Presidential Advisers Recommend Agencies Invest in Automating Software Assurance

Government entities should pursue artificial intelligence and machine learning to screen software for security vulnerabilities, according to key representatives from the information and communications technology industry.

“The Government should invest in research and development (R&D) for the software assurance field to keep up with advances in computing architectures,” reads a draft report set for a vote Tuesday by the president’s National Security Telecommunications Advisory Committee. Their meeting will include participation from National Cyber Director Chris Inglis, Cybersecurity and Infrastructure Security Agency Director Jen Easterly and National Security Council Cybersecurity Policy Chief Jefferey Greene.

The draft report was prepared by a subcommittee the NSTAC formed on software security in May that consists mainly of representatives from major software and networking companies and government contractors. The report incorporates input from subject matter experts from additional companies including the IT management firm SolarWinds, where a successful attack at the end of last year shook up the national debate on cybersecurity policy.

The report treads a lot of familiar ground with language echoing a May executive order that was largely in response to the SolarWinds attack. It speaks in high-level terms about procurement officials encouraging vendors to follow security best practices and preferencing those who do. But it also recommends the use of flexible standards and the creation of yet another public-private group to explore incentives for developers to use appropriate security practices.  

“The President should establish a task force charged with defining a public-private initiative focusing on key areas of software assurance and the software supply chain,” the report reads. “Like the earlier public-private effort on the [National Institute for Standards and Technology] Cybersecurity Framework (CSF), such an initiative can address fundamental misalignment of incentives, diversity of the assurance approaches, and complexity of the software supply chain. An effort of this nature can translate the urgent need for action into an implementable framework.”

The report also calls for an industry-heavy group at the Department of Homeland Security, which includes representation from many of the same companies, to participate in agencies’ application of guidelines tailored to particular sectors under the executive order.

“Government-private sector collaboration will be important to extend progress,” the draft report reads. “For example, the existing DHS ICT Supply Chain Risk Management (SCRM) Task Force gathers security expertise from the information technology (IT) and communications sectors, as well as government agencies, thus offering one avenue to address any new sector-specific implementation guidelines for the implementation of EO 14028.”

On the research and development front, the report specifically mentions an effort at the Defense Advanced Research Projects Agency.

“Manual compliance checks for software vulnerabilities are inefficient, error-prone, and not scalable,” the subcommittee wrote. “Automated tools, on the other hand, review a greater number of security metrics using less resource-intensive processes, with more consistent results, and ultimately, at a larger scale. ‘Big Code’ analytics processes, such as those under review by the Defense Advanced Research Projects Agency (DARPA), could result in automated tools that not only evaluate software assurance but also use capabilities such as probabilistic modeling to quantify the degree of confidence in evaluation.”

The comprehensive report also calls for the government to focus on identifying and supporting security for the open source code libraries most often used in the creation of “critical software,” as defined by NIST under the executive order.