Using Awareness and Training to Enable Secure Software Development at Sandia National Laboratories.
Abstract not provided.
Rivas, Angela↗
SEARCH · Engineering Papers
Results for “software security”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Formal Methods for Provably Secure Software and Firmware
This project addresses a gap observed in verifying the programming in embedded devices used in international arms control: namely verifying that embedded programming in an arms control device does exactly what it is supposed to do, no more and no less, every time without fail, and without disclosing unauthorized information accidentally or intentionally. In critical military, aerospace, and industrial safety systems this problem is sometimes addressed using formal methods (FM). This multi-year project seeks to identify formal methods toolsets useable in arms control regimes, with emphasis on applicability, ease of use, long term availability, and support.
formal methods, Arms Control Verification↗
Named Data Networking for DER Cybersecurity
We present our research findings on the novel NDN protocol. In this work, we defined key attack scenarios for possible exploitation and detail software security testing procedures to evaluate the security of the NDN software. This work was done in the context of distributed energy resources (DER). The software security testing included an execution of unit tests and static code analyses to better understand the software rigor and the security that has been implemented. The results from the penetration testing are presented. Recommendations are discussed to provide additional defense for secure end-to-end NDN communications.
97 MATHEMATICS AND COMPUTING↗
Model based verification of the Secure Socket Layer (SSL) Protocol for NASA systems
The National Aeronautics and Space Administration (NASA) has tens of thousands of networked computer systems and applications. Software Security vulnerabilities present risks such as lost or corrupted data, information theft, and unavailability of critical systems. These risks represent potentially enormous costs to NASA. The NASA Code Q research initiative 'Reducing Software Security Risk (RSSR) Trough an Integrated Approach' offers formal verification of information technology (IT), through the creation of a Software Security Assessment Instrument (SSAI), to address software security risks.
software security↗
Component based approach to modeling for model checking
This paper presents a portion of an overall research project on the generation of a software security assessment instrument to aid developers in assessing and assuring the security of software in the development and maintenance lifecycles.
security toolset model checking security safety fo↗
FIC Vulnerability Profile
The FIC team is engaged with Pacific Northwest National Laboratory’s (PNNL’s) Shamrock Cyber Team to provide cybersecurity analyses of the FIC software. Shamrock offers both Threat-Based Analysis services and Secure Software Development services. These services are ultimately used to understand and mitigate threats against software and to reduce vulnerabilities in software, thus improving overall cybersecurity and informing decision makers. Shamrock’s Secure Software Development services, specifically Static Analysis Security Testing (SAST) and Open-Source Analysis (OSA), produced this Vulnerability Profile.
97 MATHEMATICS AND COMPUTING↗
Security System Software
C Language Integration Production System (CLIPS), a NASA-developed expert systems program, has enabled a security systems manufacturer to design a new generation of hardware. C.CURESystem 1 Plus, manufactured by Software House, is a software based system that is used with a variety of access control hardware at installations around the world. Users can manage large amounts of information, solve unique security problems and control entry and time scheduling. CLIPS acts as an information management tool when accessed by C.CURESystem 1 Plus. It asks questions about the hardware and when given the answer, recommends possible quick solutions by non-expert persons.
Source record↗
Software To Secure Distributed Propulsion Simulations
Distributed-object computing systems are presented with many security threats, including network eavesdropping, message tampering, and communications middleware masquerading. NASA Glenn Research Center, and its industry partners, has taken an active role in mitigating the security threats associated with developing and operating their proprietary aerospace propulsion simulations. In particular, they are developing a collaborative Common Object Request Broker Architecture (CORBA) Security (CORBASec) test bed to secure their distributed aerospace propulsion simulations. Glenn has been working with its aerospace propulsion industry partners to deploy the Numerical Propulsion System Simulation (NPSS) object-based technology. NPSS is a program focused on reducing the cost and time in developing aerospace propulsion engines
Blaser, Tammy M.↗
Secure Software-Defined Networking; Policy Enforcement in Hybridized Networks.
Abstract not provided.
