Carnegie Mellon University, Software Engineering Insitute

Results per page

Developing and Using a Software Bill of Materials Framework

April 9, 2024 • Podcast

By Michael S. Bandor , Carol Woody

Carol Woody and Michael Bandor discuss a Software Bill of Materials framework to help organizations establish a comprehensive set of practices and processes.
LISTEN
2024-4-9
The Importance of Diversity in Cybersecurity: Carol Ware

March 21, 2024 • Podcast

By Carol Ware

Carol Ware, a senior cybersecurity engineer in the SEI's CERT Division, discusses the evolution of her career and the importance of diversity in the field.
LISTEN
2024-3-21
The Importance of Diversity in Artificial Intelligence: Violet Turri

March 19, 2024 • Podcast

By Violet Turri

Violet Turri, a software developer in the SEI’s AI Division, discusses the evolution of her career in AI and the importance of diversity in the field.
LISTEN
2024-3-19
Using Large Language Models in the National Security Realm

March 5, 2024 • Podcast

By Shannon Gallagher

Shannon Gallagher discusses findings and recommendations from the Mayflower Project and provides additional background information about LLMs and how they can be engineered for national security use.
LISTEN
2024-3-5
Atypical Applications of Agile and DevSecOps Principles

February 16, 2024 • Podcast

By Lyndsi A. Hughes , David Sweeney

Lyndsi Hughes and David Sweeney discuss their experiences leveraging DevSecOps pipelines in atypical situations for capability delivery and business mission.
LISTEN
2024-2-16
When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction

February 9, 2024 • Podcast

By Stephen Wilson , Patrick R. Place

Patrick Place and Stephen Wilson discuss seven considerations for successful use of Agile and EVM.
LISTEN
2024-2-9

Agile
The Impact of Architecture on the Safety of Cyber-Physical Systems

January 31, 2024 • Podcast

By Jerome Hugues

Jerome Hugues discusses challenges that arise from the increasing autonomy in cyber-physical systems including transferring and processing multiple data streams.
LISTEN
2024-1-31

Cyber-Physical Systems
ChatGPT and the Evolution of Large Language Models: 4 Case Studies

December 14, 2023 • Podcast

By Matthew Walsh , Dominic A. Ross

Matthew Walsh, a senior data scientists in CERT, and Dominic Ross, Multi-Media Design Team Lead, discuss their work in developing four case studies to understand limitations and future uses of …
LISTEN
2023-12-14

Artificial Intelligence Engineering
The Cybersecurity of Quantum Computing: 6 Areas of Research

December 4, 2023 • Podcast

By Tom Scanlon

Thomas Scanlon, lead of the SEI Data Science Group, discusses how to create the discipline of cyber protection of quantum computing and outlines six areas of future research in the …
LISTEN
2023-12-4

Quantum Computing
User-Centric Metrics for Agile

November 21, 2023 • Podcast

By Patrick R. Place , Will Hayes

Will Hayes and Pat Place discuss the importance of user stories in Agile metrics.
LISTEN
2023-11-21
The Product Manager’s Evolving Role in Software and Systems Development

November 14, 2023 • Podcast

By Judy Hwang

Judy Hwang discusses the importance of implementing product management principles in software and systems development and resources to strengthen Agile product delivery practices.
LISTEN
2023-11-14

Agile
Measuring the Trustworthiness of AI Systems

October 16, 2023 • Podcast

By Carol J. Smith , Katherine-Marie Robinson , Alexandrea Steiner

Carol Smith, Katie Robinson, and Alex Steiner discuss how to measure the trustworthiness of an AI system as well as questions that organizations should ask before determining if they want …
LISTEN
2023-10-16

Artificial Intelligence Engineering
Actionable Data in the DevSecOps Pipeline

September 27, 2023 • Podcast

By Bill Nichols , Julie B. Cohen

Bill Nichols and Julie Cohen talk with Suzanne Miller about how automation within DevSecOps product-development pipelines provides new opportunities for program managers (PMs) to confidently make decisions with the help …
LISTEN
2023-9-27

DevSecOps
Insider Risk Management in the Post-Pandemic Workplace

September 7, 2023 • Podcast

By Daniel L. Costa , Randall F. Trzeciak

Dan Costa and Randy Trzeciak discuss how remote work in the post-pandemic world is changing expectations about employee behavior monitoring and insider risk detection.
LISTEN
2023-9-7

Governance, Executive, Insider Threat, Incident Handling
An Agile Approach to Independent Verification and Validation

August 15, 2023 • Podcast

By Justin Smith

Justin Smith, senior Agile transformation leader in the SEI Software Solutions Division, talks with principal researcher Suzanne Miller about how to bring concepts from Lean and Agile software development into …
LISTEN
2023-8-15

system verification and validation, Agile
Zero Trust Architecture: Best Practices Observed in Industry

July 27, 2023 • Podcast

By Matthew Nicolai , Nathaniel Richmond

Matthew Nicolai and Nathaniel Richmond discuss five best practices in implementing a zero trust architecture, explain their significance, and provide commentary and analysis on ways to empower your organization’s zero …
LISTEN
2023-7-27

Cybersecurity, Cybersecurity Engineering, Developer, System Administrator
Automating Infrastructure as Code with Ansible and Molecule

July 11, 2023 • Podcast

By Matthew Heckathorn

Matthew Heckathorn, an integration engineer with the SEI’s CERT Division, offers guidance for systems engineers, system administrators, and others on developing Ansible roles and automating infrastructure as code.
LISTEN
2023-7-11
Identifying and Preventing the Next SolarWinds

June 27, 2023 • Podcast

By Greg Touhill

Gregory J. Touhill, director of the SEI CERT Division, talks with Suzanne Miller about the 2020 attack on SolarWinds software and how to prevent a recurrence of another major attack …
LISTEN
2023-6-27

Performance and Dependability, System of Systems, Supply Chain Assurance, Cybersecurity, Cybersecurity Engineering
A Penetration Testing Findings Repository

June 22, 2023 • Podcast

By Samantha Chaves , Marisa Midler

Marisa Midler and Samantha Chaves talk with Suzanne Miller about an open-source penetration testing findings repository that they created.
LISTEN
2023-6-22

CERT/CC Vulnerabilities, Security Vulnerabilities, Researcher, Tools, Sponsor, Cybersecurity, CERT/CC, Critical Infrastructure Protection
Understanding Vulnerability Analysis in the Rust Programming Language

June 6, 2023 • Podcast

By Garret Wassermann , David Svoboda

David Svoboda and Garret Wassermann explore tools for understanding vulnerabilities in Rust whether the original source code is available or not.
LISTEN
2023-6-6

Secure Coding, Cybersecurity, Cybersecurity Engineering, Reverse Engineering for Malware Analysis, Developer, Executive, Educator, Sponsor, Researcher
We Live in Software: Engineering Societal-Scale Systems

May 25, 2023 • Podcast

By John E. Robert , Forrest Shull

John Robert, deputy director of the SEI’s Software Solutions Division, and Forrest Shull, lead for defense software acquisition policy research at the SEI, discuss issues that must be considered when …
LISTEN
2023-5-25

Reverse Engineering, software engineering and information assurance
Secure by Design, Secure by Default

May 11, 2023 • Podcast

By Greg Touhill

Gregory J. Touhill, director of the SEI CERT Division, talks with Suzanne Miller about secure by design, secure by default, a longstanding tenet of the work of the SEI and …
LISTEN
2023-5-11

Governance, Resilience Management Model (RMM), Cybersecurity, Cybersecurity Engineering, Developer, General Public, Sponsor
Key Steps to Integrate Secure by Design into Acquisition and Development

May 4, 2023 • Podcast

By Robert Schiela , Carol Woody

Robert Schiela and Carol Woody talk with Suzanne Miller about the importance of integrating the practices and mindset of secure by design into the acquisition and development of software-reliant systems.
LISTEN
2023-5-4

Best Practices, Cybersecurity, Cybersecurity Engineering
An Exploration of Enterprise Technical Debt

April 18, 2023 • Podcast

By Stephany Bellomo

Stephany Bellomo, a principal engineer in the SEI’s Software Solutions Division, talks with principal researcher Suzanne Miller about identifying and remediating enterprise technical debt.
LISTEN
2023-4-18

Technical Debt Workshop, Technical Debt, software engineering and information assurance, Software Architecture, Developer, System Administrator
The Messy Middle of Large Language Models

April 4, 2023 • Podcast

By Jay Palat , Rachel Dzombak

Jay Palat and Rachel Dzombak discuss the current landscape of large language models (LLMs) and how to leverage tools built on top of LLMs, such as ChatGPT and Copilot.
LISTEN
2023-4-4

Artificial Intelligence Engineering, Researcher, Autonomy and Counter-Autonomy
An Infrastructure-Focused Framework for Adopting DevSecOps

March 30, 2023 • Podcast

By Vanessa B. Jackson , Lyndsi A. Hughes

Vanessa Jackson and Lyndsi Hughes discuss the DevSecOps adoption framework, which guides organizations in the planning and implementation of a roadmap to functional CI/CD pipeline capabilities.
LISTEN
2023-3-30

DevSecOps
Software Security in Rust

March 21, 2023 • Podcast

By David Svoboda , Joe Sible

David Svoboda and Joe Sible talk with Suzanne Miller about the Rust programming language and its security-related features.
LISTEN
2023-3-21

Secure Coding, Secure Development, Developer, Executive, General Public
Improving Interoperability in Coordinated Vulnerability Disclosure with Vultron

February 28, 2023 • Podcast

By Allen D. Householder

Allen Householder, a senior vulnerability and incident researcher with the SEI’s CERT Division, talks with SEI principal investigator Suzanne Miller about Vultron, a protocol for multi-party coordinated vulnerability disclosure (MPCVD).
LISTEN
2023-2-28

Security Vulnerabilities
Asking the Right Questions to Coordinate Security in the Supply Chain

February 9, 2023 • Podcast

By Carol Woody

Carol Woody talks with Suzanne Miller about the SEI’s newly released Acquisition Security Framework, which helps programs coordinate the management of engineering and supply-chain risks across system components.
LISTEN
2023-2-9

Developer, System Administrator, Acquisition
Securing Open Source Software in the DoD

January 26, 2023 • Podcast

By Scott Hissam , Linda Parker Gates

Scott Hissam talks with Linda Parker Gates about the use of free and open-source software (FOSS) in the DoD, building on insights that surfaced in a recent workshop held for …
LISTEN
2023-1-26

Acquisition, Governance, Software Engineering Research and Development, software engineering and information assurance, Sponsor
A Model-Based Tool for Designing Safety-Critical Systems

January 5, 2023 • Podcast

By Lutz Wrage , Sam Procter

Sam Procter and Lutz Wrage discuss with Suzanne Miller the Guided Architecture Trade Space Explorer (GATSE), a new SEI-developed model-based tool to help with the design of safety-critical systems.
LISTEN
2023-1-5

software engineering and information assurance, Software Architecture, Developer, Educator
Managing Developer Velocity and System Security with DevSecOps

December 6, 2022 • Podcast

By Alejandro Gomez

Alejandro Gomez talks with Suzanne Miller about how his team explored—and eventually resolved—the two competing forces of developer velocity and cybersecurity enforcement by implementing DevSecOps.
LISTEN
2022-12-6

DevSecOps, Cybersecurity
A Method for Assessing Cloud Adoption Risks

November 17, 2022 • Podcast

By Christopher J. Alberts

Chris Alberts discusses with Suzanne Miller a prototype set of cloud adoption risk factors and describes a method that managers can employ to assess their cloud initiatives against these risk …
LISTEN
2022-11-17

Cloud Computing, Cyber Risk and Resilience Management
Software Architecture Patterns for Deployability

November 15, 2022 • Podcast

By Rick Kazman

Rick Kazman, an SEI visiting scientist and coauthor of Software Architecture in Practice, talks with principal researcher Suzanne Miller about using patterns for software deployability.
LISTEN
2022-11-15

Best Practices, Software Architecture
A Roadmap for Creating and Using Virtual Prototyping Software

October 27, 2022 • Podcast

By Douglass Post (DoD High Performance Computing Modernization Program) , Richard Kendall

Douglass Post and Richard Kendall discuss their experiences applying virtual prototyping in Computational Research and Engineering Acquisition Tools and Environments (CREATE).
LISTEN
2022-10-27

software engineering and information assurance, Agile
ML-Driven Decision-Making in Realistic Cyber Exercises

October 20, 2022 • Podcast

By Dustin D. Updyke , Thomas G. Podnar

Thomas Podnar and Dustin Updyke discuss efforts by the SEI CERT Division to apply machine learning to increase the realism of non-player characters (NPCs) in cyber training exercises.
LISTEN
2022-10-20

Best Practices, Autonomy and Counter-Autonomy
Software Architecture Patterns for Robustness

September 15, 2022 • Podcast

By Rick Kazman

Rick Kazman discusses software architecture patterns and the effect that certain architectural patterns have on quality attributes, such as availability and robustness.
LISTEN
2022-9-15

Software Engineering Research and Development, Software Architecture
A Platform-Independent Model for DevSecOps

September 8, 2022 • Podcast

By Timothy A. Chick , Joe Yankel

Tim Chick and Joe Yankel present a DevSecOps Platform-Independent Model that uses model-based systems engineering (MBSE) to formalize the practices of DevSecOps pipelines and organize relevant guidance.
LISTEN
2022-9-8

Tools, DevSecOps
Using the Quantum Approximate Optimization Algorithm (QAOA) to Solve Binary-Variable Optimization Problems

August 30, 2022 • Podcast

By Jason Larkin , Daniel Justice

Jason Larkin and Daniel Justice, researchers in the SEI’s AI Division, discuss a paper outlining their efforts to simulate the performance of Quantum Approximate Optimization Algorithm (QAOA) for the Max-Cut …
LISTEN
2022-8-30

Quantum Computing
A Dive into Deepfakes

August 18, 2022 • Podcast

By Shannon Gallagher , Dominic A. Ross

Shannon Gallagher, a data scientist with SEI’s CERT Division, and Dominic Ross, multimedia team lead for the SEI, discuss deepfakes, their exponential growth in recent years, and their increasing technical …
LISTEN
2022-8-18

Autonomy and Counter-Autonomy
Trust and AI Systems

August 11, 2022 • Podcast

By Carol J. Smith , Dustin D. Updyke

Carol Smith, a senior research scientist in human machine interaction, and Dustin Updyke, a senior cybersecurity engineering in the SEI’s CERT Division, discuss the construction of trustworthy AI systems and …
LISTEN
2022-8-11

Artificial Intelligence Engineering
Challenges and Metrics in Digital Engineering

July 14, 2022 • Podcast

By Bill Nichols

Bill Nichols and Suzanne Miller discuss the challenges in making the transition from traditional development practices to digital engineering.
LISTEN
2022-7-14

Software Engineering Research and Development, Software Architecture
The 4 Phases of the Zero Trust Journey

July 7, 2022 • Podcast

By Timothy Morrow , Matthew Nicolai

Tim Morrow and Matthew Nicolai outline 4 steps that organizations can take to implement and maintain a zero trust architecture.
LISTEN
2022-7-7

Cyber-Physical Systems, Best Practices, Governance, Software Architecture
DevSecOps for AI Engineering

June 23, 2022 • Podcast

By Jay Palat , Hasan Yasar

Hasan Yasar and Jay Palat discuss how to engineer AI systems with DevSecOps and explore the relationship between MLOps and DevSecOps.
LISTEN
2022-6-23

DevSecOps, Artificial Intelligence Engineering, Agile
Undiscovered Vulnerabilities: Not Just for Critical Software

June 2, 2022 • Podcast

By Jonathan Spring

Jonathan Spring discusses the findings in a recent paper that analyzes the number of undiscovered vulnerabilities in information systems.
LISTEN
2022-6-2

Science of Cybersecurity, CERT/CC, Cybersecurity
Explainable AI Explained

May 19, 2022 • Podcast

By Violet Turri

Violet Turri discusses explainable AI, which encompasses all the techniques that make the decision-making processes of AI systems understandable to humans.
LISTEN
2022-5-19

Artificial Intelligence Engineering
Model-Based Systems Engineering Meets DevSecOps

April 7, 2022 • Podcast

By Joe Yankel , Jerome Hugues

Jerome Hugues and Joe Yankel discuss ModDevOps, an extension of DevSecOps that embraces model-based systems engineering (MBSE) practices and technology.
LISTEN
2022-4-7

Software Engineering Research and Development, DevSecOps
Incorporating Supply Chain Risk and DevSecOps into a Cybersecurity Strategy

March 24, 2022 • Podcast

By Carol Woody

Carol Woody, a principal researcher in the SEI's CERT Division, talks with Suzanne Miller about supply-chain issues and the planning needed to integrate software from the supply chain into operational …
LISTEN
2022-3-24

Science of Cybersecurity, Best Practices, Cybersecurity Engineering, DevSecOps
Software and Systems Collaboration in the Era of Smart Systems

March 10, 2022 • Podcast

By Paul Nielsen

SEI director Paul Nielsen talks with principal researcher Suzanne Miller about how the advent of smart systems has led to a growing need for effective collaboration between the disciplines of …
LISTEN
2022-3-10

Acquisition, System of Systems, Ultra-Large-Scale Systems, Software Engineering Research and Development, Software Architecture
Securing the Supply Chain for the Defense Industrial Base

March 1, 2022 • Podcast

By Katie C. Stewart , Gavin Jurecko

Gavin Jurecko, who leads the SEI’s Resilience Diagnostics Team, talks with Katie Stewart about risks associated with defense industrial base (DIB) supply chains and how the SEI works with the …
LISTEN
2022-3-1

Acquisition, Best Practices, Critical Infrastructure Protection
Building on Ghidra: Tools for Automating Reverse Engineering and Malware Analysis

