Designing Enterprise Platforms: Hosted by Dan Woods, analyst at Early Adopter Research and contributor to leading tech publications, this podcast focuses how to create product-based platforms that can have a transformational impact. The goal is to understand how to combine and integrate products rather than build from scratch. All aspects of platform building are covered from technology, to change management, to integration strategies.
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Software Engineering Institute (SEI) Podcast Series
Members of Technical Staff at the Software Engineering Institute
The SEI Podcast Series presents conversations in software engineering, cybersecurity, and future technologies.
…
continue reading
![Artwork](/static/images/128pixel.png)
1
3 API Security Risks (and How to Protect Against Them)
19:28
19:28
Play later
Play later
Lists
Like
Liked
19:28
The exposed and public nature of application programming interfaces (APIs) come with risks including the increased network attack surface. Zero trust principles are helpful for mitigating these risks and making APIs more secure. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), McKinley Sconiers-Hasan, a solu…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Evaluating Large Language Models for Cybersecurity Tasks: Challenges and Best Practices
43:05
43:05
Play later
Play later
Lists
Like
Liked
43:05
How can we effectively use large language models (LLMs) for cybersecurity tasks? In this Carnegie Mellon University Software Engineering Institute podcast, Jeff Gennari and Sam Perl discuss applications for LLMs in cybersecurity, potential challenges, and recommendations for evaluating LLMs.
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Capability-based Planning for Early-Stage Software Development
33:55
33:55
Play later
Play later
Lists
Like
Liked
33:55
Capability-Based Planning (CBP) defines a framework that has an all-encompassing view of existing abilities and future needs for strategically deciding what is needed and how to effectively achieve it. Both business and government acquisition domains use CBP for financial success or to design a well-balanced defense system. The definitions understa…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Safeguarding Against Recent Vulnerabilities Related to Rust
26:25
26:25
Play later
Play later
Lists
Like
Liked
26:25
What can the recently discovered vulnerabilities related to Rust tell us about the security of the language? In this podcast from the Carnegie Mellon University Software Engineering Institute, David Svoboda discusses two vulnerabilities, their sources, and how to mitigate them.
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Developing a Global Network of Computer Security Incident Response Teams (CSIRTs)
30:51
30:51
Play later
Play later
Lists
Like
Liked
30:51
Cybersecurity risks aren’t just a national concern. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), the CERT division’s Tracy Bills, senior cybersecurity operations researcher and team lead, and James Lord, security operations technical manager, discuss the SEI’s work developing Computer Security Incident R…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Automated Repair of Static Analysis Alerts
27:05
27:05
Play later
Play later
Lists
Like
Liked
27:05
Developers know that static analysis helps make code more secure. However, static analysis tools often produce a large number of false positives, hindering their usefulness. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), David Svoboda, a software security engineer in the SEI’s CERT Division, discusses Rede…
…
continue reading
Not all paths to cybersecurity careers look the same. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Randy Trzeciak, deputy director of cyber risk and resilience in the SEI’s CERT division, discusses his career journey, resources for pursuing a career in cybersecurity, and the importance of building a dive…
…
continue reading
Sam Procter started out studying computer science at the University of Nebraska, but he didn’t love it. It wasn’t until he took his first software engineering course that he knew he’d found his career path. In this podcast from the Carnegie Mellon University Software Engineering Institute, Sam Procter discusses the early influences that shaped his …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Developing and Using a Software Bill of Materials Framework
37:37
37:37
Play later
Play later
Lists
Like
Liked
37:37
With the increasing complexity of software systems, the use of third-party components has become a widespread practice. Cyber disruptions, such as SolarWinds and Log4j, demonstrate the harm that can occur when organizations fail to manage third-party components in their software systems. In this podcast from the Carnegie Mellon University Software …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Importance of Diversity in Cybersecurity: Carol Ware
26:37
26:37
Play later
Play later
Lists
Like
Liked
26:37
In this podcast from the Carnegie Mellon University Software Engineering Institute, Carol Ware, a senior cybersecurity engineer in the SEI’s CERT Division, discusses her career path, the value of mentorship, and the importance of diversity in cybersecurity.By Carol Ware
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Importance of Diversity in Software Engineering: Suzanne Miller
29:02
29:02
Play later
Play later
Lists
Like
Liked
29:02
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Suzanne Miller, a principal researcher in the SEI’s Software Solutions Division, discusses her career path, the value of mentorship, and the importance of diversity in software engineering.By Suzanne Miller
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Importance of Diversity in Artificial Intelligence: Violet Turri
16:57
16:57
Play later
Play later
Lists
Like
Liked
16:57
Across the globe, women account for less than 30 percent of professionals in technical fields. That number drops to 22 percent in the field of Artificial Intelligence (AI). In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Violet Turri, a software developer in the SEI’s AI Division, discusses the evolution of…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Using Large Language Models in the National Security Realm
