homepage – Page 26

April 4, 2018

SERC TALKS: “How do Agile Methods Reduce Risk Exposure and Improve Security on Highly-Critical Systems?”

Speaker: Robin Yeman, Lockheed Martin | CONTACT

Abstract

With each passing year software continues to grow and every industry regardless of their product uses software as an integral part of their value stream. That phenomenon is especially true in the government space where we deliver highly- critical systems such as aircraft, unmanned systems, missiles & guided weapons, and human space flight vehicles. Highly regulated environments not only require high quality low risk deliveries; they need to be secure. I believe using Agile methods will provide exactly that. Depending on individual experiences and varying context some projects continue to see Agile methods as risky however various studies and journals such as IEEE have shown Agile methods to deliver results in areas of quality, cost, and schedule across the commercial and government industries. Can those same Agile practices be leveraged to improve the level of security in our systems and reduce our risk exposure while the Internet of Things (IoT) continues to expand our system attack surfaces? In this presentation, we will discuss: The difference between Agile and traditional Waterfall How Agile practices enable security to be embedded in our systems from the start Where security is inserted throughout all stages of the SDLC Define the art of the possible for the future.

Bio

Robin Yeman works for Lockheed Martin (LM) Information Systems and Global Solution in Northern Virginia as a Lockheed Martin Fellow. She has over 23 years of experience in software and IT, across multiple business areas building everything from Satellites to Submarines. She has been actively supporting and leading Agile programs at Scale both domestically and internationally for the last 15years with multiple certifications including Scaled Agile Program Consultant, Certified Enterprise Coach (CEC), CSP, CSM, CSPO, PSM, PMP, PMI-ACP, INCOSE Certified Systems Engineer, and ITIL Practitioner. She actively coaches and trains teams through in person coaching, Agile workshops, virtual training classes. She leads the Lockheed Martin’s Agile Community of Practice and Center of Excellence, speaks at multiple conference engagements each year. Robin received her Master’s Degree in Software Engineering from Rensselaer Polytechnic Institute.

February 28, 2018

Technical Report Released: Transforming Systems Engineering through Model-Centric Engineering

SERC research team released Technical Report SERC-2018-TR-103 for Research Task 170 “Transforming Systems Engineering through Model-Centric Engineering”on February 28, 2018. Questions may be addressed to Principal Investigator Dr. Mark Blackburn as well as other researchers.

Executive Summary:

This is the final technical report of the Systems Engineering Research Center (SERC) research task RT170. This research task (RT) addresses research needs extending prior efforts under RT-48/118/141/157 that informed us that Model-Centric Engineering1 (MCE) is in use and adoption seems to be accelerating. Model-centric engineering can be characterized as an overarching digital engineering approach that integrates different model types with simulations, surrogates, systems and components at different levels of abstraction and fidelity across disciplines throughout the lifecycle. Industry is trending towards more integration of computational capabilities, models, software, hardware, platforms, and humans-in-the-loop. The integrated perspectives provide cross-domain views for rapid
system level analysis allowing engineers from various disciplines using dynamic models and surrogates to support continuous and often virtual verification and validation for tradespace decisions in the face of changing mission needs.

NAVAIR senior leadership confirmed in late 2015 that NAVAIR must move quickly to keep pace with the other organizations that have adopted MCE and who continue to evolve at an accelerating pace enabled by the advances in computational and modeling technologies, and improved methods. In March of 2016, there was a Change of Command at AIR 4.0 (Research and Engineering) and NAVAIR leadership decided to accelerate the Systems Engineering Transformation (SET). During 2017 there was strategic planning to characterize the Functional Areas of the SET Execution Framework. One of those functional areas is the SET Research that is discussed in this report. This research provides analyses into NAVAIR enterprise capability, and builds on efforts for cross-domain model integration, model integrity, ontologies, semantic web technologies, multi-physics modeling, and model visualization that extend RT157 research under RT-170 to address the evolving SET needs and priorities of SET.

