Software and Tools
Access and download the software, tools, and methods that the SEI creates, tests, refines, and disseminates. Organizations and individuals worldwide use these technologies and management techniques to improve the results of software projects, the quality and behavior of software systems, and the security and survivability of networked systems.
-
A Platform-Independent Model for DevSecOps
DevSecOps
Tim Chick and Joe Yankel present a DevSecOps Platform-Independent Model that uses model-based systems engineering (MBSE) to formalize the practices of DevSecOps pipelines and organize relevant guidance.
Download -
SEI Launches Mothra for Big-Data Network Flow Analysis
Situational Awareness
The open source Mothra libraries enable big-data analysis engine Apache Spark to process network flow information.
Download -
Building on Ghidra: Tools for Automating Reverse Engineering and Malware Analysis
Reverse Engineering for Malware Analysis
Jeffrey Gennari and Garret Wassermann talk with Suzanne Miller about Kaiju, a series of tools that they have developed that allows for malware analysis and reverse engineering. Kaiju helps analysts take better advantage of the NSA's Ghidra framework.
Download -
Software Assurance Guidance and Evaluation (SAGE) Tool
The Software Assurance Guidance and Evaluation (SAGE) tool helps an organization assess the security of its systems development and operations practices.
Download -
Overview of Practices and Processes of the CMMC 1.0 Assessment Guides (CMMC 1.0)
This document is intended to help anyone unfamiliar with cybersecurity standards get started with the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC).
Download -
Mission-Based Prioritization Tool (Coded)
An alternate version of the tool to implement the mission-based prioritization of agile backlogs that includes a small amount of Visual Basic code that creates a tab containing the sorted prioritized list and a tab containing features grouped parameters.
Download -
Mission-Based Prioritization Tool (Code Free)
A no-frills tool to implement the mission-based prioritization of agile backlogs that accounts for restrictions on government computers; the results must be manually sorted.
Download -
KalKi Platform Main Repository
Cloud Computing
KalKi is an IoT platform for allowing untrusted IoT devices to connect to a network in a secure way, protecting both the IoT device and the network from malicious attackers.
Download -
Infrastructure as Code: Final Report
Software Architecture
This project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated IaC scripts from the model.
Download -
Supplementary Materials for a Case Study of Analysis Contracts with the ACTIVE tool
This archive contains the source code of the ACTIVE tool, and models/data from a case study of analysis contracts in two domains: thread scheduling, and battery design.
Download -
SCALe Collection
Secure Development
The CERT Division's Source Code Analysis Laboratory (SCALe) offers conformance testing of C and Java language software systems against the CERT C Secure Coding Standard and the CERT Oracle Secure Coding Standard for Java.
Download -
Analysis Pipeline
Situational Awareness
The Analysis Pipeline supports inspection of flow records as they are created.
Download -
CERT quilt
Situational Awareness
Quilt is a JavaScript tool used to to build and manage anything from website backends to complex distributed systems.
Download -
CERT Linux Forensics Tools Repository
The CERT Linux Forensics Tools Repository provides many useful packages for cyber forensics acquisition and analysis practitioners.
Download -
CERT fixbuf
Situational Awareness
CERT fixbuf is a compliant implementation of the IPFIX Protocol.
Download -
CERT super_mediator
Situational Awareness
CERT super_mediator is an IPFIX mediator for use with the YAF and SiLK tools.
Download -
Clang-Tidy
Secure Development
Clang-Tidy is Clang-based C++ "linter" tool that provides an extensible framework for diagnosing and fixing typical programming errors.
Download -
The CERT Guide to Coordinated Vulnerability Disclosure
Security Vulnerabilities
This guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful Coordinated Vulnerability Disclosure process. It also provides insights into how CVD can go awry and how to respond when it does so.
Download -
CERT Tapioca
Security Vulnerabilities
CERT Tapioca is a network-layer MITM proxy utility that checks for apps that fail to validate certificates and investigates content of network traffic, including HTTP and HTTPS.
Download -
CERT SiLK IPset
Situational Awareness
CERT SiLK IPset can be used to build and manipulate IPset files.
Download -
CERT pyfixbuf
Situational Awareness
CERT pyfixbuf is a Python API for libfixbuf that can be used to write applications that collect and export IPFIX.
Download -
CERT snarf
Situational Awareness
CERT snarf is a distributed alert reporting system that sends send network alert messages.