34:45
34:45
Play later
Play later
Lists
Like
Liked
34:45
At the request of the White House, the Office of the Director of National Intelligence (ODNI) began exploring use cases for large language models (LLMs) within the Intelligence Community (IC). As part of this effort, ODNI sponsored the Mayflower Project at Carnegie Mellon University’s Software Engineering Institute (SEI) from May 2023 through Septe…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Atypical Applications of Agile and DevSecOps Principles
33:41
33:41
Play later
Play later
Lists
Like
Liked
33:41
Modern software engineering practices of Agile and DevSecOps have provided a foundation for producing working software products faster and more reliably than ever before. Far too often, however, these practices do not address the non-software concerns of business mission and capability delivery even though these concerns are critical to the success…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction
35:21
35:21
Play later
Play later
Lists
Like
Liked
35:21
Increasingly in government acquisition of software-intensive systems, we are seeing programs using Agile development methodology and earned value management. While there are many benefits to using both Agile and EVM, there are important considerations that software program managers must first address. In this podcast, Patrick Place, a senior engine…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Impact of Architecture on Cyber-Physical Systems Safety
34:05
34:05
Play later
Play later
Lists
Like
Liked
34:05
As developers continue to build greater autonomy into cyber-physical systems (CPSs), such as unmanned aerial vehicles (UAVs) and automobiles, these systems aggregate data from an increasing number of sensors. However, more sensors not only create more data and more precise data, but they require a complex architecture to correctly transfer and proc…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
ChatGPT and the Evolution of Large Language Models: A Deep Dive into 4 Transformative Case Studies
46:22
46:22
Play later
Play later
Lists
Like
Liked
46:22
To better understand the potential uses of large language models (LLMs) and their impact, a team of researchers at the Carnegie Mellon University Software Engineering Institute CERT Division conducted four in-depth case studies. The case studies span multiple domains and call for vastly different capabilities. In this podcast, Matthew Walsh, a seni…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Cybersecurity of Quantum Computing: 6 Areas of Research
23:01
23:01
Play later
Play later
Lists
Like
Liked
23:01
Research and development of quantum computers continues to grow at a rapid pace. The U.S. government alone spent more than $800 million on quantum information science research in 2022. Thomas Scanlon, who leads the data science group in the SEI CERT Division, was recently invited to be a participant in the Workshop on Cybersecurity of Quantum Compu…
…
continue reading
Far too often software programs continue to collect metrics for no other reason than that is how it has always been done. This leads to situations where, for any given environment, a metrics program is defined by a list of metrics that must be collected. A top-down, deterministic specification of graphs or other depictions of data required by the m…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Product Manager’s Evolving Role in Software and Systems Development
24:19
24:19
Play later
Play later
Lists
Like
Liked
24:19
In working with software and systems teams developing technical products, Judy Hwang, a senior software engineer in the SEI CERT Division, observed that teams were not investing the time, resources and effort required to manage the product lifecycle of a successful product. These activities include thoroughly exploring the problem space by talking …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Measuring the Trustworthiness of AI Systems
19:27
19:27
Play later
Play later
Lists
Like
Liked
19:27
The ability of artificial intelligence (AI) to partner with the software engineer, doctor, or warfighter depends on whether these end users trust the AI system to partner effectively with them and deliver the outcome promised. To build appropriate levels of trust, expectations must be managed for what AI can realistically deliver. In this podcast f…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Actionable Data in the DevSecOps Pipeline
31:58
31:58
Play later
Play later
Lists
Like
Liked
31:58
In this podcast from the Carnegie Mellon University Software Engineering Institute, Bill Nichols and Julie Cohen talk with Suzanne Miller about how automation within DevSecOps product-development pipelines provides new opportunities for program managers (PMs) to confidently make decisions with the help of readily available data. As in commercial co…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Insider Risk Management in the Post-Pandemic Workplace
47:34
47:34
Play later
Play later
Lists
Like
Liked
47:34
In the wake of the COVID pandemic, the workforce decentralized and shifted toward remote and hybrid environments. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dan Costa, technical manager of enterprise threat and vulnerability management, and Randy Trzeciak, deputy director of Cyber Risk and Resilience, …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
An Agile Approach to Independent Verification and Validation
31:57
31:57
Play later
Play later
Lists
Like
Liked
31:57
Independent verification and validation (IV&V) is a significant step in the process of deploying systems for mission-critical applications in the Department of Defense (DoD). In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Justin Smith, senior Agile transformation leader in the SEI Software Solutions Divisi…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Zero Trust Architecture: Best Practices Observed in Industry
27:53
27:53
Play later
