About this webinar: Today’s electronic systems are more intelligent, more connected, and more at risk than ever before. A single vulnerability can lead to widespread system-of-systems compromises. Organizations participating in security-critical industries like Aerospace and Defense (A&D) are especially at risk. In this webinar, Christopher Rommel from VDC and Joe Jarzombek from Synopsys will discuss the results from a recent report highlighting issues facing these organizations. They will also identify what considerations need to be made for the security of software that enables and controls system functionality. https://www.brighttalk.com/webcast/11447/268705

1. Systems Failures Fuel Security-
Focused Design Practices
VDC Research | IoT & Embedded Technology
August 2017

2. 2© 2017 VDC Research Group, Inc.
Today’s speakers
Chris Rommel, Executive Vice
President at VDC Research
Joe Jarzombek, Global Manager
Software Supply Chain at Synopsys

3. 3© 2017 VDC Research Group, Inc.
19.0%
57.1%
23.8%
Yes No Don't Know
14.8%
71.4%
13.8%
All Respondents
Aerospace &
Defense
Past Exposure or Identification of Security Vulnerabilities/Failures within
Organization
Security is Already a Significant Problem

4. 4© 2017 VDC Research Group, Inc.
8.1% 4.0%
16.2%
12.5%
13.5%
12.6%
13.5%
19.2%
13.5% 18.2%
18.9% 20.2%
16.2% 13.4%
0%
20%
40%
60%
80%
100%
Aerospace &
Defense
All
Respondents
Critical
Very Important
Important
Medium Importance
Somewhat Important
Not Very Important
Not Important At All
Devices are more intelligent,
more connected and more at
risk than ever before.
Many OEMs and end users wary
of potential security problems
But only ½ A&D Engs view
Security as Important
Need to overcome user inertia:
“if it ain’t broke, don’t fix it”
OEMs need to understand the
breadth and magnitude of
risk/costs
Importance of Security on Current
Project/Program
But Does Anyone Care?

5. 5© 2017 VDC Research Group, Inc.
15.2%
13.1%
71.7%
Commercial
Third-party
Software
Open Source
Third-Party
Software
In-house
Developed Code
More sophisticated functionality;
more dependence on software
functionality
The average A&D project now
has nearly 222K lines of code
Distribution and sources of
software code (3rd party, in-
house, auto-generated, etc.) is
also changing
Percent of Total Software Code in
Final Design
Software Evolution Redefining Threat Landscape

6. 6© 2017 VDC Research Group, Inc.
12.5%
3.1%
28.1%
9.4%
15.6%
15.6%
12.5%
3.1%
100% New
90% New / 10% Reused
75% New / 25% Reused
60% New / 40% Reused
50% New / 50% Reused
40% New / 60% Reused
25% New / 75% Reused
10% New / 90% Reused
Most code used in project
developed by someone
else
46% of engineers report
that at least 50% of their
code is reused from prior
projects
Risk management profiles
vary between stakeholder
groups with sometimes
unclear ownership of
liability
Code Reuse
Cloudy SW Supply Chains Increase Risk

7. 7© 2017 VDC Research Group, Inc.
1.2%5.3%
6.1%10.5%
26.2%
31.6%
47.1%
52.6%
19.3%
0%
20%
40%
60%
80%
100%
Aerospace &
Defense
All
Respondents
Device is Unconnected
Embedded Data/ Functionality
Deemed Insensitive
Security Expected to be
Added by End Users
Other
Don't know
Some think security is not
their problem to address
Expectation that end users
can bolt on security is a
recipe for failure
Even unconnected
devices can become
connected
Reason Security is Not Important
Time to Change Priorities

8. 8© 2017 VDC Research Group, Inc.
4.3%
4.3%
15.2%
17.4%
19.6%
21.7%
23.9%
26.1%
32.6%
0% 5% 10% 15% 20% 25% 30% 35%
Don’t Know
Other
IP Theft
Data Theft/Data Harvest
Device Malfunction
Network Host Services Disabled
Loss of System/Service Disabled
Attack or Vulnerability in Lab
Device Hijack Consequences of
software exploits are
multi-faceted
Failure of any type,
even “cockpit errors,”
will always point back
to SI/OEM at some
point
Results of Security Vulnerability
Growing Cost of Failure

9. 9© 2017 VDC Research Group, Inc.
45.7%
39.1%
32.6%
21.7%
17.4%
21.7%
2.2%
0%
10%
20%
30%
40%
50%
Reputation Financial Operational Legal Human No Damaged
Cause
Don't Know
Loss of confidence and brand equity can be a serious issue
In safety-critical applications, consequences can be much more dire
Critical that engineering orgs adopt best practices to protect themselves
Implications of Security Vulnerabilities
A&D Security Risks Deep and Multifaceted

10. 10© 2017 VDC Research Group, Inc.
New tools can help address
many issues
SW quality investment should
scale with SW dev resources
Diverse/integrated testing
SW composition analysis
Eng Orgs must take proactive
steps to improve system security
and reduce financial risk
Implement during dev
Reduce number of
vulnerabilities
Reduce cost of remediation
Types of Tools Used on Current Project/Program
Securing Your Bottom-line During Development
5.7%
7.8%
7.5%
6.3%
16.1%
4.2%
15.9%
23.7%
32.9%
30.8%
0.0%
2.2%
2.2%
2.2%
8.9%
8.9%
24.4%
26.7%
31.1%
33.3%
0% 20% 40%
Dynamic Application Security Testing
Interactive Application Security Testing
Software Composition Analysis (SCA)
Static Application Security Testing
Dynamic Software Testing
Binary Analysis
Model-based Software Testing
Peer Code Review
Unit Testing
Static Analysis
MilAero
All Respondents

11. 11© 2017 VDC Research Group, Inc.
11.5%
Currently Using
Static Analysis Tools
Aerospace &
Defense
All Respondents
18.8% 13.9%
Security defects not unique to one industry
But A&D need to be held to higher standard
Reevaluate not only internal processes, but also supply chain and procurement standards
Past Exposure or Identification of Security Vulnerabilities/Failures
Must Identify SW Problems Before they Become Sec Issue

12. 12© 2017 VDC Research Group, Inc.
Final Summary & Recommendations
Increasing System Complexity Necessitates Change
Tools Help Productivity, Quality, Safety AND Security
Industry Collaboration and Self-Governance
1
2
3

13. 13© 2017 VDC Research Group, Inc.
Q&A

14. 14© 2017 VDC Research Group, Inc.
Thank you
Contact us: software-integrity-info@synopsys.com
Email: crommel@vdcresearch.com
@chris_rommel @SW Integrity