Integrating Threat Modeling with the SERA Method

SEI Shorts

#Tech #Carnegie Mellon University Software Engineering Institute #Members of Technical Staff at the Software Engineering Institute #Cyber #Cybersecurity #Softwareengineering #Systemsengineer #Vulnerable

32:48

America’s Sweethearts: Dallas Cowboys Cheerleaders is back for its second season! Kay Adams welcomes the women who assemble the squad, Kelli Finglass and Judy Trammell, to the Netflix Sports Club Podcast. They discuss the emotional rollercoaster of putting together the Dallas Cowboys Cheerleaders. Judy and Kelli open up about what it means to embrace flaws in the pursuit of perfection, how they identify that winning combo of stamina and wow factor, and what it’s like to see Thunderstruck go viral. Plus, the duo shares their hopes for the future of DCC beyond the field. Netflix Sports Club Podcast Correspondent Dani Klupenger also stops by to discuss the NBA Finals, basketball’s biggest moments with Michael Jordan and LeBron, and Kevin Durant’s international dominance. Dani and Kay detail the rise of Coco Gauff’s greatness and the most exciting storylines heading into Wimbledon. We want to hear from you! Leave us a voice message at www.speakpipe.com/NetflixSportsClub Find more from the Netflix Sports Club Podcast @NetflixSports on YouTube, TikTok, Instagram, Facebook, and X. You can catch Kay Adams @heykayadams and Dani Klupenger @daniklup on IG and X. Be sure to follow Kelli Finglass and Judy Trammel @kellifinglass and @dcc_judy on IG. Hosted by Kay Adams, the Netflix Sports Club Podcast is an all-access deep dive into the Netflix Sports universe! Each episode, Adams will speak with athletes, coaches, and a rotating cycle of familiar sports correspondents to talk about a recently released Netflix Sports series. The podcast will feature hot takes, deep analysis, games, and intimate conversations. Be sure to watch, listen, and subscribe to the Netflix Sports Club Podcast on YouTube, Spotify, Tudum, or wherever you get your podcasts. New episodes on Fridays every other week.…

6 years ago 1:31

MP4•Episode home

Threat-modeling methods provide an approach for identifying possible threats to a system and mitigating them. In this SEI Cyber Minute, Chris Alberts discusses the Security Engineering Risk Analysis (SERA) Method and the threats and risks that organizations can use it to model and plan for. In addition, Chris discusses the threat-modeling methods the SEI recently integrated into the SERA Method.

102 episodes

Integrating Threat Modeling with the SERA Method

SEI Shorts

published 6 years ago

MP4•Episode home

102 episodes

All episodes

SEI Shorts

1
Protecting Systems Using SSH Keys 1:15

5 years ago1:15

1:15

In this SEI Cyber Minute, Alex Corn discusses how to protect systems using Secure Shell (SSH). SSH supports keys, which provide efficiency and security benefits.

SEI Shorts

1
A New Path to Verifiable Confidence 2:09

6 years ago2:09

2:09

In this SEI Cyber Minute, Bobbie Stempfley explains how in our increasingly complex world, the SEI is redefining approaches to security to address the transformative technologies being adopted throughout government and industry.

SEI Shorts

1
Agile Pitfall in Acquisition: The Bottom of the V 3:36

6 years ago3:36

3:36

In this SEI Cyber Minute, Suzanne Miller explains a pitfall that can occur when trying to use Agile and Lean methods when developing and implementing complex, embedded systems. In such projects, development traditionally proceeds in a model shaped like a “V,” where the completion of requirements definition, architecture, and design occurs along the left branch of the “V” and leads to implementation at the bottom point. Then, the right branch of the “V” represents verification and validation activities. The difficulty is that these projects usually reap the benefits of the iterative, incremental aspects of Agile development only during implementation, after requirements, architecture, and design work are deemed to be finished. At that point, it becomes difficult to apply the lessons learned during implementation and to make necessary changes to the work that occurred before implementation began. Suzanne Miller explains the dynamics of this pitfall, and she describes a more agile and responsive mindset that teams can use to make sure they reap the benefits of Agile and lean approaches throughout development. In addition, she shares reference material that can help interested parties learn more.…

SEI Shorts

1
Insider Threat Mitigation, We can help! 2:31

6 years ago2:31

2:31

September 2019 has been designated “National Insider Threat Awareness Month.” A number of federal agencies—including the FBI, Office of the Under Secretary of Defense for Intelligence, and Department of Homeland Security—have chosen September to spotlight the risks that insiders pose to national security. Since 2001, the SEI’s CERT Division has been helping government, industry, and academic entities identify and mitigate insider threats. The CERT Division’s research spans multiple domains, from the technical, including an exploration of tool sets for insider threat programs, to the behavioral and organizational, including a study on positive incentives for reducing insider threat in the workplace.…

SEI Shorts

1
Automating Alert Handling Reduces Manual Effort 3:22

6 years ago3:22

3:22

Static analysis (SA) alerts about software code flaws require costly manual effort to validate (e.g., determine True or False) and repair. As a result, organizations often severely limit the types of alerts they manually examine to the types of code flaws they most worry about. That approach results in a tradeoff where many True flaws may never get fixed. To make alert handling more efficient, the SEI developed and tested novel software that enables the rapid deployment of a method to classify alerts automatically and accurately. We are implementing our solution in a new version of the SEI’s SCALe – the Source Code Analysis Lab – application.…

SEI Shorts

1
SCAIFE: An Alert Auditing Classification Prototype 2:11

6 years ago2:11

2:11

In this SEI Cyber Minute, Ebonie McNeil explains how the Source Code Analysis Integrated Framework Environment or (SCAIFE) prototype is intended to be used by developers and analysts who manually audit alerts. SCAIFE provides automatic alert classification using machine learning which gives a level of confidence that the alert is true or false. The SCAIFE prototype also enables organizations to apply formulas that prioritize static analysis alerts by using factors they care about.…

SEI Shorts

7 years ago2:19