1. Software Assurance Security Issues
SAM 301
Lesson 14
Software Assurance Security Issues

2. Topics Covered Cyberterrorism
Building Security in Continuous Integration
Risk Management Framework for SOA Certification and Accreditation
SPI Software Protection Initiative
Software Security Engineering

3. What is Information Assurance?
Activities that protect and defend information and information systems by ensuring their: availability, integrity, authentication, confidentiality, and non-repudiation.

4. Information Assurance
Availability:
Timely, reliable access to data and information services
Integrity:
Protection from unauthorized change
Authentication:
Verification of Originator
Confidentiality:
Protection from unauthorized disclosure
Non-repudiation:
Undeniable proof of participation

5. Transformation
Impetus for Change
“The two truly transforming things, conceivably, might be in information technology and information operation and networking and connecting things in ways that they function totally differently than they had previously. And if that's possible, what I just said, that possibly the single-most transforming thing in our force will not be a weapon system, but a set of interconnections and a substantially enhanced capability because of that awareness.”
Secretary Rumsfeld - Aug 9, 2001
Platform-Centric
Information Advantage
Network-Centric
Information
Quality
Content
Accuracy
Timeliness
Relevance
Local
Global
Regional
61 el. Theater
8GHz MBR
169 el. 7GHz MBT
44/20
256 element
TPA
484 element
RPA
Network-Centric Operations:
Military operations enabled by “Networking the Force”
“Networking the Force” is accomplished through distributed collaboration processes designed to ensure that all pertinent available information is shared and that all appropriate assets can be brought to bear to by commanders to employ dominant maneuver, precision engagement, full-dimensional protection, and focused logistics.

6. Threats to the Global Information Grid
Traditional Threats
Non-Traditional &
Emerging Threats
Computer Network Operations
Cleared “Insiders”
Viruses
Electro Magnetic Pulse Attack
Crypto Attacks
Nodal Attacks on Networks
Terrorism vs. Critical Infrastructure
Attacks on Critical Infrastructure
Commercial Pressure on Spectrum
Competing Demands on Resources
Globalization
Slow Government Cycle Times
Law Enforcement vs. National Security Focus
Unqualified Workforce
Outmoded Protection Policies

7. INSTRUCTOR WILL ASSIGN
Reading Assignments
INSTRUCTOR WILL ASSIGN

8. Summary Cyberterrorism Building Security in Continuous Integration
Security Controls for SOA Certification and Accreditation
SPI Software Protection Initiative
Software Security Engineering