OMG Pushes for Gov’t Software Security Standards

A report released this month by a task force within the Object Management Group outlines a proposed set of standards for verifying the security and integrity of software that’s being acquired by government agencies.

The proposal by the task force, which includes representatives from the private sector and government agencies, is part of a broader effort to ensure that software products used by the government meet consistent and predefined security standards.

The OMG hopes to develop “a formal way of measuring if software is trustworthy,” said Djenana Campara, who co-chairs the Needham, Mass.-based consortium’s Architecture-Driven Modernization Task Force.

The Software Assurance Framework standards would give vendors and software buyers a consistent way to evaluate the design robustness, reliability, process integrity and configuration controls of a system, said Campara, who is also chief technology officer at Klocwork Inc., a Burlington, Mass.-based vendor of vulnerability analysis software. Security Imperative

Such a framework is crucial for allowing software suppliers to submit claims about the integrity of their software and enabling purchasers to verify the claims, said Joe Jarzombek, director of software assurance at the U.S. Department of Homeland Security’s National Cyber Security Division.

“The reason to have a standard is it tells you, ’Here’s how [a vendor] can make a claim, here are the attributes we are looking for, and here are the things you need to include when making a claim,’” Jarzombek said. The DHS is involved in the effort to develop the standards framework.

Government systems that are used for national security purposes already need to go through the Common Criteria Certification process to determine whether they meet security requirements. The OMG’s framework — which still has to go through a long approval process — would give another option to agencies that aren’t mandated to use the Common Criteria, Jarzombek said.

He added that a separate systems and software assurance standard being finalized by the International Standards Organization will give government agencies yet another option for assessing software security.

That standard is due to be approved sometime next year, according to Jarzombek.

By Jaikumar Vijayan – Computerworld (US)