Software assurance

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

Software assurance (SwA) is defined as "the level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its lifecycle, and that the software functions in the intended manner."[1]

The main objective of software assurance is to ensure that the processes, procedures, and products used to produce and sustain the software conform to all requirements and standards specified to govern those processes, procedures, and products.[2] A secondary objective of software assurance is to ensure that the software-intensive systems we produce are more secure. For such software-intensive systems, a preventive dynamic and static analysis of the potential vulnerabilities is required, and holistic, system-level understanding is recommended. As stated by Gary McGraw, "Design flaws account for 50% of security problems. One can't find design defects by staring at code. A higher-level understanding is required. That's why architectural risk analysis plays an essential role in any solid software security program."[3]

Alternate definitions[edit]

United States Department of Homeland Security (DHS)[edit]

According to the DHS, software assurance addresses:

  • Trustworthiness - No exploitable vulnerabilities exist, either maliciously or unintentionally inserted;
  • Predictable Execution - Justifiable confidence that software, when executed, functions as intended;
  • Conformance - Planned and systematic set of multi-disciplinary activities that ensure software processes and products conform to requirements, standards/ procedures.

Contributing SwA disciplines, articulated in Bodies of Knowledge and Core Competencies: Software Engineering, Systems Engineering, Information Systems Security Engineering, Information Assurance, Test and Evaluation, Safety, Security, Project Management, and Software Acquisition.[4]

Software assurance is a strategic initiative of the US Department of Homeland Security (DHS) to promote integrity, security, and reliability in software. The SwA Program is based upon the National Strategy to Secure Cyberspace - Action/Recommendation 2-14:

“DHS will facilitate a national public-private effort to promulgate best practices and methodologies that promote integrity, security, and reliability in software code development, including processes and procedures that diminish the possibilities of erroneous code, malicious code, or trap doors that could be introduced during development.”[5] There are open-source software tools for software assurance that help identify potential security vulnerabilities.[6]

United States Department of Defense (DoD)[edit]

For the DoD, SwA is defined as "the level of confidence that software functions only as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software, throughout the life cycle.[7] DoD is developing SwA as a sound systems engineering practice as demonstrated by two recent publications funded by JFAC with development led by the Software Engineering Institute (SEI) and expert practitioners within the Military Services and NSA. The Program Manager's SwA Guidebook shows how SwA should be planned, resourced, and managed while the Developer's SwA Guidebook recommends tailorable technical practices throughout the life cycle.[8] Both of these documents are the first of their kind, and awarded.[9] The two enterprise-scale organizations in DoD building SwA capability are the Joint Federated Assurance Center (JFAC)[10] and the DoD SwA Community of practice which has operated as a quarterly collegial forum 32 consecutive gatherings. Both are open to other parts of the US Government. The JFAC Charter is available at its website. To develop wider situational awareness of the families of SwA tools commercially available, JFAC funded the Institute for Defense Analysis (IDA) to produce the State of the Art Resource (SOAR).[11] A recent innovation in "engineering-in" SwA throughout the life cycle is coupling selected NIST 800-53 controls to engineering tasks so that the engineering results define the Risk Management Framework (RMF) and drive the Authority to Operate (ATO). A package including Data Item Descriptions (DIDs), machine-readable vulnerability report formats, and a brief overviewing application of the techniques is available at the JFAC website. Other disruptive innovations are in process.

Software Assurance Metrics and Tool Evaluation (SAMATE) project[edit]

According to the NIST SAMATE project,[12] software assurance is "the planned and systematic set of activities that ensures that software processes and products conform to requirements, standards, and procedures to help achieve:

  • Trustworthiness - No exploitable vulnerabilities exist, either of malicious or unintentional origin, and
  • Predictable Execution - Justifiable confidence that software, when executed, functions as intended."

National Aeronautics and Space Administration (NASA)[edit]

According to NASA, software assurance is a "planned and systematic set of activities that ensures that software processes and products conform to requirements, standards, and procedures. It includes the disciplines of Quality Assurance, Quality Engineering, Verification and Validation, Nonconformance Reporting and Corrective Action, Safety Assurance, and Security Assurance and their application during a software life cycle." The NASA Software Assurance Standard also states: "The application of these disciplines during a software development life cycle is called Software Assurance."[13]

Object Management Group (OMG)[edit]

According to the OMG, Software Assurance is “justifiable trustworthiness in meeting established business and security objectives.”[14]

OMG's SwA Special Interest Group (SIG),[15] works with Platform and Domain Task Forces and other software industry entities and groups external to the OMG, to coordinate the establishment of a common framework for analysis and exchange of information related to software trustworthiness by facilitating the development of a specification for a Software Assurance Framework [16] that will:

  • Establish a common framework of software properties that can be used to represent any/all classes of software so software suppliers and acquirers can represent their claims and arguments(respectively), along with the corresponding evidence, employing automated tools (to address scale)
  • Verify that products have sufficiently satisfied these characteristics in advance of product acquisition, so that system engineers/integrators can use these products to build (compose) larger assured systems with them
  • Enable industry to improve visibility into the current status of software assurance during development of its software
  • Enable industry to develop automated tools that support the common framework.