February 10, 2022 • Podcast

By Garret Wassermann , Jeff Gennari

Jeffrey Gennari and Garret Wassermann talk with Suzanne Miller about Kaiju, a series of tools that they have developed that allows for malware analysis and reverse engineering. Kaiju helps analysts …
LISTEN
2022-2-10

Tools, Reverse Engineering, Cybersecurity, Reverse Engineering for Malware Analysis
Envisioning the Future of Software Engineering

January 25, 2022 • Podcast

By Anita Carleton , Forrest Shull

Anita Carleton and Forrest Shull discuss the recently published SEI-led study Architecting the Future of Software Engineering: A National Agenda for Software Engineering Research & Development.
LISTEN
2022-1-25

Acquisition, System of Systems, Ultra-Large-Scale Systems, Measurement and Analysis, Critical Infrastructure Protection, Governance, software engineering and information assurance, Artificial Intelligence Engineering, Software Architecture
Implementing the DoD's Ethical AI Principles

January 13, 2022 • Podcast

By Carol J. Smith , Alexandrea Steiner

In this SEI podcast, Alex Van Deusen and Carol Smith, both with the SEI's AI Division, discuss a recent project in which they helped the Defense Innovation Unit of the …
LISTEN
2022-1-13

Best Practices, Artificial Intelligence Engineering
Walking Fast Into the Future: Evolvable Technical Reference Frameworks for Mixed-Criticality Systems

December 9, 2021 • Podcast

By Douglas Schmidt (Vanderbilt University) , Nickolas Guertin

In this SEI Podcast, Suzanne Miller talks with Nickolas Guertin and Douglas Schmidt about strategies for creating architectures for large-scale, complex systems that comprise functions with a wide range of …
LISTEN
2021-12-9

software engineering and information assurance, Software Architecture
Software Engineering for Machine Learning

November 18, 2021 • Podcast

By Ipek Ozkaya , Grace Lewis

Grace Lewis and Ipek Ozkaya discuss their research into software engineering for machine learning (ML) with host Jonathan Spring.
LISTEN
2021-11-18

software engineering and information assurance, Software Engineering Research and Development
A Discussion on Automation with Watts Humphrey Award Winner Rajendra Prasad

November 16, 2021 • Podcast

By Rajendra T. Prasad (Accenture)

In this SEI Podcast, 2020 IEEE Computer Society SEI Watts Humphrey Software Quality Award winner Rajendra Prasad of Accenture talks with Mike Konrad of the SEI about automation.
LISTEN
2021-11-16

Process Improvement, Best Practices
Enabling Transition from Sustainment to Engineering within the DoD

November 4, 2021 • Podcast

By Thomas Evans , Douglas Schmidt (Vanderbilt University)

Thomas Evans and Douglas C. Schmidt discuss challenges sustainment teams face when transitioning from sustainment to engineering in the DoD.
LISTEN
2021-11-4

Software Engineering Research and Development
The Silver Thread of Cyber in the Global Supply Chain

October 28, 2021 • Podcast

By Matthew J. Butkovic

Matt Butkovic, technical director of risk and resilience in the SEI's CERT Division, discusses with Suzanne Miller the importance of cyber in the global supply chain and his team's work …
LISTEN
2021-10-28

Cyber Risk and Resilience Management, Enterprise Risk and Resilience Management
Measuring DevSecOps: The Way Forward

October 14, 2021 • Podcast

By Bill Nichols , Hasan Yasar

Bill Nichols and Hasan Yasar discuss the ways in which DevSecOps practices yield valuable information about software performance that is likely to lead to innovations in software engineering metrics.
LISTEN
2021-10-14

DevSecOps
Bias in AI: Impact, Challenges, and Opportunities

September 30, 2021 • Podcast

By Carol J. Smith , Jonathan Spring

Carol Smith discusses with Jonathan Spring the hidden sources of bias in artificial intelligence (AI) systems and how systems developers can raise their awareness of bias, mitigate consequences, and reduce …
LISTEN
2021-9-30

Artificial Intelligence Engineering
My Story in Computing with Rachel Dzombak

September 16, 2021 • Podcast

By Rachel Dzombak

In this SEI Podcast, the latest in the “My Story in Computing” series, Rachel Dzombak discusses the journey that led to her current leadership role at the SEI as digital …
LISTEN
2021-9-16

Artificial Intelligence Engineering
Agile Strategic Planning: Concepts and Methods for Success

September 9, 2021 • Podcast

By Suzanne Miller , Linda Parker Gates

Linda Parker Gates, initiative lead, Software Acquisition Pathways, and Suzanne Miller, principal researcher in the SEI's Software Solutions Division, discuss the principles of Agile strategic planning and methods for success.
LISTEN
2021-9-9

Best Practices, Governance, software engineering and information assurance, Agile
Applying Scientific Methods in Cybersecurity

August 26, 2021 • Podcast

By Jonathan Spring , Leigh B. Metcalf

Leigh Metcalf and Jonathan Spring discuss with Suzanne Miller the application of scientific methods to cybersecurity, a subject of their recently published book, Using Science in Cybersecurity.
LISTEN
2021-8-26

Cyber-Physical Systems, Science of Cybersecurity, Cybersecurity
Zero Trust Adoption: Benefits, Applications, and Resources

August 13, 2021 • Podcast

By Geoff Sanders

Geoff Sanders, a senior network defense analyst in the SEI's CERT Division, discusses zero trust adoption and its benefits, applications, and available resources.
LISTEN
2021-8-13

Best Practices, Governance, Cybersecurity, Cybersecurity Engineering
Uncertainty Quantification in Machine Learning: Measuring Confidence in Predictions

August 5, 2021 • Podcast

By Eric Heim

Eric Heim, a senior machine learning research scientist at the Software Engineering Institute at Carnegie Mellon University, discusses the quantification of uncertainty in machine-learning (ML) systems.
LISTEN
2021-8-5

Artificial Intelligence Engineering
11 Rules for Ensuring a Security Model with AADL and Bell–LaPadula

July 29, 2021 • Podcast

By Aaron Greenhouse

Aaron Greenhouse, a senior software architecture researcher, discusses 11 analysis rules that must be enforced over an AADL instance to ensure the consistency of a security model.
LISTEN
2021-7-29

Best Practices, Software Architecture
Benefits and Challenges of Model-Based Systems Engineering

July 22, 2021 • Podcast

By Mary Popeck , Nataliya Shevchenko

Nataliya [Natasha] Shevchenko and Mary Popeck discuss the use of model-based systems engineering (MBSE), which, in contrast to document-centric engineering, puts models at the center of system design.
LISTEN
2021-7-22

software engineering and information assurance
Fostering Diversity in Software Engineering

July 15, 2021 • Podcast

By Jay Palat , Nathan R. West , Ipek Ozkaya , Grace Lewis

Grace Lewis hosts a panel discussion with Ipek Ozkaya, Nathan West, and Jay Palat about diversity in software engineering.
LISTEN
2021-7-15

Best Practices, Software Engineering Research and Development, software engineering and information assurance
Can DevSecOps Make Developers Happier?

July 8, 2021 • Podcast

By Hasan Yasar

Hasan Yasar discusses the cultural aspects of DevSecOps practices.
LISTEN
2021-7-8

software engineering and information assurance, DevSecOps, Governance, Software Engineering Research and Development
Is Your Organization Ready for AI?

June 24, 2021 • Podcast

By Carol J. Smith , Rachel Dzombak

Digital transformation lead Dr. Rachel Dzombak and research scientist Carol Smith discuss how AI Engineering can support organizations to implement AI systems.
LISTEN
2021-6-24

Artificial Intelligence Engineering
My Story in Computing with Marisa Midler

June 17, 2021 • Podcast

By Marisa Midler

Marisa Midler discusses the career path that led to her work as a cybersecurity engineer in the SEI's CERT Division. In all life choices, Midler has been guided by the …
LISTEN
2021-6-17

Cybersecurity Engineering
Managing Vulnerabilities in Machine Learning and Artificial Intelligence Systems

June 10, 2021 • Podcast

By Nathan M. VanHoudnos , Jonathan Spring , Allen D. Householder

Allen Householder, Jonathan Spring, and Nathan VanHoudnos discuss how to manage vulnerabilities in AI/ML systems.
LISTEN
2021-6-10

Security Vulnerabilities, Artificial Intelligence Engineering
AI Workforce Development

May 20, 2021 • Podcast

By Jay Palat , Rachel Dzombak

Rachel Dzombak and Jay Palat discuss growth in the field of artificial intelligence (AI) and how organizations can hire and train staff to take advantage of the opportunities afforded by …
LISTEN
2021-5-20

Best Practices, Artificial Intelligence Engineering
Moving from DevOps to DevSecOps

May 13, 2021 • Podcast

By Hasan Yasar

Hasan Yasar discusses how organizations can transition from DevOps to DevSecOps.
LISTEN
2021-5-13

DevSecOps
My Story in Computing with Dave Zubrow

April 29, 2021 • Podcast

By David Zubrow

David Zubrow discusses his career journey, which led from a PhD in applied history and social sciences to his role as a manager and technical leader at the SEI.
LISTEN
2021-4-29

Measurement and Analysis
Mission-Based Prioritization: A New Method for Prioritizing Agile Backlogs

April 22, 2021 • Podcast

By Keith Korzec

Keith Korzec discusses the Misson-Based Prioritization method for prioritizing Agile backlogs.
LISTEN
2021-4-22

Acquisition, Agile
My Story in Computing with Carol Smith

April 15, 2021 • Podcast

By Carol J. Smith

Carol Smith, who trained as a photojournalist, transitioned a love of telling people's stories to a career in human-computer interaction working in artificial intelligence with the SEI's Emerging Technology Center.
LISTEN
2021-4-15

Artificial Intelligence Engineering
Digital Engineering and DevSecOps

March 16, 2021 • Podcast

By David James Shepard

David Shepard, a software developer with the SEI's Software Solutions Division, discusses digital engineering and its relationship with DevSecOps.
LISTEN
2021-3-16
A 10-Step Framework for Managing Risk

March 11, 2021 • Podcast

By Brett Tucker

Brett Tucker outlines OCTAVE FORTE, a 10-step framework to guide organizations in managing risk.
LISTEN
2021-3-11
7 Steps to Engineer Security into Ongoing and Future Container Adoption Efforts

February 25, 2021 • Podcast

By Richard Laughlin , Tom Scanlon

Thomas Scanlon and Richard Laughlin discuss seven steps that developers can take to engineer security into ongoing and future container adoption efforts.
LISTEN
2021-2-25

Cybersecurity Engineering, Best Practices, Secure Development
Ransomware: Evolution, Rise, and Response

February 18, 2021 • Podcast

By Timothy J. Shimeall , Marisa Midler

Marisa Midler and Tim Shimeall, analysts with the SEI's CERT Division, discuss steps and strategies that organizations can adopt to minimize their exposure to the risks and threats associated with …
LISTEN
2021-2-18

Best Practices, Incident Handling, Cybersecurity
VINCE: A Software Vulnerability Coordination Platform

January 25, 2021 • Podcast

By Emily Sarneso , Art Manion

Emily Sarneso, the architect of VINCE, and Art Manion, technical manager of the Vulnerability Analysis Team in the SEI CERT Division, discuss the rollout of VINCE, how to use it, …
LISTEN
2021-1-25

Security Vulnerabilities, Cybersecurity
Work From Home: Threats, Vulnerabilities, and Strategies for Protecting Your Network

January 7, 2021 • Podcast

By Phil Groce

Phil Groce, a senior network defense analyst in the SEI's CERT Division, discusses the security implications of remote work.
LISTEN
2021-1-7

Cyber Risk and Resilience Management, Situational Awareness, Best Practices
An Introduction to CMMC Assessment Guides

December 8, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

In this SEI Podcast, Andrew Hoover and Katie Stewart, architects of the CMMC 1.0 model, discuss the CMMC assessment guides, how they were developed, and how they can be used.
LISTEN
2020-12-8

Cyber Risk and Resilience Management, Supply Chain Assurance
The CMMC Level 3 Assessment Guide: A Closer Look

December 8, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

Andrew Hoover and Katie Stewart, architects of the CMMC 1.0 model, discuss the Level 3 Assessment Guide for the CMMC and how it differs from the Level 1 Assessment Guide.
LISTEN
2020-12-8

Cyber Risk and Resilience Management, Supply Chain Assurance
The CMMC Level 1 Assessment Guide: A Closer Look

December 8, 2020 • Podcast

By Andrew F. Hoover , Katie C. Stewart

Andrew Hoover and Katie Stewart, architects of the CMMC 1.0 model, discuss the Level 1 Assessment Guide for the CMMC.
LISTEN
2020-12-8

Cyber Risk and Resilience Management, Supply Chain Assurance
Achieving Continuous Authority to Operate (ATO)

November 30, 2020 • Podcast

By Shane Ficorilli , Hasan Yasar

Shane Ficorilli and Hasan Yasar sit down with Suzanne Miller to discuss Continuous ATO, including challenges, the role of DevSecOps, and cultural issues that organizations must address.
LISTEN
2020-11-30

Best Practices, DevSecOps, Governance, Agile
Challenging the Myth of the 10x Programmer

November 10, 2020 • Podcast

By Bill Nichols

Bill Nichols, a researcher in the SEI's Software Solution Division, recently examined the veracity and relevance of the widely held notion that some programmers are much better than others (the …
LISTEN
2020-11-10

software engineering and information assurance
A Stakeholder-Specific Vulnerability Categorization

October 29, 2020 • Podcast

By Eric Hatleback , Allen D. Householder , Jonathan Spring

Eric Hatleback, Allen Householder, and Jonathan Spring, vulnerability and incident researchers in the SEI CERT Division, discuss SSVC and also take audience members through a sample scoring vulnerability.
LISTEN
2020-10-29

Security Vulnerabilities, CERT/CC
Optimizing Process Maturity in CMMC Level 5

October 13, 2020 • Podcast

By Andrew F. Hoover , Katie C. Stewart

Andrew Hoover and Katie Stewart, architects of the CMMC 1.0 model, discuss the Level 5 process maturity requirements, which are standardizing and optimizing a documented approach for CMMC.
LISTEN
2020-10-13

Cyber-Physical Systems, Governance, CERT/CC, Critical Infrastructure Protection
Reviewing and Measuring Activities for Effectiveness in CMMC Level 4

October 8, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

Andrew Hoover and Katie Stewart, architects of the CMMC model, discuss reviewing and communicating CMMC activities and measuring those activities for effectiveness, which are requirements of Level 4 of the …
LISTEN
2020-10-8

Cyber-Physical Systems, Governance, Incident Handling, CERT/CC, Critical Infrastructure Protection
Situational Awareness for Cybersecurity: Beyond the Network

October 1, 2020 • Podcast

By Timothy Morrow , Angela Horneman

Angela Horneman and Timothy Morrow discuss the importance of looking beyond the network to gain situational awareness for cybersecurity.
LISTEN
2020-10-1

Situational Awareness, Cybersecurity
Quantum Computing: The Quantum Advantage

September 17, 2020 • Podcast

By Jason Larkin

Dr. Jason Larkin discusses the challenges of working in the NISQ era and the work that the SEI is doing in quantum computing.
LISTEN
2020-9-17

Quantum Computing
CMMC Scoring 101

September 3, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

Andrew Hoover and Katie Stewart, architects of the Cybersecurity Maturity Model Certification (CMMC) 1.0, discuss how assessed DIB organizations are scored according to the model.
LISTEN
2020-9-3

Cyber-Physical Systems, Best Practices, Governance, Incident Handling, CERT/CC, Critical Infrastructure Protection, Cybersecurity
Developing an Effective CMMC Policy

August 25, 2020 • Podcast

By Andrew F. Hoover , Katie C. Stewart

Andrew Hoover and Katie Stewart, architects of the Cybersecurity Maturity Model Certification (CMMC) 1.0, present guidelines for developing an effective CMMC policy.
LISTEN
2020-8-25

Cyber Risk and Resilience Management, Cyber Workforce Development, Cyber-Physical Systems, Digital Intelligence and Investigation, Incident Management, Best Practices
The Future of Cyber: Educating the Cybersecurity Workforce

August 11, 2020 • Podcast

By Roberta (Bobbie) Stempfley , Dr. Diana Burley

Bobbie Stempfley, director of the SEI's CERT Division, interviews Dr. Diana Burley, executive director and chair of I3P, and vice provost for research for American University.
LISTEN
2020-8-11

Cyber Workforce Development, Cybersecurity
Documenting Process for CMMC

July 30, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

Andrew Hoover and Katie Stewart, architects of the Cybersecurity Maturity Model Certification (CMMC) 1.0, discuss process documentation, a Level 2 requirement.
LISTEN
2020-7-30

Cyber Risk and Resilience Management, Critical Infrastructure Protection, Incident Handling, Cybersecurity
Agile Cybersecurity

July 16, 2020 • Podcast

By Carol Woody , Will Hayes

Dr. Carol Woody and Will Hayes discuss an approach that allows organizations to integrate cybersecurity into the agile pipeline.
LISTEN
2020-7-16

Agile, Cybersecurity
CMMC Levels 1-3: Going Beyond NIST SP-171

July 1, 2020 • Podcast

By Katie C. Stewart , Andrew F. Hoover

Andrew Hoover and Katie Stewart, CMMC architects, discuss Levels 1-3 of the model and what steps organizations need to take to move beyond NIST 800-171.
LISTEN
2020-7-1

Cyber-Physical Systems, Incident Management, Security Vulnerabilities, FloCon, Research Review, Critical Infrastructure Protection, Cybersecurity
The Future of Cyber: Secure Coding

