SDCI Sec New: In-Depth Vulnerability Assessment of Middleware

点击翻译按钮获取中文摘要

This research establishes MIST, the MIddleware Security and Testing facility,to identify security vulnerabilities in middleware, which include e-commercesystems, supercomputers, and scientific and commercial networks. Theresearchers are identifying limitations in current abilities to identify andremediate vulnerabilities in the middleware. The limitations include assessmenttechniques that provide insufficient focus on critical vulnerabilities and aresubject to high false-positives, tools that provide limited abilities to find serious vulnerabilities, little or no formal characterization ofvulnerabilities, lack of trained security analysts to perform vulnerabilityassessment, scarcity of curricula, both in academia and professional training,for training security analysts, scarcity of training in software engineeringand design techniques for secure systems, and lack of independent vulnerabilityassessment activities in middleware software development.The researchers are developing first principles based vulnerability assessment(FPVA) that starts with architectural and resource analysis of the software,identifying high-value assets, and then derives threats based on how theassets are used. This research includes new and extended algorithms andtechniques for tools to help improve the automation of this task, and newsoftware engineering and coding techniques for developing secure systems.Results from their FPVA assessment activities are used to develop formalcharacterizations of these hard-to-discover vulnerabilities and, from thesecharacterizations, develop algorithms for detecting these vulnerabilities.From algorithms, they are developing new automated tools for detection. Thetools take the form of plug-ins to existing tools (to reduce unnecessaryeffort and time-to-deployment). This project expands the skills software developers by developing trainingmaterials in the form of tutorials, short courses, and a new undergraduatecourse in vulnerability assessment and secure coding practices.