Rindels, Raymond↗
Security Vulnerability Profiles of NASA Mission Software: Empirical Analysis of Security Related Bug Reports
NASA develops, runs, and maintains software systems for which security is of vital importance. Therefore, it is becoming an imperative to develop secure systems and extend the current software assurance capabilities to cover information assurance and cybersecurity concerns of NASA missions. The results presented in this report are based on the information provided in the issue tracking systems of one ground mission and one flight mission. The extracted data were used to create three datasets: Ground mission IVV issues, Flight mission IVV issues, and Flight mission Developers issues. In each dataset, we identified the software bugs that are security related and classified them in specific security classes. This information was then used to create the security vulnerability profiles (i.e., to determine how, why, where, and when the security vulnerabilities were introduced) and explore the existence of common trends. The main findings of our work include:- Code related security issues dominated both the Ground and Flight mission IVV security issues, with 95 and 92, respectively. Therefore, enforcing secure coding practices and verification and validation focused on coding errors would be cost effective ways to improve mission's security. (Flight mission Developers issues dataset did not contain data in the Issue Category.)- In both the Ground and Flight mission IVV issues datasets, the majority of security issues (i.e., 91 and 85, respectively) were introduced in the Implementation phase. In most cases, the phase in which the issues were found was the same as the phase in which they were introduced. The most security related issues of the Flight mission Developers issues dataset were found during Code Implementation, Build Integration, and Build Verification; the data on the phase in which these issues were introduced were not available for this dataset.- The location of security related issues, as the location of software issues in general, followed the Pareto principle. Specifically, for all three datasets, from 86 to 88 the security related issues were located in two to four subsystems.- The severity levels of most security issues were moderate, in all three datasets.- Out of 21 primary security classes, five dominated: Exception Management, Memory Access, Other, Risky Values, and Unused Entities. Together, these classes contributed from around 80 to 90 of all security issues in each dataset. This again proves the Pareto principle of uneven distribution of security issues, in this case across CWE classes, and supports the fact that addressing these dominant security classes provides the most cost efficient way to improve missions' security. The findings presented in this report uncovered the security vulnerability profiles and identified the common trends and dominant classes of security issues, which in turn can be used to select the most efficient secure design and coding best practices compiled by the part of the SARP project team associated with the NASA's Johnson Space Center. In addition, these findings provide valuable input to the NASA IVV initiative aimed at identification of the two 25 CWEs of ground and flight missions.
vulnerability↗
Security for Multimedia Space Data Distribution over the Internet
Distribution of interactive multimedia to remote investigators will be required for high quality science on the International Space Station (ISS). The Internet with the World Wide Web (WWW) and the JAVA environment are a good match for distribution of data, video and voice to remote science centers. Utilizing the "open" Internet in a secure manner is the major hurdle in making use of this cost effective, off-the-shelf, universal resource. This paper examines the major security threats to an Internet distribution system for payload data and the mitigation of these threats. A proposed security environment for the Space Station Biological Research Facility (SSBRP) is presented with a short description of the tools that have been implemented or planned. Formulating and implementing a security policy, firewalls, host hardware and software security are also discussed in this paper. Security is a vast topic and this paper can only give an overview of important issues. This paper postulates that a structured approach is required and stresses that security must be built into a network from the start. Ignoring security issues or putting them off until late in the development cycle can be disastrous.
