|
Software Assurance Findings Expression Schema (SAFES) Overview
January 2012
Sean Barnum, The MITRE Corporation
ABSTRACT
The Software Assurance Findings Expression Schema (SAFES) is a unified schema that will support the
full range of software assurance activities in a consistent and automatable fashion by providing a
common mechanism (structure and content) for all tools, analysis services and analysis practices in the
software assurance field to report, integrate and analyze findings in a consistent fashion. Such a unified
schema is a foundational requirement for effectively leveraging multi-perspective and multi-tool
software assurance analysis approaches and methodologies which is a current priority focus of many
government and commercial organizations. A unified schema will enable and encourage greater
consistency in findings, will establish more structured tool results that are more useful to users, will
enable integration of results from multiple tools/services and will enable automated processing of
tool/service results. This is a collaborative community effort with MITRE providing primary technical
leadership, but with the involvement and contributions of an assortment of software assurance tool and
service vendors and software assurance practitioners willing to participate and other interested
members of the software assurance community. This schema was developed from an attempt to
successfully analyze, integrate and capture the current state of the practice, current state of the art as
well as new thinking beyond the current state of the art in the field of software assurance findings. The
primary artifact for this effort is an XML-based schema that not only provides a common communication
mechanism for findings but does so in a structured fashion that enables greater flexibility in its
application and its future growth and enhancement. SAFES is currently sponsored by the NSA Center for
Assured Software (CAS) (with forthcoming additional support from the DHS Software Assurance
Program), with MITRE leading all technical development.
Additional Search Keywords
n/a
|
