A Technical History of the SEI

also developed course descriptions and other resources. In 2011, the master’s curriculum was recognized
by the IEEE and the Association for Computing Machinery as the model curriculum for a
master’s degree program in software assurance.
The Consequence: Improved Software Development and Acquisition
Practices
SEI tools, techniques, methods, and analysis are raising the level of awareness of software developers,
acquirers, and system managers [Allen 2008]. Security and privacy can now be clearly defined
in software requirements, helping to ensure these qualities are incorporated from the start.
The use of SEI frameworks helps organizations to increase their confidence that operational mission
and critical work processes can be successfully executed in the presence of stress and possible
failure, and helps them to identify areas where they can apply policy, practices, and technology
options to improve assurance. The risks inherent in supply chains can be assessed, reduced,
and mitigated. Risk-based measurement techniques increase organizations’ understanding of their
software assurance situation and enable them to make effective improvements. The cybersecurity
risk management strategy enables emergency alert originators to mitigate risks so that alerts are
sent with proper authorization, accurately, and on time, every time.
The ultimate consequence is improved national security, with increased assurance that software
will operate as expected for essential government services and the nation’s critical infrastructure
and with reduced risk and impact of successful cyber attacks.
The SEI Contribution
In seeking ways to prevent vulnerabilities rather than simply react to them, the SEI leveraged the
software community’s identification of gap areas in software assurance research and the
knowledge gained in its CERT Coordination Center’s reactive work on security breaches and software
vulnerabilities. Some projects are unique approaches to software assurance; others adapt
technology and techniques from other software-related areas. Along with the SEI research in this
area, the software industry has recognized that security must be incorporated into product and systems
development: for example, Microsoft’s Security Development Lifecycle and Cigital’s Build
Security in Maturity Model. Likewise, the national Institute of Standards and Technology (NIST)
and the Object Management Group (OMG) are developing standards and guidelines for addressing
security in software development.
The SEI works with DHS, DoD agencies and organizations, and defense contractors to raise
awareness of software assurance opportunities and requirements and to help them take action to
build security into products early in the software development lifecycle. The SEI addresses the nation’s
need for increased software assurance expertise by offering training in SEI techniques and a
curriculum 49 to prepare future software assurance experts. The institute reaches out to the community
of software developers and acquirers by managing and contributing content to DHS websites—Build
Security In (BSI) and the Software Assurance (SwA) Community Resources and Information
Clearinghouse (CRIC). SEI experts also work with the software assurance community
through DHS Software Assurance Working Groups.
49 See http://www.cert.org/mswa
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 194
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.