www.fcw.com/fcw/articles/2004/1011/web-manh-10-15-04.asp
The National Security Agency's top information security official disclose d plans this week for a government-funded research center devoted to imp roving the security of commercial software, calling the initiative a mod ern-day Manhattan Project. Comparing the proposed high-assurance software initiative to the famous a tomic bomb research project of the 1940s, NSA's director for information assurance, Daniel Wolf, said the research would focus on tools and tech niques for writing secure software and detecting malicious code hidden i n software. Before NSA officials can create the center, the Defense secretary must ap prove the concept and find money for the project, Wolf said. The quality and trustworthiness of commerci al software has become a matter of increasing concern to NSA officials, who are responsible for the security of Defense Department and intellige nce software. NSA officials anticipate that many companies on whose soft ware DOD and intelligence users rely will be moving significant portions of their commercial software development overseas within a few years. NSA officials cannot force companies to develop software a certain way, W olf said, "but we would like to get them to a point where they are produ cing commercial products that meet the needs of our users." About 95 per cent of the agency's desktop PCs run Microsoft's Windows operating syste m, Wolf said. The high-assurance software center would have a small staff of researcher s who would work with other researchers at NSA, the Defense Advanced Res earch Projects Agency, the Homeland Security Department, the National In stitute of Standards and Technology, federally funded research centers, academic institutions, and corporations. "We talk about something like a Manhattan Project because of the magnitude of what we're trying to do," Wolf said. Creating commercial software of high quality and trustworthiness is immen sely difficult using existing tools and techniques, he said. "You want s oftware that does all the things that it is supposed to do and nothing m ore," he said. It is especially difficult to know whether commercial sof tware contains hidden malicious code. Current detection tools produce to o many false positives, he said. As an agency, NSA has 50 years' experience with writing cryptographic cod e, Wolf said. "What we bring to the table is the ability to analyze soft ware and find vulnerabilities," he said.
|
http://csua.com/feed/