June 18, 2020 • Podcast

By Steve Lipner , Roberta (Bobbie) Stempfley

Bobbie Stempfley, director of the CERT Division of the SEI, explores the future of secure coding with Steve Lipner, the executive director of SAFECode and former director of software security …
LISTEN
2020-6-18

Secure Coding, Best Practices, Cybersecurity, Secure Development
Challenges to Implementing DevOps in Highly Regulated Environments

May 28, 2020 • Podcast

By Jose A. Morales , Hasan Yasar

Hasan Yasar and Jose Morales discuss challenges to implementing DevOps in highly regulated environment (HREs), exploring issues such as environment parity, the approval process, and compliance.
LISTEN
2020-5-28

DevSecOps
The Future of Cyber: Cybercrime

May 12, 2020 • Podcast

By Roberta (Bobbie) Stempfley , David Hickton

David Hickton, founding director of the University of Pittsburgh Institute for Cyber Law, Policy, and Security, sits down with Bobbie Stempfley, director of the SEI's CERT Division, to talk about …
LISTEN
2020-5-12

Incident Handling, Cybersecurity
Designing Trustworthy AI

April 29, 2020 • Podcast

By Carol J. Smith

Carol Smith discusses a framework that builds upon the importance of diverse teams and ethical standards to ensure that AI systems are trustworthy and able to effectively augment warfighters.
LISTEN
2020-4-29

Artificial Intelligence Engineering, Autonomy and Counter-Autonomy
My Story in Computing with Madison Quinn Oliver

April 16, 2020 • Podcast

By Madison Oliver

Madison Quinn Oliver, an associated vulnerability engineer in the SEI's CERT Division, discusses her career journey and obstacles and mentors that she encountered along the way.
LISTEN
2020-4-16
The CERT Guide to Coordinated Vulnerability Disclosure

March 26, 2020 • Podcast

By Allen D. Householder , David Warren

Allen Householder and David Warren discuss the CERT Guide to Coordinated Vulnerability Disclosure, which is used by security researchers, software vendors, and other stakeholders in informing others about security vulnerabilities.
LISTEN
2020-3-26

Security Vulnerabilities, Best Practices, CERT/CC, Cybersecurity
Women in Software and Cybersecurity: Dr. April Galyardt

March 10, 2020 • Podcast

By April Galyardt

Dr. April Galyardt, a machine learning research scientist in the SEI's CERT Division, discusses her career journey, challenges, and lessons learned along the way.
LISTEN
2020-3-10

Cyber Workforce Development, Artificial Intelligence Engineering
The Future of Cyber: Security and Privacy

February 27, 2020 • Podcast

By Roberta (Bobbie) Stempfley , Dr. Lorrie Cranor

Dr. Lorrie Faith Cranor, director of CyLab, sits down with Bobbie Stempfley, director of the SEI's CERT Division, to talk about the future of cyber in security and privacy.
LISTEN
2020-2-27

Cybersecurity Engineering, Artificial Intelligence Engineering
The Future of Cyber: Security and Resilience

February 13, 2020 • Podcast

By Roberta (Bobbie) Stempfley , J. Michael McQuade, Ph.D.

Bobbie Stempfley, director of the CERT Division of the SEI, and Dr. Michael McQuade, vice-president for research at Carnegie Mellon University, discuss the future of cyber in security and resilience.
LISTEN
2020-2-13

Cybersecurity Engineering, Cybersecurity
Reverse Engineering Object-Oriented Code with Ghidra and New Pharos Tools

February 6, 2020 • Podcast

By Jeff Gennari , Cory Cohen

Jeff Gennari and Cory Cohen discuss updates to the Pharos Binary Analysis Framework in GitHub, including a new plug-in to import OOAnalyzer analysis into the NSA's recently released Ghidra software …
LISTEN
2020-2-6

Cybersecurity Engineering, FloCon, Incident Handling, Cybersecurity, Reverse Engineering
Women in Software and Cybersecurity: Dr. Carol Woody

January 30, 2020 • Podcast

By Carol Woody

Dr. Carol Woody discusses the career path that led to her current role as technical manager for the Cybersecurity Engineering (CSE) team in the SEI's CERT Division.
LISTEN
2020-1-30

Cybersecurity Engineering, FloCon, Cybersecurity
Benchmarking Organizational Incident Management Practices

December 17, 2019 • Podcast

By Robin Ruefle , Mark Zajicek

Robin Ruefle and Mark Zajicek discuss recent work that provides a baseline or benchmark of incident management practices for an organization.
LISTEN
2019-12-17

Measurement and Analysis, Best Practices, Incident Handling, Enterprise Risk and Resilience Management
Machine Learning in Cybersecurity: 7 Questions for Decision Makers

December 12, 2019 • Podcast

By Jonathan Spring , Angela Horneman , April Galyardt

April Galyardt, Angela Horneman, and Jonathan Spring discuss key questions that managers and decision makers should ask about machine learning to effectively solve cybersecurity problems.
LISTEN
2019-12-12

Artificial Intelligence Engineering, Cybersecurity
Women in Software and Cybersecurity: Kristi Roth

November 26, 2019 • Podcast

By Software Engineering Institute

Kristi Roth discusses her experience as an intern in the SEI's Software Solutions Division and her journey into the field of software engineering.
LISTEN
2019-11-26

Best Practices, software engineering and information assurance
Human Factors in Software Engineering

November 12, 2019 • Podcast

By Andrew O. Mellinger , Hasan Yasar , Suzanne Miller

Andrew Mellinger, Suzanne Miller, and Hasan Yasar discuss the human factors that impact software engineering, from the communication tools they use to the environments where they work.
LISTEN
2019-11-12

Cyber Workforce Development
Women in Software and Cybersecurity: Anita Carleton

October 15, 2019 • Podcast

By Anita Carleton

Anita Carleton discusses the career path that led to her current role as acting director of the SEI's Software Solutions Division and the challenges and mentors (Watts Humphrey) that she …
LISTEN
2019-10-15

Cyber Workforce Development, software engineering and information assurance
Improving the Common Vulnerability Scoring System

October 3, 2019 • Podcast

By Deana Shick , Art Manion , Jonathan Spring

Art Manion, Deana Shick, and Jonathan Spring discuss a 2019 paper that outlines challenges with the Common Vulnerability Scoring System (CVSS) and proposes changes to improve it.
LISTEN
2019-10-3

Security Vulnerabilities, Best Practices, Cybersecurity
Why Software Architects Must Be Involved in the Earliest Systems Engineering Activities

October 1, 2019 • Podcast

By Sarah Sheard

Dr. Sarah Sheard discusses the importance of including software architects in the earliest systems engineering activities.
LISTEN
2019-10-1

Software Architecture, software engineering and information assurance
Selecting Metrics for Software Assurance

September 24, 2019 • Podcast

By Carol Woody

Dr. Carol Woody discusses the selection of metrics for measuring the software assurance of a product as it is developed and delivered to function in a specific system context.
LISTEN
2019-9-24

Cybersecurity Engineering, Cyber Risk and Resilience Management, software engineering and information assurance
AI in Humanitarian Assistance and Disaster Response

September 18, 2019 • Podcast

By Ritwik Gupta

Ritwik Gupta, a machine learning research scientist in the SEI's Emerging Technology Center, discusses the use of AI in humanitarian assistance and disaster response (HADR) efforts.
LISTEN
2019-9-18

Artificial Intelligence Engineering
The AADL Error Library

August 29, 2019 • Podcast

By Peter H. Feiler , Sam Procter

Peter Feiler and Sam Procter present the Architecture Analysis and Design Language (AADL) EMV2 Error Library, which is an established taxonomy that draws on a broad range of previous work …
LISTEN
2019-8-29

Software Architecture, software engineering and information assurance, system verification and validation
Women in Software and Cybersecurity: Suzanne Miller

August 22, 2019 • Podcast

By Suzanne Miller

SEI principal researcher Suzanne Miller discusses the path that led to her present-day career and the challenges and mentors that she encountered along the way.
LISTEN
2019-8-22

Acquisition, Best Practices
Privacy in the Blockchain Era

July 29, 2019 • Podcast

By Dr. Giulia Fanti (Electrical and Computer Engineering, CMU College of Engineering)

Dr. Giulia Fanti, an assistant professor of Electrical and Computer Engineering at Carnegie Mellon University, discusses her latest research including privacy problems in the cryptocurrency and blockchain space.
LISTEN
2019-7-29

Cyber-Physical Systems, Incident Management, Artificial Intelligence Engineering
Cyber Intelligence: Best Practices and Biggest Challenges

July 25, 2019 • Podcast

By Jared Ettinger

Jared Ettinger, a cyber intelligence researcher in the SEI's Emerging Technology Center, discusses the findings of a report that outlines challenges and best practices in cyber intelligence.
LISTEN
2019-7-25

Cyber Risk and Resilience Management, Cyber-Physical Systems, Incident Management, Situational Awareness, Best Practices
Assessing Cybersecurity Training

July 11, 2019 • Podcast

By April Galyardt

April Galyardt, a machine learning research scientist, discusses efforts to develop a new approach to assessing the skills of the cybersecurity workforce.
LISTEN
2019-7-11

Cyber Workforce Development, Cybersecurity
DevOps in Highly Regulated Environments

June 27, 2019 • Podcast

By Hasan Yasar , Jose A. Morales

Hasan Yasar and Jose Morales discuss the process, challenges, approaches, and lessons learned in implementing DevOps in the software development lifecycle in highly regulated environments.
LISTEN
2019-6-27

DevSecOps
Women in Software and Cybersecurity: Dr. Ipek Ozkaya

June 20, 2019 • Podcast

By Ipek Ozkaya

In this podcast, the latest in our Women in Software and Cybersecurity podcast series, Dr. Ipek Ozkaya talks about the educational choices and career path that led to her current …
LISTEN
2019-6-20

Software Architecture, Technical Debt, system verification and validation, software engineering and information assurance
Defending Your Organization Against Business Email Compromise

May 30, 2019 • Podcast

By Anne Connell

Anne Connell discusses recent business email compromise attacks, such as Operation Wire Wire, and offers guidance on how individuals and organizations can protect themselves from these sophisticated new modes of …
LISTEN
2019-5-30

Cyber Risk and Resilience Management, Insider Threat, FloCon, Best Practices, Critical Infrastructure Protection, Incident Handling, Cybersecurity
My Story in Computing with Dr. Eliezer Kanal

May 16, 2019 • Podcast

By Eliezer Kanal

In this SEI Podcast, the first in the My Story in Computing series, Dr. Kanal discusses his education, career path, and lessons he learned along the way.
LISTEN
2019-5-16

Situational Awareness, Reverse Engineering for Malware Analysis
Women in Software and Cybersecurity: Eileen Wrubel

April 11, 2019 • Podcast

By Eileen Wrubel

In this SEI Podcast, which highlights the work of Women in Software and Cybersecurity, Eileen Wrubel, co-lead of the SEI's Agile/DevOps Transformation directorate, discusses her career journey.
LISTEN
2019-4-11

Acquisition, Agile, software engineering and information assurance
Managing Technical Debt: A Focus on Automation, Design, and Architecture

March 20, 2019 • Podcast

By Ipek Ozkaya , Robert Nord

Rod Nord and Ipek Ozkaya discuss the SEI's current work in technical debt including the development of analysis techniques to help software engineers and decision makers manage the effect of …
LISTEN
2019-3-20

Software Architecture, Technical Debt, Mission Assurance, system verification and validation
Women in Software and Cybersecurity: Grace Lewis

March 14, 2019 • Podcast

By Grace Lewis

Grace Lewis discusses her career journey, which led to her leading Tactical Edge Computing at the SEI. This podcast is the latest installment in our Women in Software and Cybersecurity …
LISTEN
2019-3-14

Cyber-Physical Systems, Cloud Computing, Mission Assurance
10 Types of Application Security Testing Tools and How to Use Them

February 7, 2019 • Podcast

By Tom Scanlon

Thomas Scanlon, a researcher in the SEI's CERT Division, discusses the different types of application security testing tools and provides guidance on how and when to use each tool.
LISTEN
2019-2-7

Cyber-Physical Systems, Cybersecurity Engineering, Security Vulnerabilities, Best Practices, Critical Infrastructure Protection, Cybersecurity, Enterprise Risk and Resilience Management, Cyber Workforce Development
Leading in the Age of Artificial Intelligence

January 16, 2019 • Podcast

By Thomas A. Longstaff

Tom Longstaff, who in 2018 was hired as the SEI's chief technology officer, discusses the challenges of leading a technical organization in the age of artificial intelligence.
LISTEN
2019-1-16

Measurement and Analysis, Reverse Engineering for Malware Analysis, Insider Threat, Incident Management, Cybersecurity Engineering, Cyber-Physical Systems, Critical Infrastructure Protection, Governance, Autonomy and Counter-Autonomy, system verification and validation, software engineering and information assurance, Mission Assurance, Data Modeling and Analytics, Cybersecurity
Women in Software and Cybersecurity: Dr. Lorrie Cranor

January 8, 2019 • Podcast

By Dr. Lorrie Cranor

Dr. Lorrie Cranor, director of CyLab, discusses her career, her work in security and privacy, and her upcoming keynote at the Women in Cybersecurity Conference.
LISTEN
2019-1-8

Cyber-Physical Systems, Digital Intelligence and Investigation, Incident Management, Science of Cybersecurity, Cybersecurity
Women in Software and Cybersecurity: Bobbie Stempfley

December 14, 2018 • Podcast

By Roberta (Bobbie) Stempfley

Roberta "Bobbie" Stempfley discusses her career and journey to becoming the director of the SEI's CERT Division.
LISTEN
2018-12-14

Cybersecurity Engineering, Cyber-Physical Systems, Cybersecurity, Autonomy and Counter-Autonomy, Mission Assurance
Blockchain at CMU and Beyond

December 11, 2018 • Podcast

By Eliezer Kanal , Eugene Leventhal

Eliezer Kanal and Eugene Leventhal discuss blockchain research at Carnegie Mellon University and beyond.
LISTEN
2018-12-11

Science of Cybersecurity, Governance
Applying Best Practices in Network Traffic Analysis

November 29, 2018 • Podcast

By Timothy J. Shimeall , Timur D. Snoke

Tim Shimeall and Timur Snoke, both researchers in the SEI's CERT Division, highlight some best practices (and application of these practices) that they have observed in network traffic analysis.
LISTEN
2018-11-29

Incident Management, Situational Awareness, FloCon, Best Practices, Critical Infrastructure Protection, Cybersecurity, Mission Assurance
Deep Learning in Depth: The Future of Deep Learning

November 27, 2018 • Podcast

By Carson Sestili , Ritwik Gupta

Ritwik Gupta and Carson Sestili discuss the future of deep learning.
LISTEN
2018-11-27

Artificial Intelligence Engineering, Data Modeling and Analytics, Autonomy and Counter-Autonomy
Deep Learning in Depth: Adversarial Machine Learning

November 27, 2018 • Podcast

By Ritwik Gupta , Carson Sestili

Ritwik Gupta of the SEI's Emerging Technology Center and Carson Sestili, formerly of the SEI's CERT Division and now with Google, discuss adversarial machine learning.
LISTEN
2018-11-27

Artificial Intelligence Engineering, Cyber-Physical Systems, Autonomy and Counter-Autonomy
System Architecture Virtual Integration: ROI on Early Discovery of Defects

November 15, 2018 • Podcast

By Peter H. Feiler

Peter Feiler discusses the cost savings (26.1 percent) realized when using the System Architecture Virtual Integration approach on the development of software-reliant systems for aircraft.
LISTEN
2018-11-15

Software Architecture, software engineering and information assurance
Deep Learning in Depth: The Importance of Diverse Perspectives

November 8, 2018 • Podcast

By Carson Sestili , Ritwik Gupta

Ritwik Gupta of the SEI's Emerging Technology Center and Carson Sestili, formerly of the SEI's CERT Division and now with Google, discuss the importance of diverse perspectives in deep learning.
LISTEN
2018-11-8

Data Modeling and Analytics, Autonomy and Counter-Autonomy, Artificial Intelligence Engineering, Digital Intelligence and Investigation
A Technical Strategy for Cybersecurity

November 1, 2018 • Podcast

By Roberta (Bobbie) Stempfley

Roberta "Bobbie" Stempfley, who was appointed director of the SEI's CERT Division in June 2017, discusses a technical strategy for cybersecurity.
LISTEN
2018-11-1

Cyber Risk and Resilience Management, Reverse Engineering for Malware Analysis, Situational Awareness, Incident Handling, Governance, DevSecOps, Cybersecurity, Autonomy and Counter-Autonomy, Data Modeling and Analytics, Digital Intelligence and Investigation
Best Practices for Security in Cloud Computing

October 25, 2018 • Podcast

By Timothy Morrow , Donald Faatz

Don Faatz and Tim Morrow, researchers with the SEI's CERT Division, outline best practices that organizations should use to address the vulnerabilities and risks in moving applications and data to …
LISTEN
2018-10-25

Cloud Computing, Cybersecurity, software engineering and information assurance
Risks, Threats, and Vulnerabilities in Moving to the Cloud

October 18, 2018 • Podcast

By Timothy Morrow , Donald Faatz

Tim Morrow and Donald Faatz outline the risks, threats, and vulnerabilities that organizations face when moving applications or data to the cloud.
LISTEN
2018-10-18

Cloud Computing, software engineering and information assurance
Deep Learning in Depth: IARPA's Functional Map of the World Challenge

October 11, 2018 • Podcast

By Carson Sestili , Ritwik Gupta

Ritwik Gupta and Carson Sestili describe their use of deep learning in IARPA's Functional Map of the World Challenge.
LISTEN
2018-10-11

Autonomy and Counter-Autonomy, Cybersecurity, Data Modeling and Analytics, Artificial Intelligence Engineering
Deep Learning in Depth: Deep Learning versus Machine Learning

October 4, 2018 • Podcast

By Ritwik Gupta , Carson Sestili

In this podcast excerpt, Ritwik Gupta and Carson Sestili describe deep learning and how it differs from machine learning.
LISTEN
2018-10-4

Cybersecurity Engineering, Autonomy and Counter-Autonomy, Cybersecurity
Using Test Suites for Static Analysis Alert Classifiers

September 20, 2018 • Podcast

By Lori Flynn , Zachary Kurtz

CERT researchers Lori Flynn and Zach Kurtz discuss ongoing research using test suites as a source of labeled training data to create classifiers for static analysis alerts.
LISTEN
2018-9-20

Reverse Engineering for Malware Analysis, Secure Coding, CERT/CC, software engineering and information assurance, Artificial Intelligence Engineering, Secure Development
How to Be a Network Traffic Analyst

September 13, 2018 • Podcast

By Timothy J. Shimeall , Timur D. Snoke

Tim Shimeall and Timur Snoke, researchers in the SEI's CERT Division, examine the role of the network traffic analyst in capturing and evaluating ever-increasing volumes of network data.
LISTEN
2018-9-13

Best Practices, Digital Intelligence and Investigation, Incident Handling, Cybersecurity
Workplace Violence and Insider Threat

August 28, 2018 • Podcast

By Tracy Cassidy , Carrie Gardner

Tracy Cassidy and Carrie Gardner, researchers with the CERT National Insider Threat Center, discuss research on using technology to detect an employee's intent to cause physical harm.
LISTEN
2018-8-28

Insider Threat, Incident Handling
The Role of the Software Factory in Acquisition and Sustainment

August 16, 2018 • Podcast

By Paul Nielsen

Dr. Paul Nielsen discusses his involvement on a Defense Science Board Task Force that concluded that the software factory should be a key player in the acquisition and sustainment of …
LISTEN
2018-8-16

Acquisition, software engineering and information assurance, system verification and validation
Why Does Software Cost So Much?

