DC SIGAda
Program for Thursday, 10 October 2002

Structured Argumentation Support for Information Assurance

Software is increasingly used in systems, which may (should the software malfunction) threaten life, health, national security, the environment, or the economy. Often, when software-intensive safety-critical or security-critical systems are specified, there are associated regulations, standards of practice, or acquisition guidelines that explicitly call for the development and maintenance of some sort of "assurance argument". The assurance argument lays out the evidence for accepting the system as adequate with respect to specific risks.

We use the phrase "assurance argument" broadly; in some contexts it may be called a safety argument, a certification case, an assurance case, or something similar. Examples of domains where an assurance argument may be required include:

• U.S. DOD weapons systems (MIL-STD 882D and a safety case)
• Civilian avionics (DO-178B and a certification case)
• Security-critical systems (the Common Criteria and an assurance case)

It is essential that the framework for developing and assessing assurance arguments be effective, since it is the basis for making critical decisions about software systems where the consequences of failure may be substantial. But it is equally important for the framework to be efficient - that is, to require resources appropriate to the size and nature of the software being assessed. Otherwise, when software is developed in safety-critical or security-critical contexts, the costs and constraints of making the assurance argument can overwhelm those for the software development itself. A framework for assurance arguments includes a description of what assurance is required for the system, how the case will be made that the required confidence is justified, what evidence is to be gathered, and how the evidence will be combined and evaluated. Some such frameworks exist and are being used. However, it is our observation that, in general, frameworks for assurance arguments could be much improved.

This talk will describe the rationale and current issues for various kinds of assurance arguments, and then describe some research MITRE is pursuing related to assurance arguments.

Chuck Howell is consulting engineer for software assurance in the Center for Innovative Computing and Informatics at the MITRE Corporation. The Center focuses on exploring, evaluating, and applying advanced information technologies in critical systems for a wide range of organizations. He is the coauthor of Solid Software (Prentice Hall, 2001). His current interests include techniques to calibrate and reduce residual doubt about the behavior of critical systems, and approaches to making large Networked Information Systems more robust (i.e., less fragile). He is the chair of a DARPA Panel developing a research agenda for Building Trustworthy Systems, and the Principal Investigator for a MITRE research project on High Confidence Software. He is a Senior Member of the IEEE and a member of the ACM.

MITRE2 is on Colshire Drive just inside the beltway south of Route 123. Colshire Road is known as "Scotts Xing" on the North side of Route 123.

Colshire Road is located on Route 123, East of I-495 and West of the Dulles Access Highway.

• Going Northbound on 123 from I-495, Colshire Road is located 2 stoplights on the right.
• Going Southbound on 123 from the Dulles Access Highway, Colshire Road is located at the first stoplight on the left.

From I-495 south of Route 123 (Dolley Madison Boulevard):

From Dulles Access Toll Road or I-495 north of the Dulles Access Toll Road:

To obtain a map of MITRE2 Building and the MITRE Campus, visit =>
http://www.acm.org/sigada/locals/dc/Directions_MITRE2.html.

• Tuesday, 14 November will be the next Baltimore SIGAda meeting.
• Thursday, 9 January 2003 will be the next DC SIGAda Chapter meeting.

Please provide suggestions on the Web site and its contents. We are particularly interested in ways the DC SIGAda Home Page can serve you better.

Consider subscribing to our e-mail list. Simply send an email to:

with the body containing:

To be removed from the list, send an email request to:

with the body containing:

Many thanks to all earlier participants, contributors, speakers, advisors, and friends, who are involved in helping to produce and attend the meetings.

Please forward this message to people who might be interested in attending. We welcome all new members as our attendance and interests grow.

Consider registering for inclusion on our e-mail list. Registration instructions are provided on the DC SIGAda Web site.