEI Cyber Minute as he discusses "DevOps Metrics & Visualizations".
Watch SuZ Miller in this SEI Cyber Minute as she discusses "Interruption Costs" in the development process.
The SEI has launched the “CERT Cybersecurity Engineering and Software Assurance Professional Certificate” program. This program addresses the growing need to educate the current workforce to make good cybersecurity choices.
Watch Douglas Reynolds in this SEI Cyber Minute as he discusses "Secure DevOps: Managing Your FOSS Dependencies."
Are you Preparing for IPv6 Enterprise Deployment? Be sure to watch this SEI Cyber Minute.
Our team is conducting research to describe and quantify the acquisition “game” being played using modeling and simulation to frame the misaligned incentives.
Our team is developing a new prototype tool to help soldiers identify and exploit cyber opportunities in the physical environment.
Here at the Software Engineering Institute, we have created a new tool prototype that automatically explores a system's design trade space; that is, its possible combinations of system software, hardware, and configuration options.
By considering dynamic information in conjunction with static information, we can precisely locate such design flaws, and determine the root causes of bugs more quickly.
Good cyber intelligence practices—those that help you see the big picture—can prevent costly security breaches and help safeguard valuable assets and information.
The SEI Source Code Analysis Lab (SCALe) gives analysts the ability to focus on the most critical alerts from static analysis.
Watch April Galyardt in this SEI Cyber Minute as she discusses "Assessing the Skills of Cyber Operatives".
This research will help ensure the security and effectiveness of IoT devices in tactical environments.
By creating a secure-by-design language that renders certain types of bugs impossible to create, we aim to significantly reduce the risk inherent in the adoption of blockchain technology.
Watch Will Klieber in this SEI Cyber Minute as he discusses "Inference of Memory Bounds: Preventing the Next Heartbleed".
Watch Jeff Gennari in this SEI Cyber Minute as he discusses "Automated Reverse Engineering with Pharos."
Unfortunately, where there is software, there are risks from vulnerabilities. In response, the Department of Defense has recently expanded the key document governing acquisition, 5000.02.
At the SEI, we are developing tools, techniques, and tutorials to help developers make autonomous systems that are dependable and predictable while preserving core system features and functionality that extend and complement human operators.
Watch Will Hayes in this SEI Cyber Minute as he discusses "Cadence in Agile Development."
With an ever increasing number of crimes with a cyber component, the need for investigators who have been trained the ways of the Internet, encryption, and social media, to name a few, is growing and will continue to grow.
Watch Ipek Ozkaya in this Cyber Minute, as she recommends developers adopt a simple practice of reporting technical debt, including its potential accumulating side effects, as they discover or accrue that debt.
We live in a software defined world. More and more of the capability and value we derive from our connected devices is achieved by software.
Watch Bob Schiela as he decribes how SEI Secure Coding Standards have codified best practices for properly using features of specific languages to avoid security flaws in your software, thus reducing vulnerabilities.
Watch Mark Sherman as he discusses "Securing Open Source Components" in this SEI Cyber Minute.
Watch Summer Fowler as she discusses "Cyber Security Risk Oversight" in this SEI Cyber Minute.
Watch Anne Connell in this SEI Cyber Minute as she discusses "Privacy Risk Management Methodology".
Watch Lori Flynn in this SEI Cyber Minute as she discusses "Code Flaw Alert Classification".
Watch Mark Sherman in this SEI Cyber Minute as he discusses "Adding Security to Agile's Scrum".
Watch Summer Fowler in this SEI Cyber Minute as she discusses "Enterprise Risk Management".
Watch Randy Trzeciak in this SEI Cyber Minute as he discusses "Are You Vulnerable to Insider Threats?".
Watch Rachel Kartch in this SEI Cyber Minute as she discusses "Defending Against DDOS Attacks".
Watch Elli Kanal in this SEI Cyber Minute as he discusses "Enhancing Malware Analysis with AI".
Watch Sagar Chaki in this SEI Cyber Minute as he discusses "Assuring Autonomous Software".
Watch Chris May in this Cyber Minute as he discusses "CYBER LEAPfwd", a new educational platform aimed at the next generation of cybersecurity professionals.
Watch Hasan Yasar in this SEI Cyber Minute as he discusses "DevOps for Better Software Build".
Watch Nancy Mead in this SEI Cyber Minute as she discusses "Cyber Security Engineering."
Watch Michael Theis in this SEI Cyber Minute as he discusses "Workplace Violence/IT Sabotage".
Watch Dennis Allen in this SEI Cyber Minute as he discusses "Internet Protocol Version 6 (IPv6)".
Watch Rotem Guttman in this SEI Cyber Minute as he discusses "Automating Workforce Evaluation".
Watch Lisa Young in this SEI Cyber Minute as she discusses "CERT Resilience Management Model (RMM)".
Watch Rotem Guttman in this SEI Cyber Minute as he discusses "Cyber and Kinetic Warfighter Training".
Watch Gabriel Somlo in this SEI Cyber Minute as he discusses "SEI's Internet in a Box".
Watch Randy Trzeciak in this SEI Cyber Minute as he discusses "Are You Vulnerable to Insider Threats?".
Watch Lisa Young in this SEI Cyber Minute as she discusses "Managing Operational Risk".
Watch Bob Schiela in this SEI Cyber Minute as he discusses CERT Secure Coding Certificates.
Watch Summer Craze Fowler in this SEI Cyber Minute as she discusses the CMU CISO Executive Certificate.