Download -
PDFrankenstein
Reverse Engineering for Malware Analysis
PDFrankenstein is a Python tool for bulk malicious PDF feature extraction.
Download -
Insider Threat Test Dataset
Insider Threat
The Insider Threat Test Dataset is a collection of synthetic insider threat test datasets that provide both background and malicious actor synthetic data.
Download -
SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition)
Secure Development
In this online download, the CERT Secure Coding Team describes the root causes of common software vulnerabilities, how they can be exploited, the potential consequences, and secure alternatives.
Download -
Report Writer and Security Requirements Finder: User and Admin Manuals
Reverse Engineering for Malware Analysis
This report presents instructions for using the Malware-driven Overlooked Requirements (MORE) website applications.
Download -
CERT Resilience Management Model (CERT-RMM) Version 1.2
CERT-RMM, the foundation for a process improvement approach to operational resilience management, defines the practices needed to manage operational resilience.
Download -
CERT netsa-python
Situational Awareness
The netsa-python library is a collection of Python routines and frameworks to use when developing analyses using the SiLK toolkit.
Download -
CERT iSiLK
Situational Awareness
iSiLK is a graphical front-end for the SiLK tools, designed to work with an existing installation of the SiLK analysis suite.
Download -
CERT Orcus
Situational Awareness
Orcus is a system for analyzing passively-collected DNS information. It includes a capability for analyzing all DNS information that has been seen (the “resource record database”), as well as a faster name-to-address mapping with daily resolution (the “na
Download -
KD-Cloudlet
Edge Computing
Cloudlets are discoverable, generic, stateless servers located in single-hop proximity of mobile devices that can operate in disconnected mode and are virtual-machine based.
Download -
Rosecheckers
Secure Development
Rosecheckers is a tool that performs static analysis on C/C++ source files to enforce the rules in the CERT C Coding Standard.
Download -
Architecture Analysis and Design Language (AADL) Tool
Software Architecture
AADL provides a framework for analyzing system designs and supports architecture-centric, model-based development through the system lifecycle.
Download -
CERT Dranzer
Security Vulnerabilities
Dranzer is a tool that enables users to examine effective techniques for fuzz testing ActiveX controls.
Download -
CERT Prism
Situational Awareness
Prism is a tool for visualizing flow data as a time series, broken down into several configurable bins by SiLK's rwfilter tool.
Download -
Compiler-Enforced Buffer Overflow Elimination
Secure Development
This tool prevents buffer overflows from succeeding in multithreaded code using static and dynamic analysis.
Download -
CERT Stix2Cif
Situational Awareness
CERT Stix2Cif parses STIX/Cybox documents into JSON CIF feed files with corresponding configuration files and feeds them to CIF.
Download -
CERT Triage Tools
Security Vulnerabilities
CERT Triage Tools consist of a triage script and a GNU Debugger (GDB) extension named 'exploitable' that classify Linux application defects by severity.
Download -
CERT Cif2Stix
Situational Awareness
CERT Cif2Stix is a plug-in for CIF that takes JSON object or file inputs and outputs STIX/CyBox documents.
Download -
CERT Rayon
Situational Awareness
CERT Rayon is a Python library and set of tools that generates basic two-dimensional statistical visualizations.
Download -
Controls Systems Code Samples Download
Insider Threat
The Controls Systems Code Samples help an organization protect text-based intellectual property, including source code repositories.
Download -
Mobile SCALe: Rules and Analysis for Secure Java and Android Coding
Secure Development
In this report, the authors describe Android secure coding rules, guidelines, and static analysis developed as part of the Mobile SCALe project.
Download -
SQUARE Instructional Materials
Cybersecurity Engineering
SQUARE instructional materials are designed for teaching the SQUARE method.
Download -
Introduction to the Mission Thread Workshop
Software Architecture
This report introduces the Mission Thread Workshop, a method for understanding architectural and engineering considerations for developing and sustaining systems of systems. It describes the three phases of the workshop and explains the steps of each.
Download -
CERT JIRA Plugins
CERT JIRA Plugins consist of Automated Task Creator, Email Attachment Handler, and Common Code.
Download -
SMART Materials
Software Architecture
SMART materials help organizations make better decisions on their paths to adopting a service-oriented architecture.
Download -
A Framework for Software Product Line Practice, Version 5.0
Software Architecture
This document describes the activities and practices in which an organization must be competent before it can benefit from fielding a product line of software systems.