Play later
Lists
Like
Liked
27:53
Zero trust architecture has the potential to improve an enterprise’s security posture. There is still considerable uncertainty about the zero trust transformation process, however, as well as how zero trust architecture will ultimately appear in practice. Recent executive orders have accelerated the timeline for zero trust adoption in the federal s…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Automating Infrastructure as Code with Ansible and Molecule
39:38
39:38
Play later
Play later
Lists
Like
Liked
39:38
In Ansible, roles allow system administrators to automate the loading of certain variables, tasks, files, templates, and handlers based on a known file structure. Grouping content by roles allows for easy sharing and reuse. When developing roles, users must deal with various concerns, including what operating system(s) and version(s) will be suppor…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Identifying and Preventing the Next SolarWinds
46:04
46:04
Play later
Play later
Lists
Like
Liked
46:04
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Gregory J. Touhill, director of the SEI CERT Division, talks with principal researcher Suzanne Miller about the 2020 attack on Solar Winds software and how to prevent a recurrence of another major attack on key systems that are in widespread use. Solar Winds i…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A Penetration Testing Findings Repository
25:47
25:47
Play later
Play later
Lists
Like
Liked
25:47
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI) Marisa Midler and Samantha Chaves, penetration testers with the SEI’s CERT Division, talk with Suzanne Miller about a penetration-testing repository that they helped to build. The repository is a source of information for active directory, phishing, mobile tech…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Understanding Vulnerabilities in the Rust Programming Language
36:45
36:45
Play later
Play later
Lists
Like
Liked
36:45
While the memory safety and security features of the Rust programming language can be effective in many situations, Rust’s compiler is very particular on what constitutes good software design practices. Whenever design assumptions disagree with real-world data and assumptions, there is the possibility of security vulnerabilities–and malicious softw…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
We Live in Software: Engineering Societal-Scale Systems
39:31
39:31
Play later
Play later
Lists
Like
Liked
39:31
Societal-scale software systems, such as today’s commercial social media platforms, are among the most widely used software systems in the world, with some platforms reporting billions of daily active users. These systems have created new mechanisms for global communication and connect people with unprecedented speed. Despite the numerous benefits …
…
continue reading
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI) Gregory J. Touhill, director of the SEI CERT Division, talks with Suzanne Miller about secure by design, secure by default, a longstanding tenet of the work of the SEI and CERT in particular. The SEI has been in the forefront of secure software development, pro…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Key Steps to Integrate Secure by Design into Acquisition and Development
48:50
48:50
Play later
Play later
Lists
Like
Liked
48:50
Secure by design means performing more security and assurance activities earlier in the product and system lifecycles. A secure-by-design mindset addresses the security of systems during the requirements, design, and development phases of lifecycles rather than waiting until the system is ready for implementation. The need for a secure-by-design mi…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
An Exploration of Enterprise Technical Debt
25:56
25:56
Play later
Play later
Lists
Like
Liked
25:56
Like all technical debt, enterprise technical debt consists of choices expedient in the short term, but often problematic over the long term. In enterprise technical debt, the impact reaches beyond the scope of a single system or project. Because ignoring enterprise technical debt can have significant consequences, software and systems architects s…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Messy Middle of Large Language Models
33:46
33:46
Play later
Play later
Lists
Like
Liked
33:46
The recent growth of applications that leverage large language models, including ChatGPT and Copilot, has spurred reactions ranging from fear and uncertainty to adoration and lofty expectations. In this podcast from the Carnegie Mellon University Software Engineering Institute, Jay Palat, senior engineer and technical director of AI for mission, an…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
An Infrastructure-Focused Framework for Adopting DevSecOps
43:35
43:35
Play later
Play later
Lists
Like
Liked
43:35
DevSecOps practices, including continuous-integration/continuous-delivery (CI/CD) pipelines, enable organizations to respond to security and reliability events quickly and efficiently and to produce resilient and secure software on a predictable schedule and budget. Despite growing evidence and recognition of the efficacy and value of these practic…
…
continue reading
Rust is growing in popularity. Its unique security model promises memory safety and concurrency safety, while providing the performance of C/C++. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), David Svoboda and Joe Sible, both engineers in the SEI’s CERT Division, talk with principal researcher Suzanne Mil…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Improving Interoperability in Coordinated Vulnerability Disclosure with Vultron
51:16
51:16
Play later
Play later
Lists
Like
Liked
51:16
Coordinated vulnerability disclosure (CVD) begins when at least one individual becomes aware of a vulnerability, but it can’t proceed without the cooperation of many. Software supply chains, software libraries, and component vulnerabilities have evolved in complexity and have become as much a part of the CVD process as vulnerabilities in vendors’ p…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Asking the Right Questions to Coordinate Security in the Supply Chain
