Security | Software Excellence Alliance

The May 2024 tech talk was presented by Tim Chick

Abstract

The SEI has been in the forefront of secure software development, promoting a “shift left” approach, whereby security weaknesses are addressed, prevented, or eliminated earlier in the software development cycle, saving time and money.

In this presentation, we will discuss security being an integral aspect of the entire software lifecycle as a result of following deliberate, intentional engineering processes, rather than security being addressed in individual stages as one-off activities.

About the Presenter

Tim Chick is the CERT Applied Systems Group Technical Manager at Carnegie Mellon University’s (CMU) Software Engineering Institute (SEI). He currently leads a team of software and system engineers as they build and operate technical solutions for both internally-funded research and customer-facing prototypes, and delivers trusted, valued, and relevant software engineering and cybersecurity approaches for software intensive systems through engineering and consulting support to DoD and DHS programs. In collaboration with technical experts across the SEI, the team assists organizations with the application of Agile and DevSecOps practices and the adoption of emerging technologies needed to keep pace with evolving opportunities, risks, and threats.

He is also an adjunct faculty member at CMU’s Software and Societal Systems Department (S3D), where he teaches courses on Agile and Software Project Management.

Prior to joining CMU, Chick worked for Naval Air Systems Command (NAVAIR) as a project manager, leading software development projects and software process improvement efforts for the E-2C Hawkeye Program, and as a software acquisition lead for the Vertical Take-Off and Landing Tactical Unmanned Aerial Vehicle (VTUAV) Program.

He holds an MS in Computer Science from Johns Hopkins University and a BS in Computer Engineering from Clemson University.

Embracing Generative AI: The Future Isn’t Written, It’s Generated!

The February 2024 Tech Talk was presented by Chandika Mendis

Abstract

The printing press birthed the Renaissance. The steam engine sparked the Industrial Age. Now, Generative AI stands poised to be the Gutenberg of our time. This revolutionary tech isn’t just tools – it’s a productivity paradigm shift, impacting the industries and use-cases we least expected to be impacted through Artificial Intelligence: those use-cases we thought epitomized human intelligence and creativity. This paradigm shift opens up amazing new opportunities while also exposing us to new kinds of risks.

This talk attempts to explore the impact of Generative AI on our future and how we can embrace it:

Introduction to generative AI and its impact across industries
Practical applications and real-world examples
Common challenges and approach to adoption
Understand the risks and new threats this technology opens up

Now is our chance to embrace this new technology or be swept away by its tide.

About the Presenter

Chandika Mendis is a senior technology leader who plays the roles of CTO, board advisor, and angel investor for a number of tech startups. Prior to his current roles, he was the EVP and Global Head of Engineering for Virtusa. He lead the innovation teams that created award-winning IP that were a key part of Virtusa’s strategic competitive advantage. Chandika’s technology contributions were instrumental in driving Virtusa’s growth, from 300 when he joined in 2003, to 45,000 when he left in 2023 to pursue his passion helping early-stage startups. The teams under his purview won the Stevie Award for the best IT Team, the Gold Stevie for the most Innovative Technology Company, as well as the Best Product award in multiple categories. Chandika was also responsible for setting up the processes and systems to scale engineering governance activities, as well as mentoring senior technologists at Virtusa. Since leaving Virtusa, Chandika has been involved with startups leveraging innovative technologies including Generative AI, Industrial Metaverse and Cybersecurity.

The Real Cost of Bad Software Quality in the U.S. in 2022

The July 2023 tech talk was presented by Herb Krasner

Get the Detailed Tech Report

Abstract

This presentation will introduce The Cost of Poor Software Quality in the US: A 2022 Report, published in December 2022 by CISQ. We highlight the rapidly growing costs of cybersecurity failures and software technical debt. The trends and enablers of these growing costs are discussed.

CISQ’s 2020 report estimated that poor software quality cost the United States economy over $2 trillion in 2020 due to operational software failures, poor quality legacy systems, and unsuccessful projects. Compared to the country’s projected Gross Domestic Product (GDP) of $20.66 trillion, or the $1.4 trillion spent on employing IT/software professionals in 2020, it represents a staggering amount of wasted resources. This talk will share the updated results from 2022.

Author, Herb Krasner, will introduce the important findings in the report, which is full of facts, figures, case histories, references, and specific recommendations for how and where to find these burdensome costs and how to prevent or avoid them.

About the Presenter

Herb Krasner

Since early 2017, Herb has had the luxury of getting involved in whatever sparks his interest or is stimulated by his professional expertise/contacts. This led to his publication of the Cost of Poor-Quality Software in the US: A 2018 report, widely read and cited on the internet. This report has since stimulated podcasts, blogs, webinars, and other related opportunities.

In 2017, Herb retired from his 18-year position as Professor of Software Engineering at the University of Texas at Austin (UT), where he taught undergraduate and graduate classes in software engineering, database engineering, agile methods, and software quality and process improvement. He also performed and supervised research in the science of software design, the economics of software engineering, and software quality/process improvement.

As a research scientist, he is well known for his leading-edge work on modeling the cost/benefits of software quality and reporting the ROI data for software process improvement programs, as well as the reported results from his groundbreaking empirical studies of professional programmers performed at MCC. He has published over 55 papers, articles, and book sections, and has spoken at many professional conferences and meetings. As founder, Chairman, and former Director of the Software Quality Institute (SQI) at the University of Texas, he was largely responsible for creating and shaping the software engineering educational outreach organization into a successful business entity.

Herb currently serves on the Missouri S&T Computer Science Department’s Academy of Computer Science. and is an Advisory Board Member for the Consortium for IT Software Quality He is active in both the ACM and IEEE Computer Society, and served as past chairman of several international conferences, as well as Director of the ACM Scholastic Student Programming Contest. He was a book series editor for the IEEE Computer Society Press and a member of their Publications Board. His professional awards include the ACM Distinguished Service Award and ASQ Golden Quill Award.

Why Can’t Johnny Program Securely?

The October 2022 tech talk was presented by Robert Seacord

Abstract

Secure coding (unsurprisingly) is hard. Our educational systems have failed to properly prepare students, and our assessments have overestimated their abilities. Analysis and testing is useful but inadequate. This presentation will discuss the gap in qualified secure coders and what we can do to eliminate it.

About the Presenter

Robert C. Seacord is the Standardization Lead at Woven Planet, where he works on the software craft. Robert was previously a Technical Director at NCC Group, Secure Coding Manager at Carnegie Mellon’s Software Engineering Institute, and an adjunct professor in the School of Computer Science and the Information Networking Institute at Carnegie Mellon University.

He is the author of seven books, including Effective C: An Introduction to Professional C Programming (No Starch Press, 2020), The CERT C Coding Standard, Second Edition (Addison-Wesley, 2014) Secure Coding in C and C++, Second Edition (Addison-Wesley, 2013), and Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs (Addison-Wesley, 2014). He has also published more than 50 papers on software security, component- based software engineering, web-based system design, legacy-system modernization, component repositories and search engines, and user interface design and development. Robert has been teaching secure coding in C and C++ to private industry, academia, and government since 2005. He started programming professionally for IBM in 1982, working in communications and operating system software, processor development, and software engineering; he also has worked at the X Consortium, where he developed and maintained code for the Common Desktop Environment and the X Window System. Robert is on the advisory board for the Linux Foundation and is an expert at the ISO/IEC JTC1/SC22/WG14 international standardization working group for the C programming language.

Putting the “Sec” in DevSecOps… Quantified

Past Presentation

The March 2021 tech talk was presented by Larry Maccherone