August 2, 2018 • Podcast

By Michael D. Konrad , Robert W. Stoddard

Mike Konrad and Bob Stoddard discuss an approach known as causal learning that can help the Department of Defense identify which factors cause software costs to escalate and, therefore, serve …
LISTEN
2018-8-2

Mission Assurance, software engineering and information assurance
Cybersecurity Engineering & Software Assurance: Opportunities & Risks

July 26, 2018 • Podcast

By Carol Woody

Carol Woody discusses opportunities and risks in cybersecurity engineering, software assurance, and the resulting CERT Cybersecurity Engineering and Software Assurance Professional Certificate.
LISTEN
2018-7-26

Cybersecurity Engineering, Cybersecurity
Software Sustainment and Product Lines

July 10, 2018 • Podcast

By Harry L. Levinson , Mike Phillips

Mike Phillips and Harry Levinson examine the intersection of three themes that emerged during the SEI's work with one government program: product line practices, software sustainment, and public-private partnerships.
LISTEN
2018-7-10

Software Product Lines
Best Practices in Cyber Intelligence

June 25, 2018 • Podcast

By Jared Ettinger

Jared Ettinger describes preliminary findings and best practices in cyber intelligence identified through a study sponsored by the U.S. Office of the Director of National Intelligence.
LISTEN
2018-6-25

Digital Intelligence and Investigation, Cybersecurity, Incident Handling
Deep Learning in Depth: The Good, the Bad, and the Future

June 7, 2018 • Podcast

By Carson Sestili , Ritwik Gupta

Ritwik Gupta and Carson Sestili describe deep learning, a popular and quickly growing subfield of machine learning.
LISTEN
2018-6-7

Cybersecurity, Autonomy and Counter-Autonomy, Artificial Intelligence Engineering
The Evolving Role of the Chief Risk Officer

May 24, 2018 • Podcast

By Ari Lightman , Summer C. Fowler

Summer Fowler and Ari Lightman discuss the evolving role of the chief risk officer and a Chief Risk Officer Program that is developed and delivered jointly by CMU's Heinz College …
LISTEN
2018-5-24

Incident Management, Cybersecurity, Enterprise Risk and Resilience Management
Obsidian: A Safer Blockchain Programming Language

May 10, 2018 • Podcast

By Eliezer Kanal , Michael Coblenz (Carnegie Mellon School of Computer Science)

Eliezer Kanal and Michael Coblenz discuss the creation of Obsidian, a novel programming language specifically tailored to secure blockchain software development that significantly reduces the risk of coding errors.
LISTEN
2018-5-10

Cybersecurity, Secure Coding, Secure Development
Agile DevOps

April 19, 2018 • Podcast

By Eileen Wrubel , Hasan Yasar

Eileen Wrubel and Hasan Yasar discuss how Agile and DevOps can be deployed together to meet organizational needs.
LISTEN
2018-4-19

Acquisition, Agile, DevSecOps, software engineering and information assurance
Kicking Butt in Computer Science: Women in Computing at Carnegie Mellon University

April 5, 2018 • Podcast

By Grace Lewis , Jeria Quesenberry , Carol Frieze

Carol Frieze, Grace Lewis, and Jeria Quesenberry discuss CMU's approach to creating a more inclusive environment for all computer science students, regardless of gender.
LISTEN
2018-4-5

Cybersecurity
Is Software Spoiling Us? Technical Innovations in the Department of Defense

March 15, 2018 • Podcast

By Jeff Boleng

In this podcast, the panel discusses technical innovations that can be applied to the Department of Defense including improved situational awareness, human-machine interactions, artificial intelligence, machine learning, data, and continuous …
LISTEN
2018-3-15

Cyber Risk and Resilience Management, Cyber-Physical Systems, Cybersecurity Engineering, Autonomy and Counter-Autonomy, Cybersecurity, Data Modeling and Analytics, Mission Assurance, software engineering and information assurance, system verification and validation, Artificial Intelligence Engineering
Is Software Spoiling Us? Innovations in Daily Life from Software

February 8, 2018 • Podcast

By Jeff Boleng

In this podcast, which was excerpted from the webinar Is Software Spoiling Us?, the panel discusses awesome innovations in daily life that are made possible because of software.
LISTEN
2018-2-8

software engineering and information assurance, system verification and validation
How Risk Management Fits into Agile & DevOps in Government

February 1, 2018 • Podcast

By Hasan Yasar , Eileen Wrubel , Will Hayes , Timothy A. Chick

In this podcast, Eileen Wrubel, technical lead for the SEI's Agile-in-Government program leads a roundtable discussion into how Agile, DevOps, and the Risk Management Framework can work together.
LISTEN
2018-2-1

Cyber Risk and Resilience Management, Data Modeling and Analytics, system verification and validation, software engineering and information assurance, Agile, Enterprise Risk and Resilience Management
5 Best Practices for Preventing and Responding to Insider Threat

December 28, 2017 • Podcast

By Randall F. Trzeciak

Randy Trzeciak, technical manager of the CERT National Insider Threat Center, discusses five best practices for preventing and responding to insider threat.
LISTEN
2017-12-28

Insider Threat, Data Modeling and Analytics
Pharos Binary Static Analysis: An Update

December 12, 2017 • Podcast

By Jeff Gennari

Jeff Gennari discusses updates to the Pharos framework, which automates reverse engineering of malware analysis, including new tools, improvements, and bug fixes.
LISTEN
2017-12-12

Reverse Engineering for Malware Analysis, Cybersecurity
Positive Incentives for Reducing Insider Threat

November 30, 2017 • Podcast

By Daniel Bauer , Andrew P. Moore

Andrew Moore and Daniel Bauer highlight results from our recent research that suggests organizations need to take a more holistic approach to mitigating insider threat.
LISTEN
2017-11-30

Insider Threat, Best Practices
Mission-Practical Biometrics

November 16, 2017 • Podcast

By Satya Venneti

Satya Venneti presents exploratory research undertaken by the SEI's Emerging Technology Center to design algorithms to extract heart rate from video capture of non-stationary subjects in real-time.
LISTEN
2017-11-16

Artificial Intelligence Engineering
At Risk Emerging Technology Domains

October 24, 2017 • Podcast

By Dan J. Klinedinst

In this podcast, CERT vulnerability analyst Dan Klinedinst discusses research aimed at helping the Department of Homeland Security United States Computer Emergency Readiness Team (US-CERT) understand future technologies and their …
LISTEN
2017-10-24

CERT/CC, Cybersecurity
DNS Blocking to Disrupt Malware

October 12, 2017 • Podcast

By Vijay S. Sarvepalli

In this podcast, CERT researcher Vijay Sarvepalli explores Domain Name System or DNS Blocking, the idea of disrupting communications from malicious code such as ransomware that is used to lock …
LISTEN
2017-10-12

Cybersecurity
Best Practices: Network Border Protection

September 21, 2017 • Podcast

By Rachel Kartch

In this podcast, the latest in a series on best practices for network security, Rachel Kartch explores best practices for network border protection at the Internet router and firewall.
LISTEN
2017-9-21

Cybersecurity, Situational Awareness
Verifying Software Assurance with IBM’s Watson

September 7, 2017 • Podcast

By Mark Sherman

In this podcast, Mark Sherman discusses research aimed at examining whether developers could build an IBM Watson application to support an assurance review.
LISTEN
2017-9-7

software engineering and information assurance, Artificial Intelligence Engineering
The CERT Software Assurance Framework

August 31, 2017 • Podcast

By Christopher J. Alberts , Carol Woody

In this podcast, Carol Woody and Christopher Alberts introduce the prototype Software Assurance Framework, a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain.
LISTEN
2017-8-31

Agile, system verification and validation
Scaling Agile Methods

August 3, 2017 • Podcast

By Will Hayes , Eileen Wrubel

In this podcast, Will Hayes and Eileen Wrubel present five perspectives on scaling Agile from leading thinkers in the field, including Scott Ambler, Steve Messenger, Craig Larman, Jeff Sutherland, and …
LISTEN
2017-8-3

Agile, Mission Assurance, system verification and validation
Ransomware: Best Practices for Prevention and Response

July 14, 2017 • Podcast

By Angela Horneman , Alexander Volynkin

In this podcast, CERT researchers spell out several best practices for prevention and response to a ransomware attack.
LISTEN
2017-7-14

Incident Handling, Cybersecurity, Critical Infrastructure Protection
Integrating Security in DevOps

June 29, 2017 • Podcast

By Hasan Yasar

In this podcast, Hasan Yasar discusses how Secure DevOps attempts to shift the paradigm for tough security problems from following rules to creatively determining solutions.
LISTEN
2017-6-29

Performance and Dependability, software engineering and information assurance, Cybersecurity
SEI Fellows Series: Peter Feiler

June 15, 2017 • Podcast

By Peter H. Feiler

Peter Feiler was named an SEI Fellow in August 2016. This podcast is the second in a series highlighting interviews with SEI Fellows.
LISTEN
2017-6-15

Software Architecture, software engineering and information assurance
NTP Best Practices

May 25, 2017 • Podcast

By Timur D. Snoke

In this podcast, Timur Snoke explores the challenges of NTP and prescribes some best practices for securing accurate time with this protocol.
LISTEN
2017-5-25

Cybersecurity, Cyber-Physical Systems
Establishing Trust in Disconnected Environments

May 18, 2017 • Podcast

By Grace Lewis

In this podcast, Grace Lewis presents a solution for establishing trusted identities in disconnected environments based on secure key generation and exchange in the field, as well as an evaluation …
LISTEN
2017-5-18

Cloud Computing, Mission Assurance, Edge Computing
Distributed Artificial Intelligence in Space

April 20, 2017 • Podcast

By James Edmondson

In this podcast, James Edmondson discusses his work to bring distributed artificial intelligence to a next generation, renewable power grid in space.
LISTEN
2017-4-20

Autonomy and Counter-Autonomy, Cyber-Physical Systems, Artificial Intelligence Engineering
Verifying Distributed Adaptive Real-Time Systems

March 27, 2017 • Podcast

By Sagar Chaki , James Edmondson

In this podcast, James Edmondson and Sagar Chaki describe an architecture and approach to engineering high-assurance software for Distributed Adaptive Real-Time (DART) systems.
LISTEN
2017-3-27

Autonomy and Counter-Autonomy
10 At-Risk Emerging Technologies

March 23, 2017 • Podcast

By Christopher King

Researchers in the SEI's CERT Division recently examined the security of a large swath of technology domains being developed in industry and maturing over the next five years.
LISTEN
2017-3-23

Cyber-Physical Systems, Autonomy and Counter-Autonomy
Technical Debt as a Core Software Engineering Practice

February 27, 2017 • Podcast

By Ipek Ozkaya

In this podcast, Ipek Ozkaya talks about managing technical debt as a core software engineering practice and its importance in the education of future software engineers.
LISTEN
2017-2-27

Technical Debt, software engineering and information assurance
DNS Best Practices

February 23, 2017 • Podcast

By Mark Langston

In this podcast, Mark Langston discusses best practices for designing a secure, reliable DNS infrastructure.
LISTEN
2017-2-23

Best Practices, Cybersecurity
Three Roles and Three Failure Patterns of Software Architects

January 26, 2017 • Podcast

By John Klein

This podcast explores three roles and three failure patterns of software architects that he has observed working with industry and government software projects.
LISTEN
2017-1-26

software engineering and information assurance, Software Architecture
Security Modeling Tools

January 12, 2017 • Podcast

By Julien Delange

In this podcast, Julien Delange discusses security modeling tools that his team developed and how to use them to capture vulnerabilities and their propagation path in an architecture.
LISTEN
2017-1-12

system verification and validation, Software Architecture
Best Practices for Preventing and Responding to Distributed Denial of Service (DDoS) Attacks

December 19, 2016 • Podcast

By Rachel Kartch

In this podcast, CERT researcher Rachel Kartch provides an overview of DDoS attacks and best practices for mitigating and responding to them.
LISTEN
2016-12-19

Situational Awareness
Cyber Security Engineering for Software and Systems Assurance

December 8, 2016 • Podcast

By Carol Woody , Nancy R. Mead

In this podcast Nancy Mead and Carol Woody discuss their new book, Cyber Security Engineering: A Practical Approach for Systems and Software Assurance, which introduces a set of seven principles …
LISTEN
2016-12-8

Cybersecurity Engineering
Moving Target Defense

November 30, 2016 • Podcast

By Andrew O. Mellinger

In this podcast, Andrew Mellinger, a senior software developer in the SEI's Emerging Technology Center discusses work to develop a platform to organize dynamic defenses.
LISTEN
2016-11-30

Situational Awareness, Cyber-Physical Systems
Improving Cybersecurity Through Cyber Intelligence

November 10, 2016 • Podcast

By Jared Ettinger

In this podcast, Jared Ettinger of the SEI's Emerging Technology Center (ETC) talks about the ETC's work in cyber intelligence as well as the Cyber Intelligence Research Consortium.
LISTEN
2016-11-10

Cyber-Physical Systems, Cybersecurity
A Requirement Specification Language for AADL

October 27, 2016 • Podcast

By Peter H. Feiler

In this podcast, Peter Feiler describes a textual requirement specification language for the Architecture Analysis & Design Language (AADL) called ReqSpec.
LISTEN
2016-10-27

Software Architecture, system verification and validation
Becoming a CISO: Formal and Informal Requirements

October 19, 2016 • Podcast

By Lisa R. Young , Darrell Keeling (Parkview Health)

In this podcast, Darrell Keeling, Vice President of Information Security and HIPAA Security Officer at Parkview Health, discusses the knowledge, skills, and abilities needed to become a CISO in today's …
LISTEN
2016-10-19

Best Practices
Predicting Quality Assurance with Software Metrics and Security Methods

October 13, 2016 • Podcast

By Carol Woody

In this podcast, Dr. Carol Woody explores the connection between measurement, methods for software assurance, and security.
LISTEN
2016-10-13

Cybersecurity Engineering, software engineering and information assurance
Network Flow and Beyond

September 29, 2016 • Podcast

By Timothy J. Shimeall

In this podcast, Timothy Shimeall discusses approaches for analyzing network security using and going beyond network flow data to gain situational awareness to improve security.
LISTEN
2016-9-29
A Community College Curriculum for Secure Software Development

September 15, 2016 • Podcast

By Girish Seshagiri (Advanced Information Services Inc)

In this podcast, Girish Seshagiri discusses a two-year community college software assurance program that he developed and facilitated with SEI Fellow Nancy Mead at Illinois Central College.
LISTEN
2016-9-15

Cyber Risk and Resilience Management, Performance and Dependability, Cybersecurity Engineering
Security and the Internet of Things

August 25, 2016 • Podcast

By Art Manion

In this podcast, CERT researcher Art Manion discusses work that his team is doing with the Department of Homeland Security to examine and secure IoT devices.
LISTEN
2016-8-25

Security Vulnerabilities
The SEI Fellow Series: Nancy Mead

August 10, 2016 • Podcast

By Nancy R. Mead

This podcast is the first in a series highlighting interviews with SEI Fellows.
LISTEN
2016-8-10

Cybersecurity Engineering
An Open Source Tool for Fault Tree Analysis

July 28, 2016 • Podcast

By Julien Delange

In this podcast, Dr. Julien Delange discusses fault tree analysis and introduces a new tool to design and analyze fault trees.
LISTEN
2016-7-28

Software Architecture
Global Value Chain – An Expanded View of the ICT Supply Chain

July 18, 2016 • Podcast

By Lisa R. Young , Edna M. Conway (Cisco Systems, Inc.) , John Haller

In this podcast, Edna Conway and John Haller discuss the global value chain for organizations and critical infrastructures and how this expanded view can be used to improve ICT supply …
LISTEN
2016-7-18

Cyber Risk and Resilience Management
Intelligence Preparation for Operational Resilience

June 21, 2016 • Podcast

By Douglas Gray , Lisa R. Young

In this podcast, Douglas Gray, a member of the CERT Cyber Risk Management team, discusses how to operationalize intelligence products to build operational resilience of organizational assets and services using …
LISTEN
2016-6-21

Cyber Risk and Resilience Management
Evolving Air Force Intelligence with Agile Techniques

May 26, 2016 • Podcast

By Harry L. Levinson

In this podcast, Harry Levinson discusses the SEI's work with the Air Force to further evolve the AF DCGS system using Agile techniques working in incremental, iterative approaches to deliver …
LISTEN
2016-5-26

Acquisition
Threat Modeling and the Internet of Things

May 12, 2016 • Podcast

By Allen D. Householder , Art Manion

Art Manion and Allen Householder of the CERT Vulnerability Analysis team, talk about threat modeling and its use in improving the security of the Internet of Things (IoT).
LISTEN
2016-5-12

Security Vulnerabilities
Open Systems Architectures: When & Where to Be Closed

April 14, 2016 • Podcast

By Donald Firesmith

Don Firesmith discusses how acquisition professionals and system integrators can apply OSA practices to effectively decompose large, monolithic business and technical architectures into manageable and modular solutions.
LISTEN
2016-4-14

Acquisition
Effective Reduction of Avoidable Complexity in Embedded Systems

March 18, 2016 • Podcast

By Julien Delange

Dr. Julien Delange discusses the Effective Reduction of Avoidable Complexity in Embedded Systems (ERACES) project, which aims to identify and remove complexity in software models.
LISTEN
2016-3-18

Software Architecture
Toward Efficient and Effective Software Sustainment

March 18, 2016 • Podcast

By Mike Phillips

Mike Phillips discusses effective sustainment engineering efforts in the Army and Air Force, using examples from across their software engineering centers and how they tie in to SEI research.
LISTEN
2016-3-18

Acquisition
Quality Attribute Refinement and Allocation

March 8, 2016 • Podcast

By Neil Ernst

Dr. Neil Ernst discusses industry practices such as slicing and ratcheting used to develop business capabilities and suggests approaches to enable large-scale iteration.
LISTEN
2016-3-8

Software Architecture
Is Java More Secure Than C?

