Secure Systems By Design

May, 2024

Abstract

The SEI has been in the forefront of secure software development, promoting a “shift left” approach, whereby security weaknesses are addressed, prevented, or eliminated earlier in the software development cycle, saving time and money. 

In this presentation, we will discuss security being an integral aspect of the entire software lifecycle as a result of following deliberate, intentional engineering processes, rather than security being addressed in individual stages as one-off activities.

About the Presenter 

Tim Chick is the CERT Applied Systems Group Technical Manager at Carnegie Mellon University’s (CMU) Software Engineering Institute (SEI). He currently leads a team of software and system engineers as they build and operate technical solutions for both internally-funded research and customer-facing prototypes, and delivers trusted, valued, and relevant software engineering and cybersecurity approaches for software intensive systems through engineering and consulting support to DoD and DHS programs. In collaboration with technical experts across the SEI, the team assists organizations with the application of Agile and DevSecOps practices and the adoption of emerging technologies needed to keep pace with evolving opportunities, risks, and threats.

He is also an adjunct faculty member at CMU’s Software and Societal Systems Department (S3D), where he teaches courses on Agile and Software Project Management.

Prior to joining CMU, Chick worked for Naval Air Systems Command (NAVAIR) as a project manager, leading software development projects and software process improvement efforts for the E-2C Hawkeye Program, and as a software acquisition lead for the Vertical Take-Off and Landing Tactical Unmanned Aerial Vehicle (VTUAV) Program.

He holds an MS in Computer Science from Johns Hopkins University and a BS in Computer Engineering from Clemson University.

Past Presentations

Accelerating DSE: Driving Adoption and Transition at NAVAIR/NAWCWD

The August 2026 Tech Talk was presented by Jennifer Ambrecht and Wendy ChangAbstractWhile the engineering community is increasingly familiar with what Digital Systems Engineering (DSE) is, the true challenge often lies in execution, adoption, and cultural shift. This...

Why Battle-Tested Software Engineering Still Matters in the Age of AI

The June 2026 Tech Talk was presented by Mario BenitezAbstractWhile use of AI in developing and maintaining software is increasing globally, this use is relatively new, and proven practices for using AI effectively are still emerging. There are different ways to use...

The SEA Data Warehouse

The April 2026 Tech Talk announced the availability of the SEA Data WarehouseAbstractThe Data Warehouse Working Group was initiated in September 2022, with the purpose of advancing the state of the practice and the art of software engineering by providing a source of...

Agentic Coding: The Earthquake That Topples the Software Factory

The March 2026 Tech Talk was presented by Larry MaccheroneAbstractThe tectonic plates beneath software development are shifting. They are moving too fast to predict what the landscape will look like when the earthquake hits. Still, we are sure that the coming...

Why Program Increment Estimates Miss: Hidden Variables for Planning

The February 2026 Tech Talk was presented by Dr. Bill Nichols and Dr. Tapajit Dey AbstractWhat is a credible range of dates for when the work in a product increment might finish? Software development work includes many sources of uncertainty, including the size of the...

Lessons from Using LLMs to Check Software Security

The January 2026 Tech Talk was presented by Dr. Mark ShermanAbstractLarge language models (LLMs) like ChatGPT are transforming the landscape of software development and evaluation, although claims of AI replacing programmers are often overstated. This session delves...

Process Isn’t a Four-Letter Word

The November 2025 Tech Talk was presented by David TumaAbstractAgile methods emerged as a direct rebellion against the heavyweight processes of the 1990s. And the Team Software Process (TSP) did too, by brilliantly reimagining process in a lightweight, agile way that...

Agile Strategy: Onward and Upward

The September 2025 Tech Talk was presented by Linda Parker GatesAbstractThis talk describes the application of Agile principles to strategic planning. It explores how applying balanced Agile values — such as prioritizing individuals and interactions, delivering...

Engineering of Complex Systems at NAVAIR: We Must Do More With Less!

The June 2025 tech talk was presented by Jeff SchwalbAbstractAt NAVAIR, we are experiencing a dwindling engineering workforce at the same time that we are trying to meet increasing demands for support to our warfighters. We have a combination of efforts uplifting the...

Victims vs. Victors: Navigating Career Uncertainty with Resilience

The May 2025 tech talk was presented by David VanEppsAbstractSetbacks are inevitable. Travel freezes, budget cuts, hiring slowdowns, layoffs — challenges like these can shake our sense of stability. While we can’t always control what happens, we can control how we...

Applying STPA to Improve Safety and Reliability of AI-Enabled Systems

The April 2025 tech talk was presented by Timothy DavisonAbstractThis talk explores the application of System-Theoretic Process Analysis (STPA) to enhance the safety and reliability of AI-enabled systems. STPA provides a structured and scalable approach to identifying...

Drive Improved Holistic Business Results with Lean/Agile Practices

The February 2025 tech talk was presented by Fred KoosAbstractAgile practices have roots in Lean Thinking and the Toyota Production System. These are holistic approaches to improve business results. As the word “Agile” was coined in 2001, the applications were...

Clarify Your Acceptance Criteria with GIVEN-WHEN-THEN

The January 2025 tech talk was presented by Matt McConnellAbstractGherkin, also known as GIVEN-WHEN-THEN, is an effective method for writing Acceptance Criteria at many levels in software development. It treats the software as a black box, focusing on the inputs,...

Share This