SEARCH · Search NASA

Results for “Secure Software Development”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 451 records · Page 25

All sources NASA NTRS DOE OSTI

DOE OSTI2015

Underground Test Area Activity Quality Assurance Plan Nevada National Security Site, Nevada. Revision 2

This Quality Assurance Plan (QAP) provides the overall quality assurance (QA) requirements and general quality practices to be applied to the U.S. Department of Energy (DOE), National Nuclear Security Administration Nevada Field Office (NNSA/NFO) Underground Test Area (UGTA) activities. The requirements in this QAP are consistent with DOE Order 414.1D, Change 1, Quality Assurance (DOE, 2013a); U.S. Environmental Protection Agency (EPA) Guidance for Quality Assurance Project Plans for Modeling (EPA, 2002); and EPA Guidance on the Development, Evaluation, and Application of Environmental Models (EPA, 2009). If a participant’s requirement document differs from this QAP, the stricter requirement will take precedence. NNSA/NFO, or designee, must review this QAP every two years. Changes that do not affect the overall scope or requirements will not require an immediate QAP revision but will be incorporated into the next revision cycle after identification. Section 1.0 describes UGTA objectives, participant responsibilities, and administrative and management quality requirements (i.e., training, records, procurement). Section 1.0 also details data management and computer software requirements. Section 2.0 establishes the requirements to ensure newly collected data are valid, existing data uses are appropriate, and environmental-modeling methods are reliable. Section 3.0 provides feedback loops through assessments and reports to management. Section 4.0 provides the framework for corrective actions. Section 5.0 provides references for this document.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2020

Java Software Extensibility Library

The Java Software Extensibility Library provides tools that help Java software developers produce flexible and extensible Java applications. The major components include a Plugin Library and a Polymorphic Map data structure. The Plugin Library provides developers with a Plugin Registry and a standard pattern for designing, versioning, registering, retrieving, and annotating plugins. It also enables advanced capabilities such as loading plugins at runtime, and creating/loading encrypted plugin packages. The Polymorphic Map data structure facilitates the storage and retrieval of objects of varying types within a single data structure; while maintaining type safety. The library also provides a standard design pattern for producing application-specific "Domain Maps" and "Closed Domain Maps".SAND2020-3816 M Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Fleschute, Christopher↗

DOE OSTI2021

HyRAM+ (Hydrogen Plus Other Alternative Fuels Risk Assessment Models) v.4.0

HyRAM+ is a software toolkit for conducting quantitative risk assessment (QRA) and consequence modeling for hydrogen and other alternative fuels infrastructure and transportation systems. HyRAM+ contains validated, simplified release behavior models, a standardized QRA approach, and engineering models and generic data relevant to hydrogen installations. HyRAM (hydrogen-only) versions 1.0 to 3.1 were developed by Sandia for the U.S. Department of Energy (DOE) Hydrogen and Fuel Cell Technologies Office (HFTO). The U.S. DOE Vehicle Technologies Office (VTO) and U.S. Department of Transportation (DOT) Pipeline and Hazardous Material Safety Administration (PHMSA) contributed to the development of HyRAM+ version 4.0 regarding the addition of methane (natural gas) and propane models. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-10862 O

Groth, Katrina↗

DOE OSTI2022

HyRAM+ (Hydrogen Plus Other Alternative Fuels Risk Assessment Models) v.4.1.1

Groth, Katrina↗

DOE OSTI2024

HyRAM+ (Hydrogen Plus Other Alternative Fuels Risk Assessment Models) v.5.1.1

Groth, Katrina↗

DOE OSTI2019

Addendum to the REBUS Users Guide: REBUS-PC (V.1.5)

The Department of Energy (DOE) National Nuclear Security Administration (NNSA) Material Management and Minimization (M3) Reactor Conversion Program uses the REBUS-PC computer code to provide reactor physics and core design information such as neutron flux distributions in space, energy, and time, and to track isotopic changes in fuel and neutron absorbers with burnup. REBUS-PC has evolved from the original REBUS code, which was created starting in the 1960’s to study large liquid metal cooled fast reactors. In particular, additional outputs were added to improve user convenience and some inputs were modified to improve the functionality of the software. REBUS and REBUS-PC both model the external cycle, and are very general codes with 1D, 2D, and 3D neutronics capabilities, and with complete fuel shuffling capabilities. REBUS remains an extremely efficient reactor analysis tool for use in fast reactor systems, and so development has continued at Argonne National Laboratory (ANL) to this day for non-thermal reactor applications. While retaining the efficient computational engine of REBUS, REBUS-PC has evolved to its present status with continuous development since 1999. REBUS-PC has numerous changes and enhancements directed toward the needs of the thermal reactor analyst using Windows or Linux-based computational platforms.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2022