February 19, 2016 • Podcast

By David Svoboda

In this podcast, CERT researcher David Svoboda analyzes secure coding rules for both C and Java to determine if they indeed refute the conventional wisdom that Java is more secure …
LISTEN
2016-2-19

Secure Coding, Secure Development
Identifying the Architectural Roots of Vulnerabilities

February 4, 2016 • Podcast

By Rick Kazman , Carol Woody

In this podcast, Rick Kazman and Carol Woody discuss an approach for identifying architecture debt in a large-scale industrial software project by modeling software architecture as design rule spaces.
LISTEN
2016-2-4

Software Architecture, Security Vulnerabilities
Build Security In Maturity Model (BSIMM) – Practices from Seventy Eight Organizations

February 3, 2016 • Podcast

By Lisa R. Young , Gary McGraw

In this podcast, Gary McGraw, the Chief Technology Officer for Cigital, discusses the latest version of BSIMM and how to take advantage of observed practices from high-performing organizations.
LISTEN
2016-2-3

Software Assurance, Secure Coding, Cybersecurity Engineering, Secure Development
An Interview with Grady Booch

January 12, 2016 • Podcast

By Grady Booch

During a recent visit to the SEI, Grady Booch, chief scientist for IBM and author of the Unified Modeling Language, sat down for an interview with SEI Fellow Nancy Mead …
LISTEN
2016-1-12

Best Practices, Performance and Dependability
Structuring the Chief Information Security Officer Organization

December 23, 2015 • Podcast

By Nader Mehravari , Julia H. Allen , Lisa R. Young

In this podcast, Nader Mehravari and Julia Allen, members of the CERT Cyber Risk Management team, discuss an effective approach for defining a CISO team structure and functions for large, …
LISTEN
2015-12-23

Governance
How Cyber Insurance Is Driving Risk and Technology Management

November 9, 2015 • Podcast

By Lisa R. Young , Chip Block

In this podcast, Chip Block, Vice President at Evolver, discusses the growth of the cyber insurance industry and how it is beginning to drive the way that organizations manage risk …
LISTEN
2015-11-9

Cyber Risk and Resilience Management
A Field Study of Technical Debt

October 15, 2015 • Podcast

By Neil Ernst

In this podcast, Dr. Neil Ernst discusses the findings of a recent field study to assess the state of the practice and current thinking regarding technical debt and guide the …
LISTEN
2015-10-15

Technical Debt, Software Architecture
How the University of Pittsburgh Is Using the NIST Cybersecurity Framework

October 1, 2015 • Podcast

By Sean Sweeney (University of Pittsburgh) , Lisa R. Young

In this podcast, Sean Sweeney, Information Security Officer (ISO) for the University of Pittsburgh (PITT), discusses their use of the NIST (National Institute of Standards and Technology) CSF (Cybersecurity Framework).
LISTEN
2015-10-1

Cyber Risk and Resilience Management
A Software Assurance Curriculum for Future Engineers

September 24, 2015 • Podcast

By Nancy R. Mead

In this podcast, Nancy Mead discusses how, with support from the Department of Homeland Security, SEI researchers developed software assurance curricula and programs for graduate, undergraduate, and community colleges.
LISTEN
2015-9-24

Software Assurance
Four Types of Shift Left Testing

September 10, 2015 • Podcast

By Donald Firesmith

In this podcast, Donald Firesmith explains the importance of shift left testing and defines four approaches using variants of the classic V model to illustrate them.
LISTEN
2015-9-10

Acquisition
Toward Speed and Simplicity: Creating a Software Library for Graph Analytics

August 27, 2015 • Podcast

By Eric Werner , Scott McMillan

In this podcast, Scott McMillan and Eric Werner of the SEI's Emerging Technology Center discuss work to create a software library for graph analytics that would take advantage of more …
LISTEN
2015-8-27

Cyber-Physical Systems
Capturing the Expertise of Cybersecurity Incident Handlers

August 27, 2015 • Podcast

By Samuel J. Perl , Julia H. Allen , Richard O. Young

In this podcast, Dr. Richard Young, a professor with CMU, and Sam Perl, a member of the CERT Division, discuss their research on how expert cybersecurity incident handlers react when …
LISTEN
2015-8-27

Incident Management
Improving Quality Using Architecture Fault Analysis with Confidence Arguments

August 13, 2015 • Podcast

By Peter H. Feiler

The case study shows that by combining an analytical approach with confidence maps, we can present a structured argument that system requirements have been met and problems in the design …
LISTEN
2015-8-13

Software Architecture
A Taxonomy of Testing Types

July 30, 2015 • Podcast

By Donald Firesmith

In this podcast, Donald Firesmith introduces a taxonomy of testing types to help testing stakeholders understand and select those that are best for their specific programs.
LISTEN
2015-7-30

Acquisition
Reducing Complexity in Software & Systems

July 16, 2015 • Podcast

By Sarah Sheard

In this podcast, Sarah Sheard discusses research to investigate the nature of complexity, how it manifests in software-reliant systems such as avionics, how to measure it, and how to tell …
LISTEN
2015-7-16

Performance and Dependability
Designing Security Into Software-Reliant Systems

June 25, 2015 • Podcast

By Christopher J. Alberts

In this podcast, CERT researcher Christopher Alberts introduces the SERA Framework, a systematic approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle.
LISTEN
2015-6-25

Cybersecurity Engineering
Agile Methods in Air Force Sustainment

June 11, 2015 • Podcast

By Eileen Wrubel

This podcast Eileen Wrubel highlights research examining Agile techniques in the software sustainment arena—specifically Air Force programs.
LISTEN
2015-6-11

Agile, Acquisition
Defect Prioritization With the Risk Priority Number

May 28, 2015 • Podcast

By Will Hayes , Julie B. Cohen

In this podcast, Will Hayes and Julie Cohen discuss a generalized technique that could be used with any type of system to assist the program office in addressing and resolving …
LISTEN
2015-5-28

Acquisition, Security Vulnerabilities
SEI-HCII Collaboration Explores Context-Aware Computing for Soldiers

May 14, 2015 • Podcast

By Dr. Anind Dey , Jeff Boleng

Dr. Jeff Boleng and Dr. Anind Dey discuss joint research to understand the mission, role, and task of dismounted soldiers using context derived from sensors on them and their mobile …
LISTEN
2015-5-14

Pervasive Mobile Computing
An Introduction to Context-Aware Computing

April 23, 2015 • Podcast

By Jeff Boleng , Dr. Anind Dey

Dr. Anind Dey and Dr. Jeff Boleng introduce context-aware computing and explore issues related to sensor-fueled data in the internet of things.
LISTEN
2015-4-23

Pervasive Mobile Computing
Data Driven Software Assurance

April 9, 2015 • Podcast

By Art Manion , Michael D. Konrad

In 2012, SEI researchers began investigating vulnerabilities reported to the SEI's CERT Division. A research project was launched to investigate design-related vulnerabilities and quantify their effects.
LISTEN
2015-4-9

Software Assurance, Security Vulnerabilities
Applying Agile in the DoD: Twelfth Principle

March 26, 2015 • Podcast

By Mary Ann Lapham , Suzanne Miller

In this episode, Suzanne Miller and Mary Ann Lapham explore the application of the 12th Agile principle in the Department of Defense.
LISTEN
2015-3-26

Agile, Acquisition
Supply Chain Risk Management: Managing Third Party and External Dependency Risk

March 26, 2015 • Podcast

By Julia H. Allen , John Haller , Matthew J. Butkovic

In this podcast, Matt Butkovic and John Haller discuss approaches for more effectively managing supply chain risks, focusing on risks arising from “external entities that provide, sustain, or operate Information …
LISTEN
2015-3-26

Cyber Risk and Resilience Management
Introduction to the Mission Thread Workshop

March 12, 2015 • Podcast

By Michael J. Gagliardi

In this podcast, Mike Gagliardi introduces the Mission Thread Workshop, a method for understanding architectural and engineering considerations for developing and sustaining systems of systems.
LISTEN
2015-3-12

System of Systems, Software Architecture
Applying Agile in the DoD: Eleventh Principle

February 26, 2015 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this podcast, the tenth in a series by Suzanne Miller and Mary Ann Lapham exploring the application of Agile principles in the Department of Defense, the two researchers discuss …
LISTEN
2015-2-26

Agile, Acquisition
A Workshop on Measuring What Matters

February 20, 2015 • Podcast

By Michelle A. Valdez , Lisa R. Young , Julia H. Allen , Katie C. Stewart

This podcast summarizes the inaugural Measuring What Matters Workshop conducted in November 2014, and the team's experiences planning and executing the workshop, and identifying improvements for future offerings.
LISTEN
2015-2-20

Measurement and Analysis
Applying Agile in the DoD: Tenth Principle

February 12, 2015 • Podcast

By Mary Ann Lapham , Suzanne Miller

In this podcast, part of an ongoing series, Mary Ann Lapham and Suzanne Miller discuss the application of the tenth Agile principle: Simplicity—the art of maximizing the amount of work …
LISTEN
2015-2-12

Agile, Acquisition
Predicting Software Assurance Using Quality and Reliability Measures

January 29, 2015 • Podcast

By Bill Nichols , Carol Woody

In this podcast, the authors discuss how a combination of software development and quality techniques can improve software security.
LISTEN
2015-1-29

Software Assurance
Applying Agile in the DoD: Ninth Principle

January 16, 2015 • Podcast

By Mary Ann Lapham , Suzanne Miller

In this episode, Suzanne Miller and Mary Ann Lapham discuss the application of the ninth Agile principle, "Continuous attention to technical excellence and good design enhances Agile."
LISTEN
2015-1-16

Agile, Acquisition
Cyber Insurance and Its Role in Mitigating Cybersecurity Risk

January 8, 2015 • Podcast

By James J. Cebula , Julia H. Allen , David W. White

In this podcast, Jim Cebula and David White discuss cyber insurance and its potential role in reducing operational and cybersecurity risk.
LISTEN
2015-1-8

Cyber Risk and Resilience Management
AADL and Dassault Aviation

December 18, 2014 • Podcast

By Peter H. Feiler , Thierry Cornilleau (Dassault Aviation)

In this podcast, Peter Feiler and Thierry Cornilleau discuss their experiences with the Architecture Analysis and Design Language.
LISTEN
2014-12-18

Software Architecture
Tactical Cloudlets

December 4, 2014 • Podcast

By Grace Lewis , Suzanne Miller

In this podcast, Grace Lewis discusses five approaches that her team developed and tested for using tactical cloudlets as a strategy for providing infrastructure to support computation offload and data …
LISTEN
2014-12-4

Pervasive Mobile Computing
Agile Software Teams and How They Engage with Systems Engineering on DoD Acquisition Programs

November 27, 2014 • Podcast

By Suzanne Miller , Eileen Wrubel

In this podcast, Eileen Wrubel and Suzanne Miller discuss issues with Agile software teams engaging systems engineering functions in developing and acquiring software-reliant systems.
LISTEN
2014-11-27

Acquisition, Agile
Coding with AADL

November 13, 2014 • Podcast

By Suzanne Miller , Julien Delange

In this podcast, Julien Delange summarizes different perspectives on research related to code generation from software architecture models.
LISTEN
2014-11-13

Software Architecture
The State of Agile

October 30, 2014 • Podcast

By Suzanne Miller , Alistair Cockburn

In this podcast, Alistair Cockburn, an Agile pioneer and one of the original signers of the Agile Manifesto, and SEI principal researcher Suzanne Miller discuss the current state of Agile …
LISTEN
2014-10-30

Agile, Acquisition
Applying Agile in the DoD: Eighth Principle

October 9, 2014 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this episode, the eighth in a series exploring Agile principles across the DoD, Suzanne Miller and Mary Ann Lapham discuss the eighth Agile principle.
LISTEN
2014-10-9

Acquisition, Agile
A Taxonomy of Operational Risks for Cyber Security

October 7, 2014 • Podcast

By James J. Cebula , Julia H. Allen

In this podcast, James Cebula describes how to use a taxonomy to increase confidence that your organization is identifying cyber security risks.
LISTEN
2014-10-7

Cyber Risk and Resilience Management
Agile Metrics

September 25, 2014 • Podcast

By Suzanne Miller , Will Hayes

In this podcast Will Hayes and Suzanne Miller discuss research intended to aid U. S. Department of Defense acquisition professionals in the use of Agile software development methods.
LISTEN
2014-9-25

Acquisition, Agile
Four Principles for Engineering Scalable, Big Data Systems

September 11, 2014 • Podcast

By Ian Gorton , Suzanne Miller

In this podcast, Ian Gorton describes four general principles that hold for any scalable, big data system.
LISTEN
2014-9-11

Software Architecture, Big Data
An Appraisal of Systems Engineering: Defense v. Non-Defense

August 28, 2014 • Podcast

By Joseph P. Elm

In this podcast, Joseph P. Elm analyzes differences in systems-engineering activities for defense and non-defense projects and finds differences in both deployment and effectiveness.
LISTEN
2014-8-28

Measurement and Analysis
HTML5 for Mobile Apps at the Edge

August 14, 2014 • Podcast

By Suzanne Miller , Grace Lewis

In this podcast, Grace Lewis discusses research that explores the feasibility of using HTML5 for developing mobile applications, for "edge" environments where resources and connectivity are uncertain, such as in …
LISTEN
2014-8-14

Pervasive Mobile Computing, Edge Computing
Applying Agile in the DoD: Seventh Principle

July 24, 2014 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this podcast, Suzanne Miller and Mary Ann Lapham explore the application of the seventh Agile principle in the Department of Defense, working software is the primary measure of progress.
LISTEN
2014-7-24

Acquisition, Agile
AADL and Edgewater

July 10, 2014 • Podcast

By Suzanne Miller , Peter H. Feiler , Serban Gheorghe (Edgewater Computer Systems, Inc.)