Download -
Secure Coding Validation Suite
Secure Development
The Secure Coding Validation Suite is a tool that performs a set of tests to validate the rules defined in ISO Technical Specification 17961.
Download -
Source Code Analysis Laboratory (SCALe)
Secure Development
In this report, the authors describe the CERT Program's Source Code Analysis Laboratory (SCALe), a conformance test against secure coding standards.
Download -
Mission Risk Diagnostic (MRD) Method Description
Cybersecurity Engineering
In this report, the authors describe the Mission Risk Diagnostic (MRD) method, which is used to assess risk in systems across the lifecycle and supply chain.
Download -
Smart Grid Maturity Model Assets Collection, Version 1.2
These are the assets related to version 1.2 of the Smart Grid Maturity Model.
Download -
CERT SQUARE for Privacy (P-SQUARE)
Cybersecurity Engineering
P-SQUARE was designed for stakeholders, requirements engineers, and administrators and supports the security and privacy aspects of SQUARE.
Download -
CERT SQUARE for Acquisition (A-SQUARE)
Cybersecurity Engineering
SQUARE-A is designed for stakeholders, requirements engineers, and contractors/vendors to use in acquisitions and provides documentation support for a variety of use cases.
Download -
Measurement and Analysis Infrastructure Diagnostic, Version 1.0: Method Definition Document
This 2010 report is a guidebook for conducting a Measurement and Analysis Infrastructure Diagnostic (MAID) evaluation.
Download -
As-If Infinitely Ranged Integer Model, Second Edition
Secure Development
In this report, the authors present the as-if infinitely ranged (AIR) integer model, a mechanism for eliminating integral exceptional conditions.
Download -
Measurement and Analysis Infrastructure Diagnostic (MAID) Evaluation Criteria, Version 1.0
This 2009 report presents the criteria used during a MAID evaluation that serve as a checklist to rate the quality of an organization's measurement and analysis practices and the quality of the measurement information that results from the implementation of those practices.
Download -
As-if Infinitely Ranged Integer Model
Secure Development
In this report, the authors present the as-if infinitely ranged (AIR) integer model, which eliminates integer overflow and integer truncation in C and C++ code.
Download -
SMART: Analyzing the Reuse Potential of Legacy Components in a Service-Oriented Architecture Environment
Is legacy system migration feasible for your organization as a means of SOA adoption? The Service Migration and Reuse Technique (SMART) assists an organization in determining what to migrate, the steps needed, and the costs involved.
Download -
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
In this 2007 report, the authors highlight the design considerations and requirements for OCTAVE Allegro based on field experience.
Download -
Attribute-Driven Design (ADD), Version 2.0
Software Architecture
This report revises the steps of the Attribute-Driven Design (ADD) method and offers practical guidelines for carrying out each step.
Download -
Acquisition Strategy Development Tool
The Acquisition Strategy Development Tool is a customized Excel workbook that helps acquisition planners work through their method and techniques.
Download -
QUASAR: A Method for the Quality Assessment of Software-Intensive System Architectures
This 2006 handbook documents the QUASAR (QUality Assessment of System ARchitectures) method for assessing the quality of the architecture of a software-intensive system.
Download -
Views and Beyond Documentation Template
Software Architecture
A Microsoft Word template for a software architecture document is available for free download.
Download -
Quality Attribute Workshops (QAWs), Third Edition
Software Architecture
This report describes the newly revised QAW (Quality Attribute Workshop) and describes potential uses of the refined scenarios generated during it.
Download -
Identifying Commercial Off-the-Shelf (COTS) Product Risks: The COTS Usage Risk Evaluation
This 2003 report describes the development of an approach to reduce the number of program failures attributable to COTS software: the COTS Usage Risk Evaluation (CURE).
Download -
Active Reviews for Intermediate Designs
Software Architecture
This 2000 technical note describes Active Review for Intermediate Designs (ARID), a piloted software design review technique.
Download -
ATAM: Method for Architecture Evaluation
Software Architecture
This report presents technical and organizational foundations for performing architectural analysis, and presents the SEI's ATAM, a technique for analyzing software architectures.
Download -
Goal-Driven Software Measurement: A Guidebook
The materials in this 1996 guidebook are designed to help you identify, select, define, and implement software measures to support your business goals.
Download