Stone, Thom↗
Orange County Government Solar Demonstration and Research Facility
Orange County Florida completed the construction of a 20 kilowatt Solar Demonstration and Research Facility in March 2015. The system was constructed at the Orange County/University of Florida Cooperative Extension Center whose electric service address is 6021 South Conway Road, Orlando, Florida 32802. The Solar Demonstration and Research Facility is comprised of 72 polycrystalline photovoltaic modules and 3 inverters which convert direct current from the solar panels to alternating current electricity. Each module produces 270 watts of direct current power, for a total canopy production of just under 20,000 watts. The solar modules were installed with a fixed tilt of 5 degrees and face south, toward the equator to maximize the amount of sunlight captures. Each year, the electricity generated by the solar array will help eliminate 20 metric tons of carbon dioxide emissions as well as provide covered parking for staff and visitors vehicles. The solar array is expected to generate 27,000 kilowatt hours of electricity annually equating to an estimated $\$$266 savings in the monthly electric bill, or $\$$3,180 annually for the Orange County/University of Florida Cooperative Extension Center. In addition to reducing the electric bill for the Extension Center, Orange County’s solar array also takes advantage of a rebate incentive offered by the local utility, Orlando Utility Commission, which provided a meter that measures the amount of power produced by the solar array. The local utility company’s Solar Photovoltaic Production Incentive will pay Orange County $\$$0.05 per kilowatt hour for the power that is produced by the solar array. This incentive is provided in addition to Net Metering benefits, which is an effort to promote the use of clean, renewable energy on the electric grid. The Photovoltaic Solar Demonstration and Research Facility also serves an educational tool to the public; the solar array is tied directly into a data logger that provides real time power generation accessible for public viewing on an interactive kiosk located in the Orange County/University of Florida Cooperative Extension Center’s lobby where visitors can review “real time” power generation, cost savings and environmental benefits of the system. Site commissioning with the software program was delayed due to Internal Security Software issues within Orange County that needed to be resolved, therefore the “real time” capture of the production data for the solar array using the software program commenced on May 1, 2015. In addition an educational flyer was developed and is available in the Orange County Education Center’s main lobby. The project completed under this grant award assisted Orange County in demonstrating leadership by installing the application of a renewable energy technology combined with energy efficiency measures; resulting in reduced energy costs for the Orange County University of Florida Cooperative Extension Center, and helping Orange County citizens and visitors move towards the goals of greater energy independence and climate protection. The addition of the new Solar Demonstration and Research Facility has advanced the Orange County/University of Florida Cooperative Extension Center’s mission of extending, educating and providing research-based information to residents and visitors of Orange County by demonstrating the application of renewable energy technology combined with energy efficiency measures; resulting in reduced energy costs, and helping Orange County move towards the goal of greater energy independence and climate protection. In 2014, the Orange County Cooperative Extension Center hosted nearly 10,800 visitors to their on-site Exploration Gardens plus 12,686 walk-in visitors to their office plant clinic and other services. The Education Center held 2,217 educational events that were attended by 46,434 adults and youth, but about half of those events occurred off-site. Based on the visitation numbers in 2014 the Orange County Cooperative Extension Center Education is a vital partner to Orange County’s continued outreach and education efforts concerning renewable energy technologies and greenhouse gas emission reduction well in the current 2015 year and future years of operation of the solar array to the future visitors of the Center which help stimulate market demand that will continue to advance the commercialization and the widespread application and use of renewable energy technologies in Orange County and the state of Florida. The project period performance date for this grant was November 1, 2009 through March 1, 2015. The Final Project costs to complete the project as reported in the FINAL SF 425 were $\$$195,512.50 (50% recipient cost share was satisfied as required by grant terms and conditions).
14 SOLAR ENERGY↗
Security Vulnerability Profiles of Mission Critical Software: Empirical Analysis of Security Related Bug Reports
While some prior research work exists on characteristics of software faults (i.e., bugs) and failures, very little work has been published on analysis of software applications vulnerabilities. This paper aims to contribute towards filling that gap by presenting an empirical investigation of application vulnerabilities. The results are based on data extracted from issue tracking systems of two NASA missions. These data were organized in three datasets: Ground mission IVV issues, Flight mission IVV issues, and Flight mission Developers issues. In each dataset, we identified security related software bugs and classified them in specific vulnerability classes. Then, we created the security vulnerability profiles, i.e., determined where and when the security vulnerabilities were introduced and what were the dominating vulnerabilities classes. Our main findings include: (1) In IVV issues datasets the majority of vulnerabilities were code related and were introduced in the Implementation phase. (2) For all datasets, around 90 of the vulnerabilities were located in two to four subsystems. (3) Out of 21 primary classes, five dominated: Exception Management, Memory Access, Other, Risky Values, and Unused Entities. Together, they contributed from 80 to 90 of vulnerabilities in each dataset.
Goseva-Popstojanova, Katerina↗