In the fast-moving world of Agile and DevSecOps, neglecting fundamental maintenance activities will likely hinder delivery of value in the long run. Although the cost of system maintenance represents a large proportion of the budget… Read More »When Your Softwares Check Engine Light Is On: Identifying Design Problems that Impact Software Failure
Since 2010, researchers in the SEI CERT Division have emphasized the crucial need for realism within cyberteam training and exercise events. Our approach to the construction and execution of these events has led to publication… Read More »Generating Realistic Non-Player Characters for Training Cyberteams
As part of an ongoing effort to keep you informed about our latest work, this blog post summarizes some recently published SEI reports, podcasts, conference papers, and webcasts highlighting our work in vulnerabilities, privacy, software… Read More »The Latest Work from the SEI: Privacy, Ransomware, Digital Engineering, and the Solar Winds Hack
In the BBC documentary series Connections, science historian James Burke traced how technical innovations build on one another over time. New capabilities create new possibilities, new challenges, and new needs. This pattern also applies to… Read More »The Current State of DevSecOps Metrics
When using decision-support systems that are based on artificial intelligence (AI), humans often make poor choices. The failure of these systems to reward expectations about their utility have led to several such systems being abandoned.… Read More »A Game to Assess Human Decision Making with AI Support
Software developers and sustainers are seeing significant improvement by adopting Lean, Agile and DevSecOps iteration-based approaches. Now similar approaches are being proposed for more complex projects, including embedded software systems and software-driven systems of systems.… Read More »Comparing DevSecOps and Systems Engineering Principles
Zero trust adoption challenges many organizations. It isn’t a specific technology to adopt, but a security initiative that an enterprise must understand, interpret, and implement. Enterprise security initiatives are never simple, and their goal to… Read More »Zero Trust Adoption: Managing Risk with Cybersecurity Engineering and Adaptive Risk Assessment
To receive certification under the Cybersecurity Maturity Model Certification (CMMC) program, Department of Defense (DoD) contractors must successfully complete a third-party assessment. The DoD has released two CMMC assessment guides, the fundamental tools for both… Read More »How to Use the CMMC Assessment Guides
Network and defense analysts are facing increasing numbers of security alerts and, as a result of fielding those alerts, burnout. Dark Reading reported that the average security operations center (SOC) receives 10,000 alerts each day… Read More »Benefits and Challenges of SOAR Platforms