Collaboration Opportunities in Security
- Computational Security Attributes (CSA)
- Corporate governance: governing for enterprise security
- Malicious Code Analysis Tools and Techniques
- Flow-service quality (FSQ) engineering
- Function extraction (FX)
- Insider threat studies
- International watch and warning network
- Levels of Anonymity and Traceability (LEVANT)
- Network situational awareness
- STAR*Lab: Security Technology Automation and Research
- Security Quality Requirements Engineering (SQUARE)
- Resiliency Engineering Framework
- Threat Analysis and Modeling
Computational Security Attributes (CSA): Security analysis of software today is a labor-intensive process requiring substantial expertise that often results in subjective, onetime evaluations of limited use in ongoing system operation. The Computational Security Attributes (CSA) project has developed theoretical foundations and automatable engineering methods for fast and precise computation of security properties, such as authentication, authorization, and non-repudiation, during system development and operation. The project defines security properties in terms of required functional behavior that can be computed with function extraction technology.
Corporate governance: governing for enterprise security: The SEI defines governing for enterprise security as “directing and controlling an organization to establish and sustain a culture of security in the organization’s conduct (beliefs, behaviors, capabilities, and actions).” This work builds on and expands commonly described forms of governance, including corporate governance, enterprise governance, and information technology governance. The SEI helps senior executives and managers expand their governance perspectives to include security, incorporating enterprisewide security thinking into their and their organizations’ day-to-day governance actions. The SEI is building collaboration relationships with organizations working in the governance domain (such as the Institute of Internal Auditors) and seeks partners who are addressing enterprise security as part of their corporate governance strategy.
Malicious Code Analysis Tools and Techniques: As a thought leader in the field of Internet security, the CERT/CC not only provides technical information to system and network administrators and technology professionals to help them better defend their networks, it also develops tools and methods to better identify, analyze, catalog, and manage vulnerability information and malicious code. It transitions these tools and methods to the DoD, intelligence community, law enforcement, reverse engineers, CSIRTs with national responsibility, and software vendors to help improve the effectiveness of response teams and to help vendors mitigate vulnerabilities in the software they produce.
Flow-service quality (FSQ) engineering: Flow-service-quality (FSQ) engineering provides foundations for mastering complexity and addressing survivability in analysis and development of large-scale, network-centric systems. The FSQ project is defining rigorous engineering methods for complex network systems characterized by shifting boundaries and users, uncertain COTS software function and quality, extensive asynchronous operations, unpredictable failures and compromises, and lack of visibility and control.
Function extraction (FX): In today’s state of practice, programmers lack practical means to determine the full functional behavior of software in all circumstances of use. This longstanding gap in engineering capabilities lies at the heart of many problems in software security and quality. CERT STAR*Lab is developing function extraction (FX) theory and engineering automation to compute the behavior of software with mathematical precision to the maximum extent possible. A first FX system is under development to compute behavior for programs written in or compiled into Intel assembly language. FX technology is a new approach to human understanding of software, as well as to malware detection and analysis, software development and testing, correctness verification, and component composition at the system level.
Insider threat studies: The SEI has been conducting insider threat research for several years based on analysis of law-enforcement cases and supplemental interviews for each case with the investigator, prosecutor, victim organization, and/or the insider. Future analysis will focus on malicious insider activity that was addressed internally by the victim organization without the involvement of law enforcement. The SEI is interested in working with organizations willing to share data and experiences on insider threat activity and to collaborate in the collection and dissemination of guidance.
International watch and warning network: The CERT Coordination Center is collaborating with Asia-Pacific Economic Cooperation (APEC), the Organization of American States (OAS), and many individual countries to build a worldwide network of CSIRTs with national responsibility to share information about incidents, vulnerabilities, malicious code, and threats.
Levels of Anonymity and Traceability (LEVANT): The CERT research team is conducting research to improve the current technical capability to track and trace sophisticated Internetbased attacks through the CERT Levels of Anonymity and Traceability (LEVANT) project.
Network situational awareness: CERT is looking for partners to pilot tools and techniques to understand large-scale network activity. The goal is to identify malicious activity that is too subtle to detect with traditional intrusion-detection methods.
STAR*Lab: Security Technology Automation and Research: CERT has established the STAR*Lab software development laboratory, whose mission is to develop theory-based automated solutions to challenge problems in security engineering. Challenge problems are intractable barriers to progress whose solutions can have major impact on engineering capabilities. STAR*Lab applies three principles—theory first, proofby- automation, and scale-up for practical application— in developing engineering tools to address security problems.
Security Quality Requirements Engineering (SQUARE): The SQUARE project team is installing SQUARE at an industry location and is working on further development of the SQUARE prototype tool. In addition, the team has developed SQUARE educational and training materials and is conducting a more detailed study of the technical aspects of SQUARE. The team is also performing industry case studies to determine whether SQUARE-Lite, a streamlined version of SQUARE that can be used to supplement an existing requirements engineering process, is feasible.
The SEI is seeking organizations in government, academia, and industry to participate in pilots and reviews of SQUARE practices and processes.
Resiliency Engineering Framework (REF): Resiliency engineering is an emerging area of applied research focused on helping organizations integrate, improve, and mature their security, business continuity, and IT operations activities. The CERT Resiliency Engineering Framework (REF) is the cornerstone artifact of this research. REF codifies an integrated approach to protecting and sustaining critical business operations combined with a process improvement approach to maturing enterprise competency in resiliency engineering.
The framework provides guidelines for managing security and business continuity across the enterprise, in concert with and in support of an organization’s mission and strategy. Elevating these activities to an enterprise level and focusing on process enables organizations to integrate, manage, benchmark, measure, and improve them over time.
The first complete outline of the framework was published in 2007 at www.cert.org /archive/pdf/07tr009.pdf, and REF-based assessments and training are now available. Research continues to expand the framework and to develop a suite of tools, techniques, training, and methods to support organizations in using the framework. Collaborating organizations are sought to participate in the research and assist in developing the REF product suite. Please see www.cert.org/resiliency_engineering for more information about CERT REF.
Threat Analysis and Modeling: CERT has been conducting insider threat research since 2001 based on analysis of lawenforcement cases and supplemental interviews of each case with the investigator, prosecutor, victim organization, and/or the insider. Building on the insider threat studies, the SEI is researching technical threat areas, including insider IT sabotage, fraud, and theft of sensitive or confidential information; espionage; potential threats to our nation’s critical infrastructure; and other electronic crimes.
Future activity will include the development of models, reports, training, and tools to raise awareness of the risk to an organization’s critical assets and to assist the community in understanding the factors influencing an insider’s decision to act, indicators and precursors of impending malicious actions, and countermeasures for mitigation, with the goal of improving the survivability and resiliency of the enterprise. The SEI is interested in working with organizations in the following areas: developing and applying insider threat risk diagnostics, piloting innovative threat prevention and mitigation training materials, sharing data and experiences on threat activities, and collaborating in the collection and dissemination of guidance.