软件度量介绍 Software Metrics

SoftwareMetrics:Impossible,butDoablePaulE.Blackpaul.black@6November2024Certainequipment,instruments,software,ormaterials,commercialornon-commercial,areidentified.SuchidentificationdoesnotimplyrecommendationorendorsementofanyproductorservicebyNIST,nordoesitimplythatthematerialsorequipmentidentifiedarenecessarilythebestavailableforthepurpose.OutlineWhyissoftwaremeasurementhard?UsefulsoftwaremetricsNIST’sWorkOtherFederalWorkNon-governmentalWorkSociety’sOptionsThisPhotobyUnknownAuthorislicensedunderCCBY-SAPowerofDigitalDevicesWhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstaticWhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstaticWhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstaticWhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstatic!WhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstatic!WhyComputerizedSystemsareHardtoAnalyzeUniversal,notspecificNonlinear,notlinearDiscrete,notcontinuousComplex,notsimpleDeterministic,notrandomDynamic,notstaticWhatIs“Software”,Really?HardwareLow-level:buffer,SQLinjectionOperatingsystem,compiler,run-time,networkHigh-level:authenticate,backup,transmitunencrypteddataSoftwareisJustTransistorPatternsThisPhotobyUnknownAuthorislicensedunderCCBY-NDTheRealityofSoftware/2347/MostlySunnywithaChanceofCyber-doomWewanttoforecastbreaches,notmeasuresoftware.Vulnerabilitiescomefromeverywhere.Riskmodelsdonothandleunknownunknowns.Knownvulnerabilitieshavebeengrowing.Securityisarelationbetweenuserandsoftware.Onlyproxiesaremeasurable.AfterDavidFlater,“MostlySunnywithaChanceofCyber-doom”,SwMM-RSV,2016UsefulSoftwareMetricsWhatCanBeMeasured?SoftwaredevelopmentprocessDevelopertrainingBugfeedbackAssurancepracticesSoftwareitselfSizeandcomplexityChurnorreworkProofofpropertiesTestcoverageEvidencefromuseReportedvulnerabilitiesNon-failurefaultsContextofuseSomeofNIST’sWorkSecureSoftwareDevelopmentFramework(SSDF)PreparetheOrganization(PO),ProtecttheSoftware(PS),ProduceWell-SecuredSoftware(PW),RespondtoVulnerabilities(RV)NationalVulnerabilityDatabase(NVD)&CommonVulnerabilityScoringSystem(CVSS)AutomateddataonsoftwarevulnerabilitiesFISMA&FIPSSupplychain,PIV,CryptoModuleValidation,etc.SAMATEStaticAnalysisToolExposition(SATE)SoftwareAssuranceReferenceDataset(SARD)AIforbugdetectionBugsFramework(BF)OtherFederalWorkProductSecurityBadPractices,CISA&FBI,16October2024ProductPropertiesSecurityFeaturesOrganizationalProcessesandPoliciesBacktotheBuildingBlocks:APathTowardSecureandMeasurableSoftware,WhiteHouse,February2024ReportvulnerabilitiesUsememory-safelanguagesUse(embedded)formalmethodsMeasureprocessimprovementTranslatingAllCtoRust(TRACTOR),DARPA,July2024Non-governmentalWorkConsortiumforInformation&SoftwareQuality(CISQ)Automated,usefulmeasures OpenSourceSecurityFoundationBestPracticesbadgeMostlyprocess;selfattestationBuildingSecurityinMaturityModel(BSIMM)ProcessProof-CarryingCodePropertiesofcodeBuildingCode,CarlE.Landwehret.al.SocietyHasFourOptionsLimitsoftwareauthority.Developmeasuresthatareuseful.Onlybuildsoftwarethatcanbeassured.Acceptfailure.…BecauseComputerSystemsareHARD/2030/ThisslideswerepresentedatInformationSecurityandPrivacyAdvisoryBoard(ISPAB)6Nov2024CreditsSlide4:Borneochocolatefrom/product/borneo-n-26-spice-chocolate-bar/Mapfrom/wiki/File:Indonesia_provinces_english.pngBiggraphfrom/articles/process-massive-data-graphs-on-your-pc-with-this-dSlides5,6,and7:Exponentialgraph,randompoints,anduniversalbrainarefromBingOnlinePicturebyUnknownislicensedunderCCBY-SA/licenses/by-sa/3.0/Slide8:StackfromPaulE.Blackpresentation,seeslide11fordetails.Mazefrom/en/printable-maze-puzzles.htmlSlide10:Balancingstickfrom/snacks/balancing-stickSlide11:“Hardware”isfrom/pictures/190000/velka/el