In this podcast, Peter Feiler and Serban Gheorghe of Edgewater discuss their work on the Architecture Analysis and Design Language.
LISTEN
2014-7-10

Software Architecture
Security and Wireless Emergency Alerts

June 26, 2014 • Podcast

By Suzanne Miller , Christopher J. Alberts , Carol Woody

In this podcast Carol Woody and Christopher Alberts discuss guidelines that they developed to ensure that the WEA service remains robust and resilient against cyber attacks.
LISTEN
2014-6-26

Cybersecurity Engineering
Safety and Behavior Specification Using the Architecture Analysis and Design Language

June 12, 2014 • Podcast

By Suzanne Miller , Julien Delange

Julien Delange discusses two extensions to the Architecture Analysis and Design Language: the behavior annex and the error-model annex.
LISTEN
2014-6-12

Software Architecture
Applying Agile in the DoD: Sixth Principle

May 29, 2014 • Podcast

By Mary Ann Lapham , Suzanne Miller

In this podcast, Suzanne Miller and Mary Ann Lapham discuss the application of the sixth Agile principle in the Department of Defense.
LISTEN
2014-5-29

Acquisition, Agile
Characterizing and Prioritizing Malicious Code

May 29, 2014 • Podcast

By Jose A. Morales , Julia H. Allen

In this podcast, Jose Morales discusses how to prioritize malware samples, helping analysts to identify the most destructive malware to examine first.
LISTEN
2014-5-29

Reverse Engineering for Malware Analysis
Using Quality Attributes to Improve Acquisition

May 15, 2014 • Podcast

By Suzanne Miller , Patrick R. Place

In this podcast, Patrick Place describes research aimed at determining how acquisition quality attributes can be expressed and used to facilitate alignment among the software architecture and acquisition strategy.
LISTEN
2014-5-15

Acquisition
Best Practices for Trust in the Wireless Emergency Alerts Service

April 29, 2014 • Podcast

By Suzanne Miller , Carol Woody , Robert J. Ellison

In this podcast, CERT researchers Robert Ellison and Carol Woody discuss research aimed at increasing alert originators' trust in the WEA service and the public's trust in the alerts that …
LISTEN
2014-4-29

Pervasive Mobile Computing
Three Variations on the V Model for System and Software Testing

April 10, 2014 • Podcast

By Suzanne Miller , Donald Firesmith

In this podcast, Don Firesmith presents three variations on the V model of software or system development.
LISTEN
2014-4-10

Acquisition
Adapting the PSP to Incorporate Verified Design by Contract

March 27, 2014 • Podcast

By Bill Nichols , Suzanne Miller

In this podcast, Bill Nichols discusses a proposal for integrating the Verified Design by Contract method into PSP to reduce the number of defects present at the unit-testing phase, while …
LISTEN
2014-3-27

TSP
Comparing IT Risk Assessment and Analysis Methods

March 25, 2014 • Podcast

By Ben Tomhave , Erik Heidt , Julia H. Allen

In this podcast, the presenters discuss IT risk assessment and analysis, and comparison factors for selecting methods that are a good fit for your organization.
LISTEN
2014-3-25

Cyber Risk and Resilience Management, OCTAVE
AADL and Aerospace

March 13, 2014 • Podcast

By Suzanne Miller , Peter H. Feiler , Myron Hecht (The Aerospace Corporation)

In this podcast, Peter Feiler and Myron Hecht discuss the use of AADL by the Aerospace Corporation.
LISTEN
2014-3-13

Software Architecture
Assuring Open Source Software

February 27, 2014 • Podcast

By Suzanne Miller , Kate Ambrose , Naomi Anderson

In this podcast, Kate Ambrose Sereno and Naomi Anderson discuss research aimed at developing adoptable, evidence-based, data-driven approaches to evaluating (open source) software.
LISTEN
2014-2-27

Software Assurance
Security Pattern Assurance through Roundtrip Engineering

February 13, 2014 • Podcast

By Suzanne Miller , Rick Kazman

In this podcast, Rick Kazman discusses these challenges and a solution he has developed for achieving system security qualities through use of patterns.
LISTEN
2014-2-13

Software Architecture
The Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2)

February 11, 2014 • Podcast

By Nader Mehravari , Julia H. Allen , Jason Christopher (U.S. Department of Energy)

ES-C2M2 helps improve the operational resilience of the U.S. power grid.
LISTEN
2014-2-11

Cyber Risk and Resilience Management
Applying Agile in the DoD: Fifth Principle

January 30, 2014 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this episode, the fifth in a series, Suzanne Miller and Mary Ann Lapham discuss the application of the fifth principle, Build projects around motivated individuals.
LISTEN
2014-1-30

Acquisition, Agile
Software Assurance Cases

January 16, 2014 • Podcast

By Suzanne Miller , Charles Weinstock

In this podcast, Charles Weinstock introduces assurance cases and how they can be used to assure safety, security, and reliability.
LISTEN
2014-1-16

Software Assurance
Raising the Bar - Mainstreaming CERT C Secure Coding Rules

January 7, 2014 • Podcast

By Robert C. Seacord , Julia H. Allen

In this podcast, Robert Seacord describes the CERT-led effort to publish an ISO/IEC technical specification for secure coding rules for compilers and analyzers.
LISTEN
2014-1-7

Secure Coding, Secure Development
AADL and Télécom Paris Tech

December 26, 2013 • Podcast

By Peter H. Feiler , Etienne Borde

Real-World Applications of the Architecture Analysis and Design Language (AADL)
LISTEN
2013-12-26

Software Architecture
From Process to Performance-Based Improvement

December 12, 2013 • Podcast

By Suzanne Miller , Timothy A. Chick , Gene Miluk

In this podcast, Tim Chick and Gene Miluk discuss methodology and outputs of the Checkpoint Diagnostic, a tool that provides organizations with actionable performance related information and analysis closely linked …
LISTEN
2013-12-12

TSP
An Approach to Managing the Software Engineering Challenges of Big Data

November 27, 2013 • Podcast

By John Klein , Suzanne Miller , Ian Gorton

In this episode, Ian Gorton and John Klein discuss big data and the challenges it presents for software engineers. With help from fellow SEI researchers, the two have developed a …
LISTEN
2013-11-27

System of Systems, Big Data
Using the Cyber Resilience Review to Help Critical Infrastructures Better Manage Operational Resilience

November 26, 2013 • Podcast

By Julia H. Allen , Matthew J. Butkovic , Kevin Dillon (Department of Homeland Security)

In this podcast, the presenters explain how CRRs allow critical infrastructure owners to compare their cybersecurity performance with their peers.
LISTEN
2013-11-26

Cyber Risk and Resilience Management
Situational Awareness Mashups

November 14, 2013 • Podcast

By Soumya Simanta , Suzanne Miller

In this podcast Soumya Simanta describes research aimed at creating a software prototype that allows warfighters and first responders to rapidly integrate or mash geo-tagged situational awareness data from multiple …
LISTEN
2013-11-14

Pervasive Mobile Computing
Applying Agile in the DoD: Fourth Principle

October 31, 2013 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this episode, the fourth in a series about the application of agile principles in the DOD, Suzanne Miller and Mary Ann Lapham discuss the application of the fourth principle, …
LISTEN
2013-10-31

Acquisition, Agile
Architecting Systems of the Future

October 17, 2013 • Podcast

By Suzanne Miller , Eric Werner

In this episode, Eric Werner discusses research that he and several of his colleagues are conducting to help software developers create systems for the many-core central processing units in massively …
LISTEN
2013-10-17

Cyber-Physical Systems
Acquisition Archetypes

September 26, 2013 • Podcast

By Suzanne Miller , William E. Novak

In this episode, Bill Novak talks about his work with acquisition archetypes and how they can be used to help government programs avoid problems in software development and systems acquisition.
LISTEN
2013-9-26

Acquisition
Human-in-the-Loop Autonomy

September 12, 2013 • Podcast

By James Edmondson , Suzanne Miller

In this episode, James Edmondson discusses his research on autonomous systems, specifically robotic systems and autonomous systems for robotic systems.
LISTEN
2013-9-12

Pervasive Mobile Computing
Mobile Applications for Emergency Managers

August 29, 2013 • Podcast

By Bill Pollak , Mike Petock , Adam Miller (Huntingdon County, Pennsylvania, Emergency Management Agency)

Learn about the SEI's Advanced Mobile Systems Team's work with the Huntingdon County, Pennsylvania, Emergency Management Agency.
LISTEN
2013-8-29

Pervasive Mobile Computing
Why Use Maturity Models to Improve Cybersecurity: Key Concepts, Principles, and Definitions

August 27, 2013 • Podcast

By Richard A. Caralli , Julia H. Allen

In this podcast, Rich Caralli explains how maturity models provide measurable value in improving an organization's cybersecurity capabilities.
LISTEN
2013-8-27

Best Practices, Governance
Applying Agile in the DoD: Third Principle

August 15, 2013 • Podcast

By Mary Ann Lapham , Suzanne Miller

A discussion of the application of the third Agile principle, "Deliver working software frequently, from a couple of weeks to a couple of months, with a preference to the shorter …
LISTEN
2013-8-15

Acquisition, Agile
DevOps - Transform Development and Operations for Fast, Secure Deployments

July 30, 2013 • Podcast

By Julia H. Allen , Gene Kim (IP Services and ITPI)

In this podcast, Gene Kim explains how the "release early, release often" approach significantly improves software performance, stability, and security.
LISTEN
2013-7-30

Best Practices
Application Virtualization as a Strategy for Cyber Foraging

July 25, 2013 • Podcast

By Suzanne Miller , Grace Lewis

In this podcast, researcher Grace Lewis discusses application virtualization as a more lightweight alternative to VM synthesis for cloudlet provisioning.
LISTEN
2013-7-25

Pervasive Mobile Computing
Common Testing Problems: Pitfalls to Prevent and Mitigate

July 11, 2013 • Podcast

By Donald Firesmith , Suzanne Miller

Don Firesmith discusses problems that occur during testing as well as a framework that lists potential symptoms by which each can be recognized, potential negative consequences, and potential causes, and …
LISTEN
2013-7-11

Acquisition
Joint Programs and Social Dilemmas

June 27, 2013 • Podcast

By William E. Novak

In this episode, SEI researcher Bill Novak discusses joint programs and social dilemmas, which have become increasingly common in defense acquisition, and the ways in joint program outcomes can be …
LISTEN
2013-6-27

Acquisition
Applying Agile in the DoD: Second Principle

June 13, 2013 • Podcast

By Suzanne Miller , Mary Ann Lapham

In this episode, SEI researchers discuss the application of the second Agile principle, “Welcome changing requirements, even late in development.
LISTEN
2013-6-13

Agile, Acquisition
Managing Disruptive Events - CERT-RMM Experience Reports

June 11, 2013 • Podcast

By Julia H. Allen , Nader Mehravari

In this podcast, the participants describe four experience reports that demonstrate how the CERT-RMM can be applied to manage operational risks.
LISTEN
2013-6-11

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Reliability Validation and Improvement Framework

May 23, 2013 • Podcast

By Peter H. Feiler

In this podcast, Peter Feiler discusses his recent work to improve the quality of software-reliant systems through an approach known as the Reliability Validation and Improvement Framework.
LISTEN
2013-5-23

Software Architecture
Using a Malware Ontology to Make Progress Towards a Science of Cybersecurity

May 9, 2013 • Podcast

By Julia H. Allen , Dave Mundie

In this podcast, Dave Mundie explains why a common language is essential to developing a shared understanding to better analyze malicious code.
LISTEN
2013-5-9

Reverse Engineering for Malware Analysis
The Business Case for Systems Engineering

May 9, 2013 • Podcast

By Joseph P. Elm , Suzanne Miller

Joe Elm discusses the results of a recent technical report, which establishes clear links between the application of systems engineering (SE) best practices to projects and programs and the performance …
LISTEN
2013-5-9

Performance and Dependability
Applying Agile in the DoD: First Principle

April 18, 2013 • Podcast

By Mary Ann Lapham , Suzanne Miller

In this episode, Suzanne Miller and Mary Ann Lapham discuss the application of the first Agile principle, "Our highest priority is to satisfy the customer through early and continuous delivery …
LISTEN
2013-4-18

Acquisition, Agile
The Evolution of a Science Project

April 4, 2013 • Podcast

By William E. Novak , Andrew P. Moore

In this podcast, Bill Novak and Andy Moore describe a recent technical report, The Evolution of a Science Project, which intends to improve acquisition staff decision-making.
LISTEN
2013-4-4

Acquisition, Supply Chain Assurance
Securing Mobile Devices aka BYOD

March 26, 2013 • Podcast

By Julia H. Allen , Joseph Mayes

In this podcast, Joe Mayes discusses how to ensure the security of personal mobile devices that have access to enterprise networks.
LISTEN
2013-3-26

Best Practices
What's New With Version 2 of the AADL Standard?

March 21, 2013 • Podcast

By Peter H. Feiler

In this podcast, Peter Feiler discusses the latest changes to the Architecture Analysis & Design Language (AADL) standard.
LISTEN
2013-3-21

Software Architecture
The State of the Practice of Cyber Intelligence

March 7, 2013 • Podcast

By Jay McAllister , Suzanne Miller , Troy Townsend

In this podcast, Troy Townsend and Jay McAllister discuss their findings on the state of the practice of cyber intelligence.
LISTEN
2013-3-7

Critical Infrastructure Protection, Cyber-Physical Systems
Mitigating Insider Threat - New and Improved Practices Fourth Edition

February 28, 2013 • Podcast

By Lori Flynn , Julia H. Allen , George Silowash

In this podcast, participants explain how 371 cases of insider attacks led to 4 new and 15 updated best practices for mitigating insider threats.
LISTEN
2013-2-28

Insider Threat
Technology Readiness Assessments

February 21, 2013 • Podcast

By Suzanne Miller , Michael S. Bandor

Michael Bandor discusses technology readiness assessments, which the DoD defines as a formal, systematic, metrics-based process and accompanying report that assess the maturity of critical hardware and software technologies to …
LISTEN
2013-2-21

Acquisition, Supply Chain Assurance
Standards in Cloud Computing Interoperability

February 7, 2013 • Podcast

By Grace Lewis

In this podcast, Grace Lewis discusses her latest research exploring the role of standards in cloud-computing interoperability.
LISTEN
2013-2-7

Service-Oriented Architecture, Cloud Computing
Managing Disruptive Events: Demand for an Integrated Approach to Better Manage Risk

January 31, 2013 • Podcast

By Julia H. Allen , Nader Mehravari

In this podcast, Nader Mehravari describes how governments and markets are calling for the integration of plans for and responses to disruptive events.
LISTEN
2013-1-31

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
The Latest Developments in AADL

January 17, 2013 • Podcast

By Julien Delange , Peter H. Feiler

Julien Delange and Peter Feiler discuss the latest developments with the Architecture Analysis and Design Language (AADL) standard.
LISTEN
2013-1-17

Performance and Dependability, Software Architecture
The Fundamentals of Agile

January 3, 2013 • Podcast

By Timothy A. Chick

In this episode, Tim Chick, a senior member of the technical staff in the Team Software Process (TSP) initiative, discusses the fundamentals of agile, specifically what it means for an …
LISTEN
2013-1-3

TSP, Agile
Software for Soldiers who use Smartphones

December 20, 2012 • Podcast

By Edwin J. Morris

In this episode, Ed Morris describes research to create a software application for smartphones that allows soldier end-users to program their smartphones to provide an interface tailored to the information …
LISTEN
2012-12-20

Service-Oriented Architecture
Managing Disruptive Events: Making the Case for Operational Resilience

December 19, 2012 • Podcast

By Julia H. Allen , Nader Mehravari

In this podcast, Nader Mehravari describes how today's high-risk, global, fast, and very public business environment demands a more integrated approach.
LISTEN
2012-12-19

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Architecting Service-Oriented Systems

December 6, 2012 • Podcast

By Grace Lewis

Grace Lewis discusses general guidelines for architecting service-oriented systems, how common service-oriented system components support these principles, and the effect these principles and their implementation have on system quality attributes.
LISTEN
2012-12-6

Software Architecture, Service-Oriented Architecture
The SEI Strategic Plan

November 15, 2012 • Podcast

By Bill Scherlis

In this podcast, Bill Scherlis discusses the development of the strategic plan of the SEI to advance the practice of software engineering for the DoD.
LISTEN
2012-11-15

Software Assurance
Quantifying Uncertainty in Early Lifecycle Cost Estimation

November 1, 2012 • Podcast

By Robert W. Stoddard , James McCurley

In this podcast episode, Jim McCurley and Robert Stoddard discuss a new method developed by the SEI's Software Engineering Measurement and Analysis (SEMA) team, Quantifying Uncertainty in Early Lifecycle Cost …
LISTEN
2012-11-1

Measurement and Analysis
Using Network Flow Data to Profile Your Network and Reduce Vulnerabilities

October 23, 2012 • Podcast

By Julia H. Allen , Sid Faber , Austin Whisnant

In this podcast, participants discuss how a network profile can help identify unintended points of entry, misconfigurations, and other weaknesses.
LISTEN
2012-10-23

Best Practices
Architecting a Financial System with TSP

October 18, 2012 • Podcast

By Felix Bachmann , Jim McHale

In this episode, Felix Bachmann and James McHale discuss their work on a project between the SEI and Bursatec to create a reliable and fast new trading system for Groupo …
LISTEN
2012-10-18

Software Architecture, TSP
The Importance of Data Quality

October 4, 2012 • Podcast

By David Zubrow

In this episode, Dave Zubrow discusses the importance of data quality and research that his team is undertaking in this area.
LISTEN
2012-10-4

Measurement and Analysis
How to More Effectively Manage Vulnerabilities and the Attacks that Exploit Them

September 25, 2012 • Podcast

By Art Manion , Julia H. Allen

In this podcast, Greg Crabb explains how CERT-RMM can be used to establish and meet resilience requirements for a wide range of business objectives.
LISTEN
2012-9-25

Incident Management, Best Practices
Misaligned Incentives

September 20, 2012 • Podcast

By William E. Novak

In this episode, Novak discusses misaligned incentives, misaligned people incentives in software acquisition programs, and how the wrong incentives can undermine acquisition programs and produce poor outcomes.
LISTEN
2012-9-20

Acquisition
How a Disciplined Process Enhances & Enables Agility

September 4, 2012 • Podcast

By Bill Nichols

In this podcast, Bill Nichols discusses how a disciplined process enables and enhances agility
LISTEN
2012-9-4

TSP
Agile Acquisition

September 4, 2012 • Podcast

By Mary Ann Lapham , Suzanne Miller

This podcast explores the SEI's research and work to assist the DoD in Agile acquisition.
LISTEN
2012-9-4

Acquisition, Agile
An Architecture-Focused Measurement Framework for Managing Technical Debt

September 4, 2012 • Podcast

By Ipek Ozkaya

In this podcast, Ipek Ozkaya discusses the SEI's research on the strategic management of technical debt, which involves decisions made to defer necessary work during the planning or execution of …
LISTEN
2012-9-4

Software Architecture, Technical Debt
Cloud Computing for the Battlefield

September 4, 2012 • Podcast

By Grace Lewis

Grace Lewis discusses her research to overcome challenges for battlefield computing by using cloudlets: localized, lightweight servers running one or more virtual machines on which soldiers can offload expensive computations …
LISTEN
2012-9-4