31:11
31:11
Play later
Play later
Lists
Like
Liked
31:11
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dr. Carol Woody, a principal researcher in the SEI's CERT Division, talks with Suzanne Miller about the SEI’s newly released Acquisition Security Framework, which helps programs coordinate the management of engineering and supply-chain risks across system comp…
…
continue reading
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Scott Hissam, a researcher within the SEI’s Software Solutions Division who works on software assurance in Department of Defense (DoD) systems, talks with Linda Parker Gates, initiative lead for the SEI’s Software Acquisition Pathways, about the use of free an…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A Model-Based Tool for Designing Safety-Critical Systems
48:43
48:43
Play later
Play later
Lists
Like
Liked
48:43
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dr. Sam Procter and Lutz Wrage, researchers with the SEI, discuss the Guided Architecture Trade Space Explorer (GATSE), a new SEI-developed model-based tool to help with the design of safety-critical systems. The GATSE tool allows engineers to evaluate more de…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Managing Developer Velocity and System Security with DevSecOps
32:55
32:55
Play later
Play later
Lists
Like
Liked
32:55
In aiming for correctness and security of product, as well as for development speed, software development teams often face tension in their objectives. During a recent customer engagement that involved the development of a continuous-integration (CI) pipeline, developers wanted to develop features and deploy to production, deferring non-critical bu…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A Method for Assessing Cloud Adoption Risks
21:47
21:47
Play later
Play later
Lists
Like
Liked
21:47
The shift to a cloud environment provides significant benefits. Cloud resources can be scaled quickly, updated frequently, and widely accessed without geographic limitations. Realizing these benefits, however, requires organizations to manage associated organizational and technical risks. In this podcast from the Carnegie Mellon University Software…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Software Architecture Patterns for Deployability
29:09
29:09
Play later
Play later
Lists
Like
Liked
29:09
Competitive pressures in many domains, as well as development paradigms such as Agile and DevSecOps, have led to the increasingly common practice of continuous delivery or continuous deployment where frequent updates to software systems are rapidly and reliably fielded. In today’s systems, releases can occur at any time—possibly hundreds of release…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
ML-Driven Decision Making in Realistic Cyber Exercises
48:58
48:58
Play later
Play later
Lists
Like
Liked
48:58
In this podcast from the Carnegie Mellon University Software Engineering Institute, Thomas Podnar and Dustin Updyke, both senior cybersecurity engineers with the SEI’s CERT Division, discuss their work to apply machine learning to increase the realism of non-player characters (NPCs) in cyber training exercises.…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A Roadmap for Creating and Using Virtual Prototyping Software
56:30
56:30
Play later
Play later
Lists
Like
Liked
56:30
In this podcast from the Carnegie Mellon University Software Engineering Institute, Douglass Post and Richard Kendall, authors of "Creating and Using Virtual Prototyping Software: Principles and Practices" discuss with principal researcher Suzanne Miller experiences and insights that they gleaned from applying virtual prototyping in CREATE (Computa…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Software Architecture Patterns for Robustness
31:13
31:13
Play later
Play later
Lists
Like
Liked
31:13
In this podcast from the Carnegie Mellon University Software Engineering Institute, visiting scientist Rick Kazman and principal researcher Suzanne Miller discuss software architecture patterns and the effect that certain architectural patterns have on quality attributes, such as availability and robustness. Kazman also provides examples of mechani…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A Platform-Independent Model for DevSecOps
23:41
23:41
Play later
Play later
Lists
Like
Liked
23:41
DevSecOps encompasses all the best software engineering principles known today with an emphasis on faster delivery through increased collaboration of all stakeholders resulting in more secure, useable, and higher-quality software systems. In this podcast from the Carnegie Mellon University Software Engineering Institute, researchers Tim Chick and J…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Using the Quantum Approximate Optimization Algorithm (QAOA) to Solve Binary-Variable Optimization Problems
27:36
27:36
Play later
Play later
Lists
Like
Liked
27:36
In this podcast from the Carnegie Mellon University Software Engineering Institute, Jason Larkin and Daniel Justice, researchers in the SEI’s AI Division, discuss a paper outlining their efforts to simulate the performance of Quantum Approximate Optimization Algorithm (QAOA) for the Max-Cut problem and compare it with some of the best classical alt…
…
continue reading
To ensure trust, artificial intelligence systems need to be built with fairness, accountability, and transparency at each step of the development cycle. In this podcast from the Carnegie Mellon University Software Engineering Institute, Carol Smith, a senior research scientist in human machine interaction, and Dustin Updyke, a senior cybersecurity …
…
continue reading
In this podcast from the Carnegie Mellon University Software Engineering Institute, Shannon Gallagher, a data scientist with SEI’s CERT Division, and Dominic Ross, multimedia team lead for the SEI, discuss deepfakes, their exponential growth in recent years, their increasing technical sophistication, and the problems they pose for individuals and o…
…
continue reading