Software Assurance Forum for Excellence in Code (SAFECode)[edit]

According to SAFECode, software assurance is “confidence that software, hardware and services are free from intentional and unintentional vulnerabilities and that the software functions as intended.”[17]

Webopedia[edit]

According to Webopedia, Software Quality Assurance, abbreviated as SQA, and also called "software assurance", is a level of confidence that software is free from vulnerabilities, either intentionally designed into the software or inserted at any time during its lifecycle, and that the software functions in the intended manner."[18]

As indicated in the Webopedia definition, the term "software assurance" has been used as a shorthand for Software Quality Assurance (SQA) when not necessarily considering security or trustworthiness. SQA is defined in the Handbook of Software Quality Assurance as: "the set of systematic activities providing evidence of the ability of the software process to produce a software product that is fit to use."[19]

Initiatives[edit]

A US federally funded initiative is called Software Assurance,[20] which is jointly funded by DHS, DOD and NIST, and runs the Build Security In (BSI)[21] website.

Why does software assurance matter?[edit]

Many business activities and critical functions—from national defense to banking to healthcare to telecommunications to aviation to control of hazardous materials—depend on the correct, predictable operation of software. These activities could be seriously disrupted were the software-intensive systems that they rely on to fail.[2]

See also[edit]

References[edit]

  1. ^ "National Information Assurance Glossary"; CNSS Instruction No. 4009 National Information Assurance Glossary
  2. ^ a b Karen Mercedes, Theodore Winograd "Enhancing The Development Life Cycle To Produce Secure Software" Archived March 30, 2012, at the Wayback Machine, Data & Analysis Center for Software, October 2008
  3. ^ McGraw, Gary. Software Security: Building Security In. Software Security. Addison-Wesley. ISBN 0-321-35670-5. p.75
  4. ^ Build Security In Home (December 2, 2011). "DHS Build Security In web portal". Buildsecurityin.us-cert.gov. Retrieved May 8, 2013.
  5. ^ Build Security In Home (December 2, 2011). "Build Security In Home". Buildsecurityin.us-cert.gov. Retrieved May 8, 2013.
  6. ^ "Open source (software) assurance tools". Archived from the original on September 11, 2014.
  7. ^ PUBLIC LAW 112–239—JAN. 2, 2013, NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2013, section 933.
  8. ^ https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=538756 and https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=
  9. ^ and https://www.isc2.org/News-and-Events/Press-Room/Posts/2019/06/17/ISC2-Announces-2019-Information-Security-Leadership-Awards-Government-Winners
  10. ^ PUBLIC LAW 113–66—DEC. 26, 2013, NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2014, section 937
  11. ^ https://www.ida.org/research-and-publications/publications/all/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation-2016-app-e
  12. ^ "Main Page - SAMATE project". Samate.nist.gov. Retrieved May 8, 2013.
  13. ^ NASA-STD-2201-93 Archived July 2, 2006, at the Wayback Machine "Software Assurance Standard", November 10, 1992
  14. ^ OMG Software Assurance (SwA) Special Interest Group (SIG) http://adm.omg.org/SoftwareAssurance.pdf and http://swa.omg.org/docs/softwareassurance.v3.pdf
  15. ^ "Omg Swa Sig". Swa.omg.org. February 26, 2010. Retrieved May 8, 2013.
  16. ^ http://www.omg.org/CISQ_compliant_IT_Systemsv.4-3.pdf
  17. ^ "Software Assurance: An Overview of Current Industry Best Practices" (PDF). Archived from the original (PDF) on May 13, 2013. Retrieved May 8, 2013.
  18. ^ "Webopedia on-line encyclopedia". Webopedia.com. Retrieved May 8, 2013.
  19. ^ G. Gordon Schulmeyer and James I. McManus, Handbook of Software Quality Assurance, 3rd Edition (Prentice Hall PRT, 1998)
  20. ^ "Software Assurance Community Resources and Information Clearinghouse". Buildsecurityin.us-cert.gov. Retrieved May 8, 2013.
  21. ^ Build Security In Home (December 2, 2011). "Build Security In Home". Buildsecurityin.us-cert.gov. Retrieved May 8, 2013.

External links[edit]