Service-Oriented Architecture, Cloud Computing
U.S. Postal Inspection Service Use of the CERT Resilience Management Model

August 21, 2012 • Podcast

By Julia H. Allen , Gregory Crabb (United States Postal Service)

In this podcast, Greg Crabb explains how CERT-RMM can be used to establish and meet resilience requirements for a wide range of business objectives.
LISTEN
2012-8-21

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Insights from the First CERT Resilience Management Model Users Group

July 17, 2012 • Podcast

By Lisa R. Young , Julia H. Allen

In this podcast, Lisa Young explains that implementing CERT-RMM requires well-defined improvement objectives, sponsorship, and more.
LISTEN
2012-7-17

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
NIST Catalog of Security and Privacy Controls, Including Insider Threat

April 24, 2012 • Podcast

By Ron Ross (NIST) , Joji Montelibano , Julia H. Allen

In this podcast, participants discuss why security controls, including those for insider threat, are necessary to protect information and information systems.
LISTEN
2012-4-24

Best Practices
Cisco's Adoption of CERT Secure Coding Standards

February 28, 2012 • Podcast

By Martin Sebor (Cisco) , Julia H. Allen

In this podcast, Martin Sebor explains how implementing secure coding standards is a sound business decision.
LISTEN
2012-2-28

Cyber Workforce Development
How to Become a Cyber Warrior

January 31, 2012 • Podcast

By Julia H. Allen , Dennis M. Allen

In this podcast, Dennis Allen explains that protecting the internet and its users against cyber attacks requires more skilled cyber warriors.
LISTEN
2012-1-31

Cyber Workforce Development
Considering Security and Privacy in the Move to Electronic Health Records

December 20, 2011 • Podcast

By Deborah Lafky (Healthcare Information Technology (HIT) Security/Cybersecurity) , Julia H. Allen , Matthew J. Butkovic

In this podcast, participants discuss how using electronic health records bring many benefits along with security and privacy challenges.
LISTEN
2011-12-20

Best Practices
Measuring Operational Resilience

October 4, 2011 • Podcast

By Pamela D. Curtis , Julia H. Allen

In this podcast, Julia Allen explains that measures of operational resilience should answer key questions, inform decisions, and affect behavior.
LISTEN
2011-10-4

Measurement and Analysis, Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Why Organizations Need a Secure Domain Name System

September 6, 2011 • Podcast

By Julia H. Allen , Alex Nicoll

Use of Domain Name System security extensions can help prevent website hijacking attacks.
LISTEN
2011-9-6

Best Practices
Controls for Monitoring the Security of Cloud Services

August 2, 2011 • Podcast

By Julia H. Allen , Jonathan Spring , Art Manion

In this podcast, participants explain that it depends on the service model how cloud providers and customers can use controls to protect sensitive information.
LISTEN
2011-8-2

Best Practices
Building a Malware Analysis Capability

July 12, 2011 • Podcast

By Julia H. Allen , Jeff Gennari

In this podcast, Jeff Gennari explains that analyzing malware is essential to assessing the damage and reducing the impact associated with ongoing infection.
LISTEN
2011-7-12

Reverse Engineering for Malware Analysis
Using the Smart Grid Maturity Model (SGMM)

May 5, 2011 • Podcast

By Julia H. Allen , David W. White

In this podcast, David White describes how over 100 electric power utilities are using the Smart Grid Maturity Model.
LISTEN
2011-5-5

Cyber Risk and Resilience Management
Integrated, Enterprise-Wide Risk Management: NIST 800-39 and CERT-RMM

March 29, 2011 • Podcast

By Julia H. Allen , James J. Cebula , Ron Ross (NIST)

In this podcast, participants explain why and how business leaders must address risk at the enterprise, business process, and system levels.
LISTEN
2011-3-29

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Conducting Cyber Exercises at the National Level

February 22, 2011 • Podcast

By Brett Lambo (U.S. Department of Homeland Security) , Julia H. Allen , Matthew J. Butkovic

In this podcast, participants discuss exercises that help organizations, governments, and nations prepare for, identify, and mitigate cyber risks.
LISTEN
2011-2-22

Cyber Risk and Resilience Management
Indicators and Controls for Mitigating Insider Threat

January 25, 2011 • Podcast

By Julia H. Allen , Michael Hanley

In this podcast, Michael Hanley explains how technical controls can be effective in helping to prevent, detect, and respond to insider crimes.
LISTEN
2011-1-25

Insider Threat
How Resilient Is My Organization?

December 9, 2010 • Podcast

By Julia H. Allen , David W. White , Richard A. Caralli

In this podcast, Richard Caralli explains how CERT-RMM can ensure that critical assets and services perform as expected in the face of stress and disruption.
LISTEN
2010-12-9

Cyber Risk and Resilience Management
Public-Private Partnerships: Essential for National Cyber Security

November 30, 2010 • Podcast

By Julia H. Allen , John Haller , Samuel A. Merrell , Philip Huff (Arkansas Electric Cooperative Corporation)

In this podcast, participants explain that knowledge of software assurance is essential to ensure that complex systems function as intended.
LISTEN
2010-11-30

Governance
Software Assurance: A Master's Level Curriculum

October 26, 2010 • Podcast

By Julia H. Allen , Nancy R. Mead , Thomas B. Hilburn (Embry-Riddle Aeronautical University) , Richard C. Linger (Oak Ridge National Laboratory)

In this podcast, participants explain how knowledge about software assurance is essential to ensure that complex systems function as intended.
LISTEN
2010-10-26

Cyber Workforce Development
How to Develop More Secure Software - Practices from Thirty Organizations

September 28, 2010 • Podcast

By Julia H. Allen , Sammy Migues (Cigital) , Gary McGraw

In this podcast, participants discuss how organizations can benchmark their software security practices against 109 observed activities from 30 organizations.
LISTEN
2010-9-28

Software Assurance
Mobile Device Security: Threats, Risks, and Actions to Take

August 31, 2010 • Podcast

By Julia H. Allen , Jonathan Frederick

In this podcast, Jonathan Frederick explains how internet-connected mobile devices are becoming increasingly attractive targets.
LISTEN
2010-8-31

Best Practices
Establishing a National Computer Security Incident Response Team (CSIRT)

August 19, 2010 • Podcast

By Jeffrey J. Carpenter , John Haller , Julia H. Allen

In this podcast, participants discuss how essential a national CSIRT is for protecting national and economic security and continuity.
LISTEN
2010-8-19

Governance, Incident Management
Securing Industrial Control Systems

July 27, 2010 • Podcast

By Julia H. Allen , Art Manion

In this podcast, Julia Allen how critical it is to secure systems that control physical switches, valves, pumps, meters, and manufacturing lines.
LISTEN
2010-7-27

Best Practices
The Power of Fuzz Testing to Reduce Security Vulnerabilities

May 25, 2010 • Podcast

By Julia H. Allen , Will Dormann

In this podcast, Will Dormann urges listeners to subject their software to fuzz testing to help identify and eliminate security vulnerabilities.
LISTEN
2010-5-25

Best Practices
Protect Your Business from Money Mules

April 27, 2010 • Podcast

By Julia H. Allen , Chad Dougherty

Organized criminals recruit unsuspecting intermediaries to help steal funds from small businesses.
LISTEN
2010-4-27

Insider Threat
Train for the Unexpected

March 3, 2010 • Podcast

By Matthew Meyer (M&I Corporation) , Julia H. Allen

In this podcast, Matthew Meyer explains that being able to respond effectively when faced with a disruptive event requires becoming more resilient.
LISTEN
2010-3-3

Cyber Workforce Development
The Role of the CISO in Developing More Secure Software

March 2, 2010 • Podcast

By Julia H. Allen , Pravir Chandra (Fortify Software)

In this podcast, Pravir Chandra warns that CISOs must leave no room for doubt that they understand what is expected of them when developing secure software.
LISTEN
2010-3-2

Software Assurance
Computer and Network Forensics: A Master's Level Curriculum

February 2, 2010 • Podcast

By Julia H. Allen , Kristopher Rush

In this podcast, Kris Rush describes how students learn to combine multiple facets of digital forensics and draw conclusions to support investigations.
LISTEN
2010-2-2

Digital Intelligence and Investigation
Introducing the Smart Grid Maturity Model (SGMM)

January 12, 2010 • Podcast

By Julia H. Allen , Ray Jones (APQC)

In this podcast, Ray Jones explains how the SGMM provides a roadmap to guide an organization's transformation to the smart grid.
LISTEN
2010-1-12

Cyber Risk and Resilience Management
Leveraging Security Policies and Procedures for Electronic Evidence Discovery

January 9, 2010 • Podcast

By Julia H. Allen , John Christiansen (Christiansen IT Law)

In this podcast, John Christiansen explains that effectively responding to e-discovery requests depends on well-defined policies, procedures, and processes.
LISTEN
2010-1-9

Governance
Integrating Privacy Practices into the Software Development Life Cycle

December 22, 2009 • Podcast

By Julia H. Allen , Ralph Hood (Microsoft) , Kim Howell (Microsoft)

In this podcast, participants explain that addressing privacy during software development is just as important as addressing security.
LISTEN
2009-12-22
Using the Facts to Protect Enterprise Networks: CERT's NetSA Team

December 1, 2009 • Podcast

By Julia H. Allen , Timothy J. Shimeall

In this podcast, Timothy Shimeall describes how network defenders and business leaders can use NetSA measures to protect their networks.
LISTEN
2009-12-1

Cyber Workforce Development
Ensuring Continuity of Operations When Business Is Disrupted

November 10, 2009 • Podcast

By Gary Daniels (Marshall & Ilsley Corporation) , Julia H. Allen

In this podcast, Gary Daniels explains that providing critical services during times of stress depends on documented, tested business continuity plans.
LISTEN
2009-11-10

Cyber Risk and Resilience Management
Managing Relationships with Business Partners to Achieve Operational Resiliency

October 20, 2009 • Podcast

By Julia H. Allen , David W. White

In this podcast, David White explains why a defined, managed process for third party relationships is essential, particularly when business is disrupted.
LISTEN
2009-10-20

Cyber Risk and Resilience Management
The Smart Grid: Managing Electrical Power Distribution and Use

September 29, 2009 • Podcast

By Julia H. Allen , James F. Stevens

In this podcast, James Stevens explains how using the smart grid comes with some new privacy and security challenges.
LISTEN
2009-9-29

Cyber Risk and Resilience Management
Electronic Health Records: Challenges for Patient Privacy and Security

September 8, 2009 • Podcast

By Robert Charette (ITABHI Corporation) , Julia H. Allen

In this podcast, Robert Charette explains why electronic health records (EHRs) are possibly the most complicated area of IT today.
LISTEN
2009-9-8
Mitigating Insider Threat: New and Improved Practices

August 18, 2009 • Podcast

By Andrew P. Moore , Randall F. Trzeciak , Julia H. Allen , Dawn Cappelli

Two hundred and eighty-two cases of actual insider attacks suggest 16 best practices for preventing and detecting insider threat.
LISTEN
2009-8-18

Insider Threat
Rethinking Risk Management

July 7, 2009 • Podcast

By Julia H. Allen , Christopher J. Alberts

In this podcast, Christopher Alberts urges business leaders to adopt new approaches to addressing risks across the life cycle and supply chain.
LISTEN
2009-7-7

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
The Upside and Downside of Security in the Cloud

June 16, 2009 • Podcast

By Tim Mather (RSA) , Julia H. Allen

In this podcast, Tim Mather advises business leaders considering cloud services to weigh the economic benefits against the security and privacy risks.
LISTEN
2009-6-16

Best Practices
More Targeted, Sophisticated Attacks: Where to Pay Attention

May 26, 2009 • Podcast

By Martin Linder , Julia H. Allen

In this podcast, Martin Linder urges business leaders to take action to better mitigate sophisticated social engineering attacks.
LISTEN
2009-5-26

Insider Threat
Is There Value in Identifying Software Security "Never Events?"

May 5, 2009 • Podcast

By Robert Charette (ITABHI Corporation) , Julia H. Allen

In this podcast, Robert Charette suggests when to examine responsibilities when developing software with known, preventable errors.
LISTEN
2009-5-5

Software Assurance
Cyber Security, Safety, and Ethics for the Net Generation

April 14, 2009 • Podcast

By Julia H. Allen , Rodney Petersen (EDUCAUSE)

In this podcast, Rodney Peterson explains why capitalizing on the cultural norms of the Net Generation is essential when developing security awareness programs.
LISTEN
2009-4-14

Cyber Workforce Development
An Experience-Based Maturity Model for Software Security

March 31, 2009 • Podcast

By Julia H. Allen , Brian Chess (Fortify Software) , Sammy Migues (Cigital) , Gary McGraw

In this podcast, participants discuss how observed practice, represented as a maturity model, can serve as a basis for developing more secure software.
LISTEN
2009-3-31

Software Assurance
Mainstreaming Secure Coding Practices

March 17, 2009 • Podcast

By Julia H. Allen , Robert C. Seacord

In this podcast, Robert Seacord explains how requiring secure coding practices when building or buying software can dramatically reduce vulnerabilities.
LISTEN
2009-3-17

Software Assurance, Cyber Workforce Development
Security: A Key Enabler of Business Innovation

March 3, 2009 • Podcast

By Julia H. Allen , Laura Robinson (Robinson Insight) , Roland Cloutier (EMC Corporation)

In this podcast, participants describe how making security strategic to business innovation involves seven strategies.
LISTEN
2009-3-3

Governance
Better Incident Response Through Scenario Based Training

February 17, 2009 • Podcast

By Christopher May , Julia H. Allen

In this podcast, Christopher May explains how teams are better prepared to respond to incidents if realistic, hands-on training is part of their normal routine.
LISTEN
2009-2-17

Incident Management, Cyber Workforce Development
An Alternative to Risk Management for Information and Software Security

February 3, 2009 • Podcast

By Brian Chess (Fortify Software) , Julia H. Allen

In this podcast, Brian Chess explain how standards, compliance, and process are better than risk management for ensuring information and software security.
LISTEN
2009-2-3

Cyber Risk and Resilience Management
Tackling Tough Challenges: Insights from CERT’s Director Rich Pethia

January 20, 2009 • Podcast

By Julia H. Allen , Richard D. Pethia

In this podcast, Rich Pethia reflects on the CERT Division's 20-year history and discusses its future IT and security challenges.
LISTEN
2009-1-20

Best Practices
Climate Change: Implications for Information Technology and Security

December 9, 2008 • Podcast

By Julia H. Allen , Richard Power (Carnegie Mellon CyLab)

In this podcast, Richard Power explains how climate change requires new strategies for dealing with traditional IT and information security risks.
LISTEN
2008-12-9

Governance
Using High Fidelity, Online Training to Stay Sharp

November 25, 2008 • Podcast

By Julia H. Allen , Jim Wrubel

In this podcast, Jim Wrubel explains how virtual training environments can deliver high quality content to security professionals on-demand, anywhere, anytime.
LISTEN
2008-11-25

Cyber Workforce Development
Integrating Security Incident Response and e-Discovery

November 11, 2008 • Podcast

By David Matthews (City of Seattle) , Julia H. Allen

In this podcast, Julia Allen explains how responding to an e-discovery request involves many of the same steps and roles as responding to a security incident.
LISTEN
2008-11-11

Incident Management
Concrete Steps for Implementing an Information Security Program

October 28, 2008 • Podcast

By Julia H. Allen , Jennifer Bayuk (No Affiliation)

In this podcast, Jennifer Bayuk explains how successful security programs are based on strategy, policy, awareness, implementation, monitoring, and remediation.
LISTEN
2008-10-28

Best Practices
Virtual Communities: Risks and Opportunities

October 14, 2008 • Podcast

By Julia H. Allen , Jan Wolynski (Royal Canadian Mounted Police)

In this podcast, Jan Wolynski advises business leaders to evaluate risks and opportunities when considering conducting business in online, virtual communities.
LISTEN
2008-10-14

Best Practices
Developing Secure Software: Universities as Supply Chain Partners

September 30, 2008 • Podcast

By Julia H. Allen , Mary Ann Davidson (Oracle)

In this podcast, Mary Ann Davidson explains how integrating security into university curricula is a key solution to developing more secure software.
LISTEN
2008-9-30

Software Assurance, Cyber Workforce Development
Security Risk Assessment Using OCTAVE Allegro

September 16, 2008 • Podcast

By Julia H. Allen , Lisa R. Young

In this podcast, Lisa Young describes OCTAVE Allegro, a streamlined assessment method that focuses on risks to information used by critical business services.
LISTEN
2008-9-16

Cyber Risk and Resilience Management
Getting to a Useful Set of Security Metrics

September 2, 2008 • Podcast

By Julia H. Allen , Clint Kreitner (The Center for Internet Security)

Well-defined metrics are essential to determine which security practices are worth the investment.
LISTEN
2008-9-2

Measurement and Analysis
How to Start a Secure Software Development Program

August 20, 2008 • Podcast

By Gary McGraw , Julia H. Allen

In this podcast, Gary McGraw explains how to achieve software security by thinking like an attacker and integrating practices into the development lifecycle.
LISTEN
2008-8-20

Software Assurance, Cyber Workforce Development
Managing Risk to Critical Infrastructures at the National Level

August 5, 2008 • Podcast

By Bradford J. Willke , Julia H. Allen

In this podcast, Bradford Willke explain how protecting critical infrastructures and the information they use are essential for preserving our way of life.
LISTEN
2008-8-5

Governance
Analyzing Internet Traffic for Better Cyber Situational Awareness

July 28, 2008 • Podcast

By Julia H. Allen , Derek Gabbard

In this podcast, Derek Gabbard discusses automation, innovation, reaction, and expansion as the foundation for meaningful network traffic intelligence.
LISTEN
2008-7-28

