Subject to copyright

Tools and techniques are emerging that allow us to directly evaluate software artifacts to gain assurance that they are free of exploitable vulnerabilities. This is complementary to the current capability to assess the process used to build the software and the ability to assess the specification and design of security-relevant features (encryption, authentication, etc.). The current ad-hoc use of these direct evaluation tools and techniques results in critical gaps in coverage and inefficiencies. In this paper, we explore an approach to using these tools in a more structured way that aligns with the desire to document an "assurance case" for a particular piece of software. The approach starts with having the user specify a list of narrowly defined attributes to assure. This list will generally be a subset of standard dictionaries like Mitre's Common Weakness Enumeration (CWE) (Mitre) or CERT's Secure Coding Standards (CERT) but may also include attributes for a particular purpose/product/organization. The user can decide upon the initial list based upon risk and then evolve the list over the life of the product. The user will then choose a regime of tools and techniques to "positively assure " each of the attributes enumerated in the chosen set. The output of using those tools and techniques is all gathered into a measurement information system so it is available as evidence for the assurance case. This paper (1) defines "positive assurance", (2) gives more detail on this proposed approach, (3) discusses some of the issues that we expect to arise, and (4) explores the use of this approach with an example from the CWE and CERT'