SULI Research Report Paper

The Intelligence and Space Research Group 4 (ISR-4) at the Los Alamos National Laboratory focuses on signal processing and developing space electronics for various national security missions. The Space and Atmospheric Burst Reporting System (SABRS) is a sensing payload designed for nuclear detonation detection. As the sensors from previous payloads become obsolete, the requirement for a novel payload design increases. SABRS Prime is the successor to the previous SABRS payloads and is scheduled for delivery in 2028. As part of the SABRS Prompt Gamma Instrument Interface Board, high frequency signals from silicon photomultiplier tubes need to be split and subsequently transmitted to the Analog to Digital Converter. Prior to developing the Space Grade Instrument Interface Board, evaluation modules with Commercial off-the-shelf (COTS) components are evaluated and tested under rigorous conditions. Verification of power levels and gain specifications are some of the important steps taken during the evaluation stage. Working on the Signal Splitting Board has enabled me to work with various schematic software applications and learn more about the processes behind designing space grade electronic components. In addition, I conducted research on efficiency improvements for space-based power systems. Changes in design approaches were found to be the most significant sources of improvement. Being able to interact with researchers and peers across various scientific disciplines has given me a better insight into my future pursuits. Working in a R&D environment has cemented my decision to work on space applications for Quantum Sensing and pursue a PhD in Electrical Engineering. The SULI internship program at the Los Alamos National Laboratory has helped me develop the skillset of a researcher, understand the rigorous processes behind developing space grade hardware, and improve my critical thinking abilities to support the development of reliable instrumentation for deep space missions.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2023

Active High Assurance Authentication Protocol (AHAAP)

The AHAAP Maturation Project involves maturation and evaluation of a patented zero-trust tamper-resistant high-assurance session-less dynamic and active device authentication protocol that simultaneously authenticates identity and provides integrity verification in a single step, substantially reducing the risk of cyberattack, and eliminating the need for costly and complex conventional communication security systems requirements (i.e., cryptography, Public Key Infrastructure (PKI), and key management). These cybersecurity attributes of the technology must be preserved when applying the technology to different cybersecurity solutions, including Command & Control (C&C), Over-the-Air (OTA) update, Common Access Card (CAC), and distributed energy resource (DER) implementations, among others. The technology research objective is to test and verify that the cybersecurity attributes of the technology are not degraded in different cybersecurity applications. The primary technology development objective is to build minimum viable products to demonstrate the technology addresses today’s cybersecurity threats so that prospective investors, strategic partners, regulatory agencies, and commercial customers can interact with and assess the protection assured by the technology. The AHAAP Maturation Project goal is to develop, test, and validate one or more AHAAP implementations. The AHAAP Maturation Project tasks are: (i) engineer AHAAP implementation software, (ii) build a functional prototype that implements the AHAAP software for demonstration, testing, analysis, and evaluation purposes, and (iii) generate a report detailing the results of the AHAAP C&C software and hardware implementation. The final project deliverables are: (i) AHAAP software implementation and prototype, (ii) a report from Sandia National Laboratories detailing the results of the AHAAP implementations.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Adapting Secure MultiParty Computation to Support Machine Learning in Radio Frequency Sensor Networks

In this project we developed and validated algorithms for privacy-preserving linear regression using a new variant of Secure Multiparty Computation (MPC) we call "Hybrid MPC" (hMPC). Our variant is intended to support low-power, unreliable networks of sensors with low-communication, fault-tolerant algorithms. In hMPC we do not share training data, even via secret sharing. Thus, agents are responsible for protecting their own local data. Only the machine learning (ML) model is protected with information-theoretic security guarantees against honest-but-curious agents. There are three primary advantages to this approach: (1) after setup, hMPC supports a communication-efficient matrix multiplication primitive, (2) organizations prevented by policy or technology from sharing any of their data can participate as agents in hMPC, and (3) large numbers of low-power agents can participate in hMPC. We have also created an open-source software library named "Cicada" to support hMPC applications with fault-tolerance. The fault-tolerance is important in our applications because the agents are vulnerable to failure or capture. We have demonstrated this capability at Sandia's Autonomy New Mexico laboratory through a simple machine-learning exercise with Raspberry Pi devices capturing and classifying images while flying on four drones.

42 ENGINEERING↗

DOE OSTI2024

Advanced Computing is at the Forefront of a New “Moonshot” Revolutionizing the North American Power Grid

In the 50+ years since the first humans landed on the moon, computing has grown at breakneck speed. We are faced with another challenge that is just as daunting, and just as important to overcome-modernizing the North American electric power grid-and high-performance computing (HPC) systems with specialized software will be an important element in rising to this challenge. We describe at a high level how software developed in the ExaSGD project addresses this "moonshot" goal by utilizing exascale computing and a novel high performance solver software stack to support the mission of decarbonizing power grid operations in an environment of uncertain weather and climate. To reach the exascale benchmark the team has made a number of first-of-their-kind innovations, including novel method for stochastic optimization, fine grained parallel methods for modeling power systems, and GPU resident sparse numerical linear solvers.

17 WIND ENERGY↗

NASA NTRS2017

Non-Maximally Decimated Filter Banks Enable Adaptive Frequency Hopping for Unmanned Aircraft Vehicles

In the last few years, radio technologies for unmanned aircraft vehicle (UAV) have advanced very rapidly. The increasing need to fly unmanned aircraft systems (UAS) in the national airspace system (NAS) to perform missions of vital importance to national security, defense, and science has pushed ahead the design and implementation of new radio platforms. However, a lot still has to be done to improve those radios in terms of performance and capabilities. In addition, an important aspect to account for is hardware cost and the feasibility to implement these radios using commercial off-the-shelf (COTS) components. UAV radios come with numerous technical challenges and their development involves contributions at different levels of the design. Cognitive algorithms need to be developed in order to perform agile communications using appropriate frequency allocation while maintaining safe and efficient operations in the NAS and, digital reconfigurable architectures have to be designed in order to ensure a prompt response to environmental changes. Command and control (C2) communications have to be preserved during "standard" operations while crew operations have to be minimized. It is clear that UAV radios have to be software-defined systems, where size, weight and power consumption (SWaP) are critical parameters. This paper provides preliminary results of the efforts performed to design a fully digital radio architecture as part of a NASA Phase I STTR. In this paper, we will explain the basic idea and technical principles behind our dynamic/adaptive frequency hopping radio for UAVs. We will present our Simulink model of the dynamic FH radio transmitter design for UAV communications and show simulation results and FPGA system analysis.

UAV↗

NASA NTRS2013

IT Security Support for the Spaceport Command Control Systems Development Ground Support Development Operations

Security is one of the most if not the most important areas today. After the several attacks on the United States, security everywhere was heightened from Airports to the communication among the military branches legionnaires. With advanced persistent threats (APTs) on the rise following Stuxnet, government branches and agencies are required, more than ever, to follow several standards, policies and procedures to reduce the likelihood of a breach. Attack vectors today are very advanced and are going to continue to get more and more advanced as security controls advance. This creates a need for networks and systems to be in an updated and secured state in a launch control system environment. FISMA is a law that is mandated by the government to follow when government agencies secure networks and devices. My role on this project is to ensure network devices and systems are in compliance with NIST, as outlined in FISMA. I will achieve this by providing assistance with security plan documentation and collection, system hardware and software inventory, malicious code and malware scanning and configuration of network devices i.e. routers and IDSsIPSs. In addition I will be completing security assessments on software and hardware, vulnerability assessments and reporting, conducting patch management and risk assessments. A guideline that will help with compliance with NIST is the SANS Top 20 Critical Controls. SANS Top 20 Critical Controls as well as numerous security tools, security software and the conduction of research will be used to successfully complete the tasks given to me. This will ensure compliance with FISMA and NIST, secure systems and a secured network. By the end of this project, I hope to have carried out stated above as well as gain an immense knowledge about compliance, security tools, networks and network devices, policies and procedures.

computer information security↗

NASA NTRS2014

IT Security Support for the Spaceport Command Control Systems Development Ground Support Development Operations

Security is one of the most if not the most important areas today. After the several attacks on the United States, security everywhere has heightened from airports to the communication among the military branches legionnaires. With advanced persistent threats (APT's) on the rise following Stuxnet, government branches and agencies are required, more than ever, to follow several standards, policies and procedures to reduce the likelihood of a breach. Attack vectors today are very advanced and are going to continue to get more and more advanced as security controls advance. This creates a need for networks and systems to be in an updated and secured state in a launch control system environment. FISMA is a law that is mandated by the government to follow when government agencies secure networks and devices. My role on this project is to ensure network devices and systems are in compliance with NIST, as outlined in FISMA. I will achieve this by providing assistance with security plan documentation and collection, system hardware and software inventory, malicious code and malware scanning, and configuration of network devices i.e. routers and IDS's/IPS's. In addition, I will be completing security assessments on software and hardware, vulnerability assessments and reporting, and conducting patch management and risk assessments. A guideline that will help with compliance with NIST is the SANS Top 20 Critical Controls. SANS Top 20 Critical Controls as well as numerous security tools, security software and the conduction of research will be used to successfully complete the tasks given to me. This will ensure compliance with FISMA and NIST, secure systems and a secured network. By the end of this project, I hope to have carried out the tasks stated above as well as gain an immense knowledge about compliance, security tools, networks and network devices, as well as policies and procedures.

security↗

NASA NTRS2012

NASA Tech Briefs, March 2012

The topics include: 1) Spectral Profiler Probe for In Situ Snow Grain Size and Composition Stratigraphy; 2) Portable Fourier Transform Spectroscopy for Analysis of Surface Contamination and Quality Control; 3) In Situ Geochemical Analysis and Age Dating of Rocks Using Laser Ablation-Miniature Mass Spectrometer; 4) Physics Mining of Multi-Source Data Sets; 5) Photogrammetry Tool for Forensic Analysis; 6) Connect Global Positioning System RF Module; 7) Simple Cell Balance Circuit; 8) Miniature EVA Software Defined Radio; 9) Remotely Accessible Testbed for Software Defined Radio Development; 10) System-of-Systems Technology-Portfolio-Analysis Tool; 11) VESGEN Software for Mapping and Quantification of Vascular Regulators; 12) Constructing a Database From Multiple 2D Images for Camera Pose Estimation and Robot Localization; 13) Adaption of G-TAG Software for Validating Touch and Go Asteroid Sample Return Design Methodology; 14) 3D Visualization for Phoenix Mars Lander Science Operations; 15) RxGen General Optical Model Prescription Generator; 16) Carbon Nanotube Bonding Strength Enhancement Using Metal Wicking Process; 17) Multi-Layer Far-Infrared Component Technology; 18) Germanium Lift-Off Masks for Thin Metal Film Patterning; 19) Sealing Materials for Use in Vacuum at High Temperatures; 20) Radiation Shielding System Using a Composite of Carbon Nanotubes Loaded With Electropolymers; 21) Nano Sponges for Drug Delivery and Medicinal Applications; 22) Molecular Technique to Understand Deep Microbial Diversity; 23) Methods and Compositions Based on Culturing Microorganisms in Low Sedimental Fluid Shear Conditions; 24) Secure Peer-to-Peer Networks for Scientific Information Sharing; 25) Multiplexer/Demultiplexer Loading Tool (MDMLT); 26) High-Rate Data-Capture for an Airborne Lidar System; 27) Wavefront Sensing Analysis of Grazing Incidence Optical Systems; 28) Foam-on-Tile Damage Model; 29) Instrument Package Manipulation Through the Generation and Use of an Attenuated-Fluent Gas Fold; 30) Multicolor Detectors for Ultrasensitive Long-Wave Imaging Cameras; 31) Lunar Reconnaissance Orbiter (LRO) Command and Data Handling Flight Electronics Subsystem; and 32) Electro-Optic Segment-Segment Sensors for Radio and Optical Telescopes.

Source record↗

DOE OSTI2015

The cementitious barriers partnership experimental programs and software advancing DOE's waste disposal/tank closure efforts - 15436

The U.S. Department of Energy Environmental Management (DOE-EM) Office of Tank Waste Management sponsored Cementitious Barriers Partnership (CBP) is chartered with providing the technical basis for implementing cement-based waste forms and radioactive waste containment structures for long-term disposal. DOE needs in this area include the following to support progress in final treatment and disposal of legacy waste and closure of High-Level Waste (HLW) tanks in the DOE complex: - Long-term performance predictions and - Flow sheet development and flow sheet enhancements - Conceptual designs for new disposal facilities The DOE-EM Cementitious Barriers Partnership is producing software and experimental programs resulting in new methods and data needed for end-users involved with environmental cleanup and waste disposal. Both the modeling tools and the experimental data have already benefited the DOE sites in the areas of performance assessments by increasing confidence backed up with modeling support, leaching methods, and transport properties developed for actual DOE materials. In 2014, the CBP Partnership released the CBP Software Toolbox - 'Version 2.0' which provides concrete degradation models for: 1) sulfate attack, 2) carbonation, 3) chloride initiated rebar corrosion, and includes constituent leaching. These models are applicable and can be used by both DOE and the Nuclear Regulatory Commission (NRC) for service life and long-term performance evaluations and predictions of nuclear and radioactive waste containment structures across the DOE complex (Figure 1) including Future SRS salt-stone and HLW tank performance assessments and special analyses - Hanford site HLW tank closure projects and other projects in which cementitious barriers are required - The Advanced Simulation Capability for Environmental Management (ASCEM) project which requires source terms from cementitious containment structures as input to their flow simulations - Regulatory reviews of DOE performance assessments - Nuclear Regulatory Commission reviews of commercial nuclear power plant (NPP) structures which are part of the overall US Energy Security program to extend the service life of NPPs In addition, the CBP experimental programs have had a significant impact on the DOE complex by providing specific data unique to DOE sodium salt wastes at Hanford and SRS which are not readily available in the literature. Two recent experimental programs on cementitious phase characterization and on technetium (Tc) mobility have provided significant conclusions as summarized below: Recent mineralogy characterization discussed in this paper illustrates that sodium salt waste form matrices are somewhat similar to but not the same as those found in blended cement matrices which to date have been used in long-term thermodynamic modeling and contaminant sequestration as a first approximation. Utilizing the CBP generated data in long-term performance predictions provides for a more defensible technical basis in performance evaluations. - In addition, recent experimental studies related to technetium mobility indicate that conventional leaching protocols may not be conservative for direct disposal of Tc- containing waste forms in vadose zone environments. These results have the potential to influence the current Hanford supplemental waste treatment flow sheet and disposal conceptual design. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2025

FY 2025 Multidimensional Data Correlation Platform: Unified Software Architecture for Advanced Materials and Manufacturing Technologies Data Management and Processing

The Advanced Materials and Manufacturing Technologies (AMMT) program continues to advance a data-driven approach to demonstrate the utility of additive manufacturing for fabricating components for nuclear applications. A key scientific goal is to leverage data to better understand manufacturing outcomes and thereby improve the performance, reliability, and lifespan of nuclear components. Ultimately, this effort supports the development of standards for certification and qualification of additively manufactured components, enabling broader industry adoption. In support of this objective, the AMMT program is building and deploying a data management platform to record, index, analyze, and make available the manufacturing data generated across the AMMT program. In FY 2023, the team conceptualized the architecture of the platform and, in FY 2024, deployed the first functional version at the Oak Ridge National Laboratory (ORNL) Manufacturing Demonstration Facility (MDF). In FY 2025, the platform was officially opened to all AMMT members. To enable this expansion, core modifications and enhancements were developed, including improvements to the user interface and workflows for data entry and retrieval. Most notably, robust security and access control mechanisms were implemented to protect data and manage information sharing. This effort featured a logging system, protected views, and controlled access mechanisms. This report documents these enhancements and the transition of the platform into program-wide use.

36 MATERIALS SCIENCE↗

NASA NTRS1995

The NAS Computational Aerosciences Archive

In order to further the state-of-the-art in computational aerosciences (CAS) technology, researchers must be able to gather and understand existing work in the field. One aspect of this information gathering is studying published work available in scientific journals and conference proceedings. However, current scientific publications are very limited in the type and amount of information that they can disseminate. Information is typically restricted to text, a few images, and a bibliography list. Additional information that might be useful to the researcher, such as additional visual results, referenced papers, and datasets, are not available. New forms of electronic publication, such as the World Wide Web (WWW), limit publication size only by available disk space and data transmission bandwidth, both of which are improving rapidly. The Numerical Aerodynamic Simulation (NAS) Systems Division at NASA Ames Research Center is in the process of creating an archive of CAS information on the WWW. This archive will be based on the large amount of information produced by researchers associated with the NAS facility. The archive will contain technical summaries and reports of research performed on NAS supercomputers, visual results (images, animations, visualization system scripts), datasets, and any other supporting meta-information. This information will be available via the WWW through the NAS homepage, located at http://www.nas.nasa.gov/, fully indexed for searching. The main components of the archive are technical summaries and reports, visual results, and datasets. Technical summaries are gathered every year by researchers who have been allotted resources on NAS supercomputers. These summaries, together with supporting visual results and references, are browsable by interested researchers. Referenced papers made available by researchers can be accessed through hypertext links. Technical reports are in-depth accounts of tools and applications research projects performed by NAS staff members and collaborators. Visual results, which may be available in the form of images, animations, and/or visualization scripts, are generated by researchers with respect to a certain research project, depicting dataset features that were determined important by the investigating researcher. For example, script files for visualization systems (e.g. FAST, PLOT3D, AVS) are provided to create visualizations on the user's local workstation to elucidate the key points of the numerical study. Users can then interact with the data starting where the investigator left off. Datasets are intended to give researchers an opportunity to understand previous work, 'mine' solutions for new information (for example, have you ever read a paper thinking "I wonder what the helicity density looks like?"), compare new techniques with older results, collaborate with remote colleagues, and perform validation. Supporting meta-information associated with the research projects is also important to provide additional context for research projects. This may include information such as the software used in the simulation (e.g. grid generators, flow solvers, visualization). In addition to serving the CAS research community, the information archive will also be helpful to students, visualization system developers and researchers, and management. Students (of any age) can use the data to study fluid dynamics, compare results from different flow solvers, learn about meshing techniques, etc., leading to better informed individuals. For these users it is particularly important that visualization be integrated into dataset archives. Visualization researchers can use dataset archives to test algorithms and techniques, leading to better visualization systems, Management can use the data to figure what is really going on behind the viewgraphs. All users will benefit from fast, easy, and convenient access to CFD datasets. The CAS information archive hopes to serve as a useful resource to those interested in computational sciences. At present, only information that may be distributed internationally is made available via the archive. Studies are underway to determine security requirements and solutions to make additional information available. By providing access to the archive via the WWW, the process of information gathering can be more productive and fruitful due to ease of access and ability to manage many different types of information. As the archive grows, additional resources from outside NAS will be added, providing a dynamic source of research results.

Miceli, Kristina D.↗

DOE OSTI2024

Deciphering Discrepancies: A Comparative Analysis of Docker Image Security

As the use of microservices continues to grow and become a foundational approach to architecting software solutions, ensuring the security of microservices is paramount. Docker images have emerged as the predominant solution to containerize microservices–and thus, Docker images are becoming a large attack surface. Thus, reducing vulnerabilities in Docker images will reduce microservice cyberattacks. A common way to find vulnerabilities in Docker images employs static analysis tools like Trivy and Grype. However, these tools frequently generate disparate vulnerability reports when analyzing the same Docker image, thus causing uncertainty in tool selection. We collected 927 Docker images, analyzed them with Trivy and Grype, and compared the vulnerabilities reported in each image. Among the 865 images found to have vulnerabilities, Trivy and Grype disagreed on both the number of vulnerabilities and the vulnerability IDs found therein. Since both tools interface with external vulnerability databases, some discrepancies can be attributed to how the tools interface with these external resources. The external vulnerability databases partially overlap and frequently contradict one another, thereby creating challenges for static analysis tool developers and end users alike. This New Ideas and Emerging Results (NIER) study contains new and critical information that practitioners need for selecting and using static analysis tools–given that increases in the use of Docker technologies means increases in the size of the attack surfaces.

Boles, Brittany [Montana State University]↗