Incident Management
Managing Security Vulnerabilities Based on What Matters Most

July 22, 2008 • Podcast

By Julia H. Allen , Art Manion

In this podcast, Art Manion explains that determining which security vulnerabilities to address should be based on the importance of the information asset.
LISTEN
2008-7-22

Incident Management
Identifying Software Security Requirements Early, Not After the Fact

July 8, 2008 • Podcast

By Julia H. Allen , Nancy R. Mead

In this podcast, Nancy Mead explains that during requirements engineering, software engineers need to think about how software should behave when under attack.
LISTEN
2008-7-8

Software Assurance
Making Information Security Policy Happen

June 24, 2008 • Podcast

By Julia H. Allen , Paul Love (The Standard)

In this podcast, Paul Love argues that targeted, innovative communications and a robust lifecycle are keys for security policy success.
LISTEN
2008-6-24

Governance
Becoming a Smart Buyer of Software

June 10, 2008 • Podcast

By Brian P. Gallagher , Julia H. Allen

Managing software that is developed by an outside organization can be more challenging than building it yourself.
LISTEN
2008-6-10

Software Assurance
Building More Secure Software

May 27, 2008 • Podcast

By Mike Petock , Julia H. Allen , Bill Pollak

In this podcast, Julia Allen explains how software security is about building more defect-free software to reduce vulnerabilities targeted by attackers.
LISTEN
2008-5-27

Software Assurance, Cyber Workforce Development
Connecting the Dots Between IT Operations and Security

May 13, 2008 • Podcast

By Julia H. Allen , Gene Kim (IP Services and ITPI)

In this podcast, Gene Kim describes how high performing organizations must integrate information security controls into their IT operational processes.
LISTEN
2008-5-13

Best Practices
Getting in Front of Social Engineering

April 29, 2008 • Podcast

By Julia H. Allen , Gary Hinson (No Affiliation)

In this podcast, Betsy Nichols tells us how benchmark results can compare results with peers, drive performance, and help determine how much security is enough.
LISTEN
2008-4-29

Insider Threat
Using Benchmarks to Make Better Security Decisions

April 15, 2008 • Podcast

By Betsy Nichols (PlexLogic) , Julia H. Allen

In this podcast, Betsy Nichols describes how benchmark results can be used to help determine how much security is enough.
LISTEN
2008-4-15

Measurement and Analysis
Protecting Information Privacy - How To and Lessons Learned

April 1, 2008 • Podcast

By Julia H. Allen , Kim Hargraves (Microsoft)

In this podcast, Kim Hargraves describes three keys to ensuring information privacy in an organization.
LISTEN
2008-4-1
Initiating a Security Metrics Program: Key Points to Consider

March 18, 2008 • Podcast

By Julia H. Allen , Samuel A. Merrell

In this podcast, Samuel Merrell explains that a sound security metrics program should select data relevant to consumers from repeatable processes.
LISTEN
2008-3-18

Measurement and Analysis
Insider Threat and the Software Development Life Cycle

March 4, 2008 • Podcast

By Dawn Cappelli , Julia H. Allen

In this podcast, Dawn Cappelli explains how insider threat vulnerabilities can be introduced during all phases of the software development lifecycle.
LISTEN
2008-3-4

Insider Threat
Tackling the Growing Botnet Threat

February 19, 2008 • Podcast

By Julia H. Allen , Nicholas Ianelli

In this podcast, Nicholas Ianelli cautions business leaders to understand the risks to their organizations caused by the proliferation of botnets.
LISTEN
2008-2-19

Insider Threat
Building a Security Metrics Program

February 5, 2008 • Podcast

By Betsy Nichols (PlexLogic) , Julia H. Allen

In this podcast, Betsy Nichols explains that reporting meaningful security metrics depends on topic selection, context definition, and data access.
LISTEN
2008-2-5

Measurement and Analysis
Inadvertent Data Disclosure on Peer-to-Peer Networks

January 22, 2008 • Podcast

By M. Eric Johnson (Dartmouth College) , Scott Dynes (Dartmouth College) , Julia H. Allen

In this podcast, participants discuss how peer-to-peer networks are being used to unintentionally disclose government, commercial, and personal information.
LISTEN
2008-1-22

Best Practices
Information Compliance: A Growing Challenge for Business Leaders

January 8, 2008 • Podcast

By Julia H. Allen , Tom Smedinghoff (Wildman Harrold)

In this podcast, Tom Smedinghoff reminds directors and executives that they are personally accountable for protecting information entrusted to their care.
LISTEN
2008-1-8

Governance
Internal Audit's Role in Information Security: An Introduction

December 10, 2007 • Podcast

By Dan Swanson (Dan Swanson and Associates) , Julia H. Allen

In this podcast, Dan Swanson explains how an internal audit can serve a key role in establishing an effective information security program.
LISTEN
2007-12-10

Governance
What Business Leaders Can Expect from Security Degree Programs

November 27, 2007 • Podcast

By Sean Beggs (Carnegie Mellon University) , Stephanie Losi

In this podcast, participants discuss whether information security degree programs meet the needs of business leaders seeking knowledgeable employees.
LISTEN
2007-11-27

Cyber Workforce Development
The Path from Information Security Risk Assessment to Compliance

November 13, 2007 • Podcast

By Julia H. Allen , William R. Wilson

In this podcast, William Wilson explains how an information security risk assessment, performed with operational risk management, can contribute to compliance.
LISTEN
2007-11-13

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
Computer Forensics for Business Leaders: Building Robust Policies and Processes

October 30, 2007 • Podcast

By Stephanie Losi , Cal Waits

In this podcast, participants discuss how business leaders can play a key role in computer forensics by establishing and testing strong policies.
LISTEN
2007-10-30

Digital Intelligence and Investigation
Business Resilience: A More Compelling Argument for Information Security

October 16, 2007 • Podcast

By Stephanie Losi , Scott Dynes (Dartmouth College)

In this podcast, participants discuss how a business resilience argument can bridge the gap between information security officers and business leaders.
LISTEN
2007-10-16

Cyber Risk and Resilience Management
Resiliency Engineering: Integrating Security, IT Operations, and Business Continuity

October 15, 2007 • Podcast

By Lisa R. Young , Julia H. Allen

In this podcast, Lisa Young suggests that by taking a holistic view of business resilience, business leaders can help their organizations stand up to threats.
LISTEN
2007-10-15

Cyber Risk and Resilience Management, Resilience Management Model (RMM)
The Human Side of Security Trade-Offs

September 18, 2007 • Podcast

By Greg Newby (Arctic Region Supercomputing Center) , Stephanie Losi

In this podcast, participants explain that it's easy to think of security as a collection of technologies and tools, but that people are the real key.
LISTEN
2007-9-18

Cyber Workforce Development
Dual Perspectives: A CIO's and CISO's Take on Security

September 4, 2007 • Podcast

By Patty Morrison (Motorola) , Bill Boni (Motorola) , Julia H. Allen

In this podcast, participants explain that since you can't secure everything, managing security risk to a "commercially reasonable degree" is best.
LISTEN
2007-9-4
Tackling Security at the National Level: A Resource for Leaders

August 7, 2007 • Podcast

By Julia H. Allen , Jeffrey J. Carpenter

In this podcast, Clint Kreitner explains how information security costs can be reduced by enforcing standard configurations for widely deployed systems.
LISTEN
2007-8-7

Governance
Reducing Security Costs with Standard Configurations: U.S. Government Initiatives

August 7, 2007 • Podcast

By Julia H. Allen , Clint Kreitner (The Center for Internet Security)

In this podcast, participants explain that since you can't secure everything, , managing security risk to a "commercially reasonable degree" is best.
LISTEN
2007-8-7

Best Practices
Real-World Security for Business Leaders

July 24, 2007 • Podcast

By Pamela Fusco (FishNet Security) , Bill Pollak , Mike Petock

In this podcast, William Wilson advises business leaders to use international standards to create a business- and risk-based information security program.
LISTEN
2007-7-24

Governance
Using Standards to Build an Information Security Program

July 10, 2007 • Podcast

By Julia H. Allen , William R. Wilson

In this podcast, William Wilson explains how business leaders can use international standards to create a business- and risk-based information security program.
LISTEN
2007-7-10

Governance
Getting Real About Security Governance

June 26, 2007 • Podcast

By Julia H. Allen , Stephanie Losi

In this podcast, participants explain that enterprise security governance can be achieved by implementing a defined, repeatable process.
LISTEN
2007-6-26

Governance
Convergence: Integrating Physical and IT Security

June 12, 2007 • Podcast

By Julia H. Allen , Brian Contos (ArcSight) , Bill Crowell (No Affiliation)

In this podcast, participants recommend deploying common solutions for physical and IT security as a cost-effective way to reduce risk and save money.
LISTEN
2007-6-12

Best Practices
IT Infrastructure: Tips for Navigating Tough Spots

May 29, 2007 • Podcast

By Steve Huth , Stephanie Losi , Steve Kalinowski

In this podcast, participants discuss how organizations may occasionally need to redefine their IT infrastructures and be ready to handle tricky situations.
LISTEN
2007-5-29

Best Practices
The Value of De-Identified Personal Data

May 15, 2007 • Podcast

By Scott Ganow (Verispan) , Mike Hubbard (Womble Carlyle Sandridge & Rice, PLLC) , Stephanie Losi

In this podcast, participants discuss the complex legal compliance landscape and how de-identification can help organizations share data more securely.
LISTEN
2007-5-15
Adapting to Changing Risk Environments: Operational Resilience

May 1, 2007 • Podcast

By Stephanie Losi , Richard A. Caralli

In this podcast, participants discuss how businesses leaders need to keep their critical processes and services up and running in the face of the unexpected.
LISTEN
2007-5-1

Cyber Risk and Resilience Management
Computer Forensics for Business Leaders: A Primer

April 17, 2007 • Podcast

By Richard Nolan , Stephanie Losi

In this podcast, participants discuss how computer forensics is often overlooked when planning an incident response strategy.
LISTEN
2007-4-17

Digital Intelligence and Investigation
The Real Secrets of Incident Management

April 3, 2007 • Podcast

By Georgia Killcrece , Stephanie Losi , Robin Ruefle

In this podcast, participants explain that incident management is not just technical response, but a cross-enterprise effort.
LISTEN
2007-4-3

Incident Management
The Legal Side of Global Security

March 20, 2007 • Podcast

By Stephanie Losi , Jody R. Westby

In this podcast, participants encourage business leaders, including legal counsel, to understand how to tackle complex security issues for a global enterprise.
LISTEN
2007-3-20

Governance
A New Look at the Business of IT Education

March 6, 2007 • Podcast

By Stephanie Losi , Larry Rogers

System administrators increasingly need business savvy in addition to technical skills, and IT training courses must try to keep pace with this trend.
LISTEN
2007-3-6

Cyber Workforce Development
Crisis Communications During a Security Incident

February 20, 2007 • Podcast

By Stephanie Losi , Kelly Kimberland

In this podcast, participants alert business leaders to be prepared to communicate with the media and their staff during high-profile security incidents.
LISTEN
2007-2-20

Incident Management
Assuring Mission Success in Complex Environments

February 6, 2007 • Podcast

By Julia H. Allen , Christopher J. Alberts

In this podcast, participants discuss analysis tools for assessing complex organizational and technological issues that are beyond traditional approaches.
LISTEN
2007-2-6

Cyber Risk and Resilience Management, OCTAVE, Enterprise Risk and Resilience Management
Privacy: The Slow Tipping Point

January 23, 2007 • Podcast

By Stephanie Losi , Alessandro Acquisiti (Carnegie Mellon University)

In this podcast, participants discuss a trend toward more data disclosure that may cause users to become desensitized to privacy breaches.
LISTEN
2007-1-23

Cyber Risk and Resilience Management
Building Staff Competence in Security

January 9, 2007 • Podcast

By Julia H. Allen , Barbara Laswell

In this podcast, Barbara Laswell describes specifications that define the knowledge, skills, and competencies required for a range of security positions.
LISTEN
2007-1-9

Cyber Workforce Development
Evolving Business Models, Threats, and Technologies: A Conversation with CERT's Deputy Director for Technology

December 26, 2006 • Podcast

By Thomas A. Longstaff , Julia H. Allen

In this podcast, participants discuss how business models are evolving as security threats become more covert and technology enables information migration.
LISTEN
2006-12-26

Best Practices
Inside Defense-in-Depth

December 19, 2006 • Podcast

By Stephanie Losi , Kristopher Rush

In this podcast, participants discuss defense-in-depth, a path toward enterprise resilience.
LISTEN
2006-12-19

Best Practices
Protecting Against Insider Threat

November 28, 2006 • Podcast

By Julia H. Allen , Dawn Cappelli

In this podcast, Dawn Cappelli describes the real and substantial threat of attack from insiders.
LISTEN
2006-11-28

Insider Threat
Change Management: The Security 'X' Factor

November 14, 2006 • Podcast

By Stephanie Losi , Gene Kim (IP Services and ITPI)

In this podcast, Gene Kim reports how a recent security survey found one factor that separated high performers from the rest of the pack: change management.
LISTEN
2006-11-14

Best Practices
CERT Lessons Learned: A Conversation with Rich Pethia, Director of CERT

October 31, 2006 • Podcast

By Julia H. Allen , Richard D. Pethia

In this podcast, Richard Pethia voices his view of the internet security landscape and the future of the CERT Division.
LISTEN
2006-10-31

Best Practices
The ROI of Security

October 17, 2006 • Podcast

By Julia H. Allen , Stephanie Losi

In this podcast, Julia Allen explains how ROI is a useful tool because it enables comparison among investments in a consistent way.
LISTEN
2006-10-17

Measurement and Analysis
Compliance vs. Buy-in

October 17, 2006 • Podcast

By Julia H. Allen , Stephanie Losi

In this podcast, Julia Allen explains why integrating security into standard business processes is more effective than treating security as a compliance task.
LISTEN
2006-10-17

Governance
Why Leaders Should Care About Security

October 17, 2006 • Podcast

By Julia H. Allen , Mike Petock

In this podcast, Julia Allen urges leaders to be security conscious and treat adequate security as a non-negotiable requirement of being in business.
LISTEN
2006-10-17

Governance
Proactive Remedies for Rising Threats

October 17, 2006 • Podcast

By Stephanie Losi , Martin Linder , Julia H. Allen

In this podcast, participants discuss how threats to information security are increasingly stealthy and must be mitigated through sound policy and strategy.
LISTEN
2006-10-17

Insider Threat

Software Engineering Institute

Podcasts

Subscribe

Filter by

Developing and Using a Software Bill of Materials Framework

April 9, 2024 • Podcast

By Michael S. Bandor , Carol Woody

The Importance of Diversity in Cybersecurity: Carol Ware

March 21, 2024 • Podcast

By Carol Ware

The Importance of Diversity in Artificial Intelligence: Violet Turri

March 19, 2024 • Podcast

By Violet Turri

Using Large Language Models in the National Security Realm

March 5, 2024 • Podcast

By Shannon Gallagher

Atypical Applications of Agile and DevSecOps Principles

February 16, 2024 • Podcast

By Lyndsi A. Hughes , David Sweeney

When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction

February 9, 2024 • Podcast

By Stephen Wilson , Patrick R. Place

The Impact of Architecture on the Safety of Cyber-Physical Systems

January 31, 2024 • Podcast

By Jerome Hugues

ChatGPT and the Evolution of Large Language Models: 4 Case Studies

December 14, 2023 • Podcast

By Matthew Walsh , Dominic A. Ross

The Cybersecurity of Quantum Computing: 6 Areas of Research

December 4, 2023 • Podcast

By Tom Scanlon

User-Centric Metrics for Agile

November 21, 2023 • Podcast

By Patrick R. Place , Will Hayes

The Product Manager’s Evolving Role in Software and Systems Development

November 14, 2023 • Podcast

By Judy Hwang

Measuring the Trustworthiness of AI Systems

October 16, 2023 • Podcast

By Carol J. Smith , Katherine-Marie Robinson , Alexandrea Steiner

Actionable Data in the DevSecOps Pipeline

September 27, 2023 • Podcast

By Bill Nichols , Julie B. Cohen

Insider Risk Management in the Post-Pandemic Workplace

September 7, 2023 • Podcast

By Daniel L. Costa , Randall F. Trzeciak

An Agile Approach to Independent Verification and Validation

August 15, 2023 • Podcast

By Justin Smith

Zero Trust Architecture: Best Practices Observed in Industry

July 27, 2023 • Podcast

By Matthew Nicolai , Nathaniel Richmond

Automating Infrastructure as Code with Ansible and Molecule

July 11, 2023 • Podcast

By Matthew Heckathorn

Identifying and Preventing the Next SolarWinds

June 27, 2023 • Podcast

By Greg Touhill

A Penetration Testing Findings Repository

June 22, 2023 • Podcast

By Samantha Chaves , Marisa Midler

Understanding Vulnerability Analysis in the Rust Programming Language

June 6, 2023 • Podcast

By Garret Wassermann , David Svoboda

We Live in Software: Engineering Societal-Scale Systems

May 25, 2023 • Podcast

By John E. Robert , Forrest Shull

Secure by Design, Secure by Default

May 11, 2023 • Podcast

By Greg Touhill

Key Steps to Integrate Secure by Design into Acquisition and Development

May 4, 2023 • Podcast

By Robert Schiela , Carol Woody

An Exploration of Enterprise Technical Debt

April 18, 2023 • Podcast

By Stephany Bellomo

The Messy Middle of Large Language Models

April 4, 2023 • Podcast

By Jay Palat , Rachel Dzombak

An Infrastructure-Focused Framework for Adopting DevSecOps