A key decision by NAVAIR leadership in 2017 was to conduct a surrogate pilot as reflected in Figure 1. The aspects of this research task are blended into the surrogate pilot. The surrogate pilot is using experiments to simulate the execution of the new SET Framework, shown in Figure 2. The first phase of the SET Surrogate Pilot addresses the following mission, goals and objectives:

Mission: Collaboration between Government and Industry in Model-based Acquisition under SET Framework
Goal: Execute SET Framework to Assess, Refine, and Understand a New Paradigm for Collaboration in Authoritative Source of Truth (AST)
Objectives (non-exhaustive):
- Formalize experiments to answer questions about executing SET framework using Surrogate Contractor (SC)
- ”Government team” creates mission, system (& other) models, “generates specification/Request For Proposal,” and provides acquisition models to SC as Government Furnished Information (GFI)
- SC refines the GFI to make corrections and add innovations with physical allocation views with an multi-physics-based Initial Balanced Design
- Simulate continuous virtual reviews and derive new objective measures for assessing maturing design in AST
- Demonstrate visualizations for real-time collaboration in AST
- Demonstrate and document methods applied
- Investigate challenging areas and research topics in series of pilots

Figure 1. SE Transformation “Roll out” Strategy

Technical Report

For More information about the Project click here.

February 7, 2018

SERC TALKS: “Speed, Data and Ecosystems: How to Excel in a Software-Driven World?”

DOWNLOAD SLIDES

Speaker: Dr. Jan Bosch, Chalmers University of Technology | CONTACT

Abstract

We are living in the most exciting time in the history of mankind. The last century has seen unprecedented improvements in the quality of the human condition and technology is at the heart of this progress. Now we are experiencing an even bigger leap as we move towards a new level of digitalization and automation. Ranging from self-driving cars to factories without workers to societal infrastructure, every sensor and actuator is becoming connected and new applications that enable new opportunities are appearing daily. The fuel of this emerging connected, software-driven reality is software and the key challenge is to continuously deliver value to customers. The future of software business in this context is centered around three main developments: Speed, Data and Ecosystems. The focus on speed is concerned with the constantly increasing rate of deploying new software in the field. This continuous integration and deployment is no longer only the purview of internet companies but is also increasingly deployed in embedded systems. Second, data is concerned with the vast amounts of information collected from systems deployed in the field and the behavior of the users of these systems. Software businesses need to significantly improve their ability to exploit the value present in that data. Finally, ecosystems are concerned with the transition in many companies from doing everything in-house to strategic use of innovation partners and partners providing commodity functionality. The keynote addresses these three main developments, provides numerous examples from the Nordic and international industry and predicts the next steps that industry and academia need to engage in to remain competitive.

Bio

Jan Bosch is Professor of Software Engineering at Chalmers University Technology in Gothenburg, Sweden. He is Director of the Software Center (www.software-center.se), a strategic partner-funded collaboration between 11 large European companies (including Ericsson, Volvo Cars, Volvo Trucks, Saab Defense, Jeppesen (Boeing), Siemens and Bosch) and five universities focused on software engineering excellence. Earlier, he worked as Vice President Engineering Process at Intuit Inc where he also led Intuit’s Open Innovation efforts and headed the central mobile technologies team. Before Intuit, he was head of the Software and Application Technologies Laboratory at Nokia Research Center, Finland. Prior to joining Nokia, he headed the software engineering research group at the University of Groningen, The Netherlands. He received a MS degree from the University of Twente, The Netherlands, and a PhD degree from Lund University, Sweden. His research activities include evidence-based development, software architecture, innovation experiment systems, compositional software engineering, software ecosystems, software product families and software variability management. He is the author of several books including “Design and Use of Software Architectures: Adopting and Evolving a Product Line Approach” published by Pearson Education (Addison-Wesley & ACM Press) and “Speed, Data and Ecosystems: Excelling in a Software-Driven World” published by Taylor and Francis, editor of several books and volumes and author of a significant number of research articles. He is editor for Journal of Systems and Software as well as Science of Computer Programming, chaired several conferences as general and program chair, served on numerous program committees and organized countless workshops. In the startup space, Jan is Chairman of the Board of Auqtus AB and, until recently, Fidesmo in Stockholm, Remente, in Gothenburg, Sweden. He serves on the advisory board of Assia Inc. in Redwood City, CA, Peltarion AB in Stockholm and Burt AB in Gothenburg, Sweden. Jan also runs a boutique consulting firm, Boschonian AB, that offers its clients support around the implications of digitalization including the management of R&D and innovation. For more information see his website: www.janbosch.com.

