Project Sponsor: Space and Naval Warfare (SPAWAR) Systems Center, Charleston, South Carolina, Department of Navy

Project Team Members:
Faculty: Dr. Seok-Won Lee (PI), Dr. Gail-Joon Ahn and Dr. Bill Chu
Students: Robin Gandhi (PhD),  Siddharth Wagle (MS) and Ajeet Murty (MS)
Past Members: Deepak Yavagal (MS), Divya Muthurajan (MS), Swapnil Brahmankar (MS), Vikram Parekh (MS), Raghuram Gururajan (MS) and Jayasri Vaidyanath (MS)

Period: July, 2004 - Feb. 2006

Project Description:

DITSCAP (The DoD Information Technology Security Certification and Accreditation Process, DoD Directive 5200.40) is the standard C&A (Certification and Accreditation) Process for the Department of Defense. The DITSCAP establishes a standard process, set of activities, general tasks, and a management structure to certify and accredit information system (IS) that will maintain the information assurance (IA) and security posture of the Defense Information Infrastructure (DII). This process supports an infrastructure-centric approach, with a focus on the mission, environment, and architecture. For a system in development, the intent is to identify appropriate security requirements, design to meet those requirements, test the design against the same requirements, and then monitor the accredited system for changes or reaccredidation as necessary.

In this project, we identify the missing components and limitations in the current DITSCAP practice such as:

1.Long and exhaustive process of self-checks and documentation;
2.Requiring extensive resources to conduct, manage, and maintain; and
3.Lack of an organized methodology to gather and analyze the necessary information, and investigate how to improve the entire DITSCAP practice through an automated system support.

To address these issues and enhance the effectiveness of DITSCAP, our design principles, modeling techniques and supporting theoretical foundations lead to the conceptualization and design of the DITSCAP-Automation Tool (DITSCAP-AT). DITSCAP-AT aggregates and analyzes C&A related information from various sources, using a uniform representation scheme and transforms static record keeping repositories into active ones that link to each other from different perspectives, allowing for their reuse and evolution through all the stages of the system lifecycle. DITSCAP-AT leverages the expressiveness of object oriented ontologies as its primary modeling method for information representation and analysis that provides active assistance in performing analysis to discover possible missing, conflicting, inconsistent, incomplete or overlapping information.
 

Selected Documents/Publications:

Gandhi, R. A., Siddharth, W., and Lee, S.W., "Process Artifacts Defined as an Aspectual Service to System Models" In Proceedings of the 2nd International Workshop on Service-Oriented Computing: Consequences for Engineering Requirements (SOCCER'06), 14th International Requirements Engineering Conference (RE'06), September 11-15, 2006 Minneapolis/St. Paul, Minnesota, USA.

Lee, S.W, Gandhi, R. A, Muthurajan, D., Yavagal, D.S., and Ahn, G, "Building problem domain ontology from security requirements in regulatory documents," In Proceedings of the 2006 international Workshop on Software Engineering For Secure Systems (Shanghai, China, May 20 - 21, 2006). SESS '06. ACM Press, New York, NY, pp.43-50
http://doi.acm.org/10.1145/1137627.1137635 

Lee, S. W., Gandhi, R. A., and Ahn, G., “Certification Process Artifacts Defined as Measurable Units for Software-intensive Systems Lifecycle” To Appear in the International Journal on Software Process: Improvement and Practice, Wiley, July, 2006

Lee, S. W., Muthurajan, D., Gandhi, R. A., Yavagal, D., and Ahn, G., “Building Decision Support Problem Domain Ontology from Security Requirements to Engineer Software-intensive Systems” To Appear in the International Journal on Software Engineering and Knowledge Engineering, Vol (16) 5, October, 2006

Lee, S.W., Ahn, G., Gandhi, R.A., and Yavagal, D., "An Information Assurance Engineering Methodology for Critical Infrastructure Protection: The DITSCAP Automation Study", TR-NiSE-04-03, Technical Report, Software and Information Systems Department, UNC Charlotte, Nov. 2004.

Lee, S.W., Ahn, G. and Gandhi, R.A. “Engineering Information Assurance for Critical Infrastructures: The DITSCAP Automation Study.” In Proceedings of the Fifteenth Annual International Symposium of the International Council on Systems Engineering (INCOSE ‘05), Session1, Track2, Rochester, NY, July 10-15. 2005.

Lee, S.W., Gandhi, R., Ahn, G., “Establishing Trustworthiness in Services of the Critical Infrastructure through Certification and Accreditation”, ACM SIGSOFT Software Engineering Notes”, Vol. 30, Issue 4, July 2005. ACM Press, New York, NY.  (Also appeared in SESS workshop at ICSE ’05)

Lee, S. W., Gandhi, R. A., & Ahn, G, “Establishing Trustworthiness in Services of the Critical Infrastructure: Automating the DITSCAP”, In Proceedings of the Workshop on Software Engineering for Secure Systems (SESS05), The 27th International Conference on Software Engineering (ICSE 05), pp. 43-49, May 2005

Lee, S. W., Gandhi, R. A., and Ahn, G. and Yavagal, D., Active Automation of the DITSCAP, IEEE International Conference on Intelligence and Security Informatics (IEEE ISI-2005),.Atlanta, Georgia, May 19-20, 2005, Lecture Notes in Computer Science, Vol. 3495, pp. 479-485, Springer.

Lee, S. W., Gandhi, R. A., and Ahn, G., “Security Requirements Driven Risk Assessment for Critical Infrastructure Information Systems”, In Proceedings of the Symposium on Requirements Engineering for Information Security (SREIS 05), Requirements Engineering (RE ’05), Paris, France, August 2005.

Project Phases:

Phase 1: (06/24/2004 - 09/30/2004, Contract No. N65236-04-P-7779)

Activities: DITSCAP-AT Requirements analysis and definition; Identify the scope of the DITSCAP Automated Tool, Software and resource requirements, Software development plan and identify associated risks; Prototype Design; The design and demonstration of a conceptual DITSCAP-AT prototype

Phase 2: (12/8/2004 - 02/28/2005, Contract No. N65236-05-P-0597)

Activities: Creation of a Service Oriented Architecture for DITSCAP-AT; Goal-oriented elicitation of the DITSCAP-AT functional requirements, Creation of a Requirements template for the elicitation and representation of DITSCAP-oriented requirements; Methodology for Building a Requirements Repository; Creation of a vulnerability assessment taxonomy

Phase 3: (04/01/2005 - 08/15/2005, Contract No. N65236-05-P2418)

Activities: Requirements capture and categorization to support hierarchical representation of requirements and associated meta-knowledge; DITSCAP-oriented Risk and Vulnerability Assessment Taxonomy creation; Machine Learned Information Gathering (VASALite toolkit); Advanced risk calculation algorithms based on Multi-Dimensional Link Analysis

Phase 4: (08/15/2005 - 02/28/2006, Contract No. N65236-05-P-3672)

Activities: Creation of Tool Support to populate models produced in the previous phases; Development of DITSCAP-AT Process-Driven Workflow interfaces; DITSCAP-AT Business logic to support the Process-Driven Workflow; Utilities to support advanced risk calculation algorithms based on Multi-Dimensional Link Analysis; Integration of the Requirements Repository  and  the Machine Learned Information Gathering Module within the Process-Driven Workflow to demonstrate the DITSCAP-AT proof of concept