Supply-chain risk management: Incorporating security into software development

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2010, Pages

  Ellison, Robert J ^a   Woody, Carol ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ATTACK PATTERNS; COMMERCIAL OFF-THE-SHELF PRODUCTS; DATA FLOW; SOFTWARE ACQUISITION; SOFTWARE ASSURANCE; SOFTWARE DEFECTS; SOFTWARE DEVELOPMENT;

COMPUTER SOFTWARE; DATA FLOW ANALYSIS; DEFECTS; RISK MANAGEMENT; RISKS; SOFTWARE DESIGN;

SUPPLY CHAIN MANAGEMENT;

EID: 77951740753     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2010.355     Document Type: Conference Paper

References (11)

1. Howard, Michael & Lipner, Steve. The Security Development Lifecycle. Microsoft Press, 2006
2. Simpson, Stacy, editor. "Fundamental Practices for Secure Software Development quot; http://www.safecode.org/publications/SAFECode-Dev- Practices1008.pdf (2008)
3. McGraw, Gary; Chess, Brian; & Migues, Sammy. "The Building Security In Maturity model" http://www.bsimm. com/ (2009)
4. Howard, Michael. " Fending Off Future Attacks by Reducing Attack Surface" http://msdn.microsoft.com/enus/ library/ms972812.aspx (2003)
5. Howard, Michael; Pincus, Jon; & Wing, Jeannette. "Measuring Relative Attack Surfaces." Proceedings of Workshop on Advanced Developments in Software and Systems Security, Taipei, December 2003. http://www.cs.cmu.edu/ ~wing/publications/Howard-Wing03.pdf
6. Swiderski, Frank & Snyder, Window. Threat Modeling. Microsoft Press, 2004
7. National Institute of Standards and Technology, "Recommended Security Controls for Federal Information Systems and Organizations", NIST Special Publication 800-853 Revision 3, http://csrc.nist.gov/publications/ nistpubs/800-53-Rev3/sp800-53-rev3-final-errata.pdf, 2009
8. Steingruebl, Andy & Peterson, Gunnar. "Software Assumptions Lead to Preventable Errors." IEEE Computer. August/September (2009): 84-87
9. Howard, Michael, " Improving Software Security by Eliminating the CWE Top 25 Vulnerabilities." IEEE Computer. June/July (2009): 68-71
10. Ellison, Robert; Goodenough, John; Weinstock, Charles; & Woody, Carol. Survivability Assurance for System of Systems. CMU/SEI-2008-TR-008. Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2009.
11. Simpson, Stacy, editor. "The Software Supply Chain Integrity Framework. http://www.safecode.org/publications/SAFECode-Supply-Chain0709.pdf (2009)