November 1, 2017

SERC TALKS: “The Dilemmas of Cybersecurity – Why is Everything Broken?”

DOWNLOAD SLIDES

Speaker: Dr. William L. Scherlis, Carnegie Mellon University | CONTACT

Abstract

There are diverse barriers to advancement of strong cybersecurity, and many of these derive from unresolved conflicts among equities relating to technical means for high assurance, allocation of risk and liability, identity and attribution, deterrence and active defense, product and process evaluation, and diffusion of technology. What are the prospects, from a technical and policy perspective, to address these conflicts in ways that will enable higher levels of security?

Bio

William L. Scherlis is a Professor of Computer Science and Director of the Institute for Software Research (ISR) in the School of Computer Science at Carnegie Mellon University (CMU). He founded and led the CMU PhD Program in Software Engineering for its first decade of operation. He was Acting CTO for the Software Engineering Institute for 2012 and early 2013. Dr. Scherlis completed a Ph.D. in Computer Science at Stanford University, a year at the University of Edinburgh (Scotland) as a John Knox Fellow, and an A.B. at Harvard University in Applied Mathematics. His research relates to software assurance, cybersecurity, software analysis, and assured safe concurrency. Scherlis has testified before Congress on software sustainment, on information technology and innovation, and on roles for a Federal CIO. He interrupted his career at CMU to serve at Defense Advanced Research Projects Agency (DARPA) for six years, departing in 1993 as a senior executive. Scherlis chaired the National Research Council (NRC) study committee that produced the report Critical Code: Software Producibility for Defense in 2010. He served multiple terms as a member of the DARPA Information Science and Technology Study Group (ISAT). He has been an advisor to major IT companies and a founder of CMU spin-off companies. Scherlis is a Fellow of the IEEE and a lifetime National Associate of the National Academy of Sciences. He is a emeritus member of the SERC Research Council in the area of Trusted Systems.

October 4, 2017

SERC TALKS: “What are the Top Ten Software Security Flaws?”

DOWNLOAD SLIDES

Speaker: Gary McGraw, Synopsys | CONTACT

Abstract

Software security defects come in two categories: bugs in the implementation and flaws in the design. In the commercial marketplace, much more attention has been paid to finding and fixing bugs than has been paid to finding and fixing flaws. That is because automatically identifying bugs is a much easier problem than identifying design flaws. The IEEE Center for Secure Design was founded to address this issue head on. My presentation will cover the IEEE CSD’s first deliverable by introducing and discussing how to avoid the top ten software security flaws. The content was developed in concert with Twitter, Google, Cigital, HP, Sadosky Foundation of Argentina, George Washington University, Intel/McAfee, RSA, University of Washington, EMC, Harvard University, and Athens University of Economics and Business. During the talk, I will introduce and discuss how to avoid the top ten software security design flaws. It’s important, of course, to know that these flaws account for half of the defects commonly encountered in software security. But more important still is learning how to avoid these problems when designing a new system or revisiting an existing system.

Bio

Gary McGraw is the Vice President Security Technology of Synopsys (SNPS), a silicon valley company headquartered in Mountain View, CA. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Software Security, Exploiting Software, Building Secure Software, Java Security, Exploiting Online Games, and 6 other books; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a periodic security column for SearchSecurity, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Max Financial, NTrepid, and Ravenwhite. He has also served as a Board member of Cigital (acquired by Synopsys) and as Advisor to Dasient (acquired by Twitter), Fortify Software (acquired by HP), and Invotas (acquired by FireEye). His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean’s Advisory Council for the School of Informatics. Gary produces the monthly Silver Bullet Security Podcast for Synopsys and IEEE Security & Privacy magazine (syndicated by SearchSecurity).

August 2, 2017

SERC TALKS: “How Do We Prepare the People Who Will Need to Manage the Real-time Responses to Cyber Attacks on Physical Systems?”

ABSTRACT:

As part of an ongoing multi-year SERC Research Task led by University of Virginia, the research effort focuses on development of cyber attack resilience concepts for cyber-physical systems, an experimentally-based set of activities have been focused on exploring human factors issues. In particular, situations involving human operators have been simulated where cyber attacks have been detected by a dedicated monitoring sub-system (referred to as a Sentinel), and a system operator is alerted and provided with relevant system reconfiguration advisories. The simulated attack scenarios include possibilities for extreme events, including possibilities for killing or seriously injuring people. The research effort has focused on operator responses to the detections and advisories, including a collaboration project with the MITRE Corporation in a simulation activity at Creech Air Force Base involving pilots remotely controlling attacked unmanned aerial vehicles (UAVs), and a collaboration project at Wright-Patterson Air Force Base (WPAFB) with the Air Force Institute of Technology involving experiments with 32 airmen remotely controlling attacked unmanned ground vehicles. The Creech Air Force Base effort raised a number of significant human factors questions that are especially pertinent to system reconfiguration responses to cyber attacks, while the more focused WPAFB experiments addressed the relationship between a particular operator behavioral characteristic (level of suspicion) and operator responses. The Talk provides the results from these efforts and their implications on operator selection and training, including identifying a broader set of needed integrated human factors and system design research activities focused on cyber attack resiliency.

Speakers: Dr. Barry Horowitz, University of Virginia | CONTACT || Dr. Inki Kim, University of Virginia | CONTACT

Short Biography of Dr. Horowitz

Dr. Horowitz is a SERC Research Council member in Trusted Systems and Principal Investigator of a 6 year long research project (Security Engineering). He is also the director for the University of Virginia (UVa) research site of the National Science Foundation sponsored Industry/University Cooperative Re- search Center called WICAT (Wireless Internet Center for Advanced Technology). Prior to UVa, he was president and CEO of the MITRE Corporation. He received the Air Force’s highest award for a civilian, is a member of the National Academy of Engineering, Tau Beta Pi and Eta Kappa Nu honor societies, and was awarded the AFCEA Gold Medal of Engineering in 1990. Dr. Horowitz is currently serving as a member of the Naval Studies Board (NSB) of the National Academy of Science, and has participated as a panel member on a variety of studies conducted by the Defense Science Board, the Army Science Board and the National Academy of Engineering.

Short Biography of Dr. Kim

Dr. Kim is an Assistant Professor in the Department of Systems and Information Engineering, and a faculty advisor for Human Factors Student Chapter at the University of Virginia. His research interest focuses on experiment, simulation and modeling of human behaviors and performance while interacting with advanced technologies. He supervises a laboratory (HCSI: Human-Centered Systems and Innovation) to empirically test cognitive and physical responses of people in reality and Virtual/Augmented reality. During his Ph.D. program at Penn State, he developed a virtual haptic simulation for resident training, and it was recognized in the Human Factors and Ergonomics Society (HFES) and the Institute of Industrial Engineers (IIE), and the work contributed to winning research grants from the National Institute of Health (NIH). Before joining the Ph.D. program in 2009, he had conducted and supervised thirteen industry projects to improve usability and affective responses to various consumer products for IBM, Hyundai Motors, LG Electronics, LG chemical, and the Korea Railroad Corporation. Earlier during his M.S. program at Seoul National University, Korea, he built a statistical model to predict affective responses of cinema audiences based on the visual and auditory cues in movies, and the research was sponsored by the Korea Film Council.

DOWNLOAD SLIDES

« Previous Page