Tagging Your Code with a Useful Assurance Label
summary
Claims that a concise label can say which assurance activities were done, when in the lifecycle, and which CWEs those activities actually cover. It maps weaknesses to CWE impact scorecard entries and to assessment methods so code reviews, static and dynamic analysis, or pen tests are matched to findable flaws. The deliverable is an Assurance Tag for Binaries encoded with Software ID tags, optionally signed (Tag Vault), with a DOD-derived table backing the mappings.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:04Characteristics of the Advanced Persistent Threat
- 16:28Technical Impacts- Common Consequences
- 17:37Scoring Weaknesses Based on Context
- 20:26Technical Impact Scorecard
- 22:38Leveraging and Managing to take Advantage of the Multiple Perspectives of Analysis
related talks
05mA Maintainer’s Tour Of Tag Security And Compliance
07mA Security Engineer’s Guide to TAG Security
28mA Project Maintainers Guide To TAG Security
17mKeynote: TAG Security, You're It!
30mThe Immediate and Lasting Benefits of TAG Security Assessments
19mMeasure and Improve Software Supply Chain Assurance with OWASP SCVS
31mConstructive Assurance Cases for Cybersecurity
32mStaring Into the Abyss with the Security Technical Advisory Group