A Technical History of the SEI

[Alberts 2009]. In 2010, SEI researchers began to apply these new risk principles as part of a research
effort into developing a method for assessing risk in the software supply chain. Finally,
much of the SEI’s current risk management work is focused on software assurance. In 2014, SEI
researchers began developing the Security Engineering Risk Analysis (SERA) method, a systematic
risk-based method for building security into software-reliant systems rather than deferring security
to later lifecycle activities such as operations.
The Consequence: A Disciplined Approach to Identifying and Managing
Software Risks
The SEI had a significant impact on the community in terms of risk management, primarily by establishing
the foundation of a defined practice and systematic way of identifying and codifying
risks. The SEI risk research produced one of the standards for software risk management, enabling
program managers in all types of software-intensive programs to do a better job of identifying
what could go wrong and mitigating the worst of those risks. In the Cutter Consortium’s report,
The State of Risk Management 2002, 21 percent of respondents to a survey about risk
management techniques said that they use SEI standards for risk management. Only ISO ranked
higher, with 36 percent of respondents. 23
The SEI Contribution
The SEI software risk management effort benefited from broad community input. Working with
the Department of Defense, NASA, industry, and cybersecurity experts and managers provided a
wealth of useful techniques and lessons learned, as well as the opportunities to improve different
approaches to solving the problems associated with risk management. Without these contributions,
the resulting methods and approaches of the SEI’s work would not be as rich, deep, and
broad.
The SEI risk research continues today, examining specific problems associated with today’s
highly complex, interdependent programs and finding new ways to deal with the emergent issues
of tomorrow.
References
[Alberts 2003] Alberts, Christopher & Dorofee, Audrey. Managing Information Security Risks:
The OCTAVE Approach. Addison-Wesley Professional, 2003 (ISBN 03211188630).
[Alberts 2008] Alberts, Christopher; Dorofee, Audrey; & Marino, Lisa. Mission Diagnostic Protocol,
Version 1.0: A Risk-Based Approach for Assessing the Potential for Success (CMU/SEI-
2008-TR-005). Software Engineering Institute, Carnegie Mellon University, 2008. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8665
23 Detailed information on this report is available only to registered Cutter users. However, some information
is available at http://www.cutter.com/cgi-bin/search/usr/local/etc/httpd/htdocs?filter=&query=hype+or+reality.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 142
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.