A Technical History of the SEI

The SEI concern about risks posed to national and economic security provided the impetus for
evaluation methods that give the DoD and other organizations a view of risk to their information
systems, along with practices for protecting those systems. OCTAVE is a suite of techniques,
methods, and tools for assessing information security risks to critical government and business assets,
the foundation for planning continuous risk management. A related assessment is Computer
Network Defense (CND) metrics, which focus on risks in CSIRT incident management. The U.S.
Army and Air Force use OCTAVE to help meet HIPPA regulations, and the technique has been
taught at DoD medical treatment facilities around the globe.
As part of its effort to influence product development, the SEI began looking at how to incorporate security
early in the software development lifecycle. The Cybersecurity Engineering group focuses on
using engineering solutions to address this challenge. The DoD and federal agencies benefit from
frameworks and methods that support decisions from acquisition through operation, which organize
research and practice areas for building assured systems, and that guide measurement and analysis.
SQUARE (Security Requirements Engineering) gives developers a process for identifying security and
privacy requirements from the start; A-SQUARE, an addition to the SQUARE suite, aids in acquisition
of stable products with security as an integral attribute rather than an add-on.
Future research and development will enable the CERT Division to keep up with changing technology,
risks, attacks, and DoD software assurance needs.
References
[ACM 1989] Communications of the ACM 32, 6 (June 1989): Entire issue devoted to the subject
of the Morris Worm. Example article: Eugene H. Spafford, “The Internet Worm: Crisis and Aftermath:”
678-687.
[FAS 2000] Federation of American Scientists. “Blacker.” http://www.fas.org/irp/program/security/blacker.htm
(2000).
[Howard 1997] Howard, John D. “An Analysis of Security Incidents on the Internet 1989-1995.”,
PhD diss., Carnegie Mellon University, 1997. https://resources.sei.cmu.edu/library/assetview.cfm?assetID=52454
[Leiner 2012] Leiner, Barry M.; Cerf, Vinton G.; Clark, David D.; Kahn, Robert R., et al. “Brief
History of the Internet.” Internet Society. http://www.internetsociety.org/internet/internet-51/history-internet/brief-history-internet
(2012).
[Moitra 2004] Moitra, Soumyo & Konda, Suresh. “An Empirical Investigation of Network Attacks
on Computer Systems,” Computers and Security 23, 1 (February 2004): 43-51.
[Museum 2006] Computer History Museum. “Internet History.” http://www.computerhistory.org/internet_history
(2006).
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 165
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.