DOCSLIB.ORG

Cyber Intelligence Tradecraft Report the State of Cyber Intelligence Practices in the United States Copyright 2019 Carnegie Mellon University

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cyber Intelligence Tradecraft Report the State of Cyber Intelligence Practices in the United States Copyright 2019 Carnegie Mellon University Cyber Intelligence Tradecraft Report The State of Cyber Intelligence Practices in the United States Copyright 2019 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation. References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Internal use:* Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. External use:* This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other external and/or commercial use. Requests for permission should be directed to the Software Engineering Institute at [email protected]. * These restrictions do not apply to U.S. government entities. Carnegie Mellon® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM19-0447 Cyber Intelligence Tradecraft Report The State of Cyber Intelligence Contributors Practices in the United States Hollen Barmer Jennifer Kane Heather Evans By Erica Brandon Jared Ettinger Ritwik Gupta Daniel DeCapria Andrew Mellinger Implementation Guides Artificial Intelligence and Cyber Intelligence April Galyardt, Ritwik Gupta, Dan DeCapria, Eliezer Kanal, Jared Ettinger The Internet of Things and Cyber Intelligence Dan Klinedinst, Deana Shick, Jared Ettinger Public Cyber Threat Frameworks and Cyber Intelligence Samuel Perl, Geoffrey Dobson, Geoffrey Sanders, Daniel Costa, Lawrence Rogers, Jared Ettinger Design David Biber, Alexandrea Van Deusen, Todd Loizes Contents Executive Summary ....................................................................1 Cyber Intelligence Study Report ..................................................3 Environmental Context ............................................................. 10 Data Gathering ......................................................................... 36 Threat Analysis ........................................................................ 56 Strategic Analysis ..................................................................... 69 Reporting and Feedback ........................................................... 85 Conclusion ..............................................................................104 Appendix: The Future of Cyber and Cyber Intelligence ..............106 Appendix: Most Popular Cyber Intelligence Resources ...............110 Appendix: Prioritizing Threats for Management (full view) ........111 Glossary .................................................................................112 Implementation Guides Artificial Intelligence and Cyber Intelligence.............................117 The Internet of Things and Cyber Intelligence ...........................141 Public Cyber Threat Frameworks and Cyber Intelligence ...........157 Executive Summary Strengthening Cyber Intelligence Intelligence dates to ancient times when early civilizations used it to protect their assets and gain an advantage over their adversaries. Although the ways we perform the work of intelligence have changed, it remains as critical as ever. And this can be no truer than in the cyber domain. In performing cyber intelligence, we collect, compare, analyze, and disseminate information about threats and threat actors seeking to disrupt the cyber ecosystem,1 one of our most critical assets. Through cyber intelligence, we know ourselves and our adversaries better. And with that knowledge, we can proactively take steps to better understand risks, protect against threats, and seize opportunities. In 2013, the Software Engineering Institute (SEI) at Carnegie Mellon University conducted a study on behalf of the U.S. Office of the Director of National Intelligence to understand the state of cyber intelligence practices at organizations throughout the country. We conducted a similar study in 2018, and this report details our most recent findings. We built on outcomes from the 2013 study to develop foundational concepts that drive the 2018 study. First, we define cyber intelligence as acquiring, processing, analyzing, and disseminating information that identifies, tracks, and predicts threats, risks, and opportunities in the cyber domain to offer courses of action that enhance decision making. Second, we propose a framework for cyber intelligence; based on the intelligence cycle, its components provide for Environmental Context, Data Gathering, Threat Analysis, Strategic Analysis, and Reporting and Feedback. During the 2018 study, we interviewed 32 organizations representing a variety of sectors to understand their best practices and biggest challenges in cyber intelligence. During conversations guided by questions designed to elicit descriptive answers, we noted organizations’ successes and struggles and how they approached each component of the Cyber Intelligence Framework. We also provided an informal assessment of how well each organization was performing for certain factors within each component. We aggregated and analyzed these answers, grouping what participants told us into themes. This report moves through the Cyber Intelligence Framework, detailing our findings for each component. Three companion implementation guides provide practical advice about artificial intelligence and cyber intelligence, the internet of things and cyber intelligence, and cyber threat frameworks. 1 https://www.dhs.gov/sites/default/files/publications/DHS-Cybersecurity-Strategy_1.pdf 1 There are a number of areas where organizations can take action to improve their cyber intelligence practices. They include differentiating between cyber intelligence and cybersecurity, establishing repeatable workflows, breaking down silos that fragment data and expertise, enabling leadership to understand and become more engaged in cyber intelligence, establishing consistent intelligence requirement and data validation processes, and harnessing the power of emerging technologies. Since 2013, the practice of cyber intelligence has gotten stronger. Yet it is not strong enough. In the coming years, data and compute power will continue to increase, and artificial intelligence will enable us to make sense of threats while also making threats themselves more complex. Organizations of any size can learn from and apply the best practices and performance improvement suggestions outlined in this report. Together we can achieve higher levels of performance in understanding our environment, gathering and analyzing data, and creating intelligence for decision makers. 2 Cyber Intelligence Study Report Introduction ABOUT THIS REPORT: IMPROVING THE PRACTICE OF CYBER INTELLIGENCE This report details the findings of a study the Software Engineering Institute (SEI) at Carnegie Mellon University conducted at the request of the United States Office of the Director of National Intelligence (ODNI). Our mission was simple: understand how organizations across sectors conduct the work of cyber intelligence and share our findings. In this report, we describe the practices of organizations that are performing well and the areas where many organizations struggle, and we identify the models, frameworks, and innovative technologies driving cyber intelligence today. We believe this report can provide a starting point to enable organizations across the country to adopt best practices, work together to fix common challenges, and reduce the risk of cyber threats to the broader cyber community. WHO SHOULD READ THIS REPORT? We have designed this report to be informative for anyone concerned with cyber threats. The following readers will find this report useful: • Organizational Decision Makers: understanding where to direct funding and resources • Cyber Intelligence Team Managers: understanding best practices for your team, including hiring, workflow, and leveraging data • Cyber Intelligence Analysts: understanding best practices, tools for analysis, and what your peers are doing Whether your organization has a robust cyber intelligence program or is just getting started, the actionable recommendations provided
Load more

Recommended publications
  • Trends Toward Real-Time Network Data Steganography
    TRENDS TOWARD REAL-TIME NETWORK DATA STEGANOGRAPHY James Collins, Sos Agaian Department of Electrical and Computer Engineering The University of Texas at San Antonio, San Antonio, Texas, USA [email protected], [email protected] Abstract Network steganography has been a well-known covert data channeling method for over three decades. The basic set of techniques and implementation tools have not changed significantly since their introduction in the early 1980’s. In this paper, we review the predominant methods of classical network steganography, describing the detailed operations and resultant challenges involved in embedding data in the network transport domain. We also consider the various cyber threat vectors of network steganography and point out the major differences between classical network steganography and the widely known end-point multimedia embedding techniques, which focus exclusively on static data modification for data hiding. We then challenge the security community by introducing an entirely new network data hiding methodology, which we refer to as real-time network data steganography. Finally, we provide the groundwork for this fundamental change of covert network data embedding by introducing a system-level implementation for real-time network data operations that will open the path for even further advances in computer network security. KEYWORDS Network Steganography, Real-time Networking, TCP/IP Communications, Network Protocols 1. INTRODUCTION Even though the origins of steganography reach back to the time of ancient Greece, to Herodotus in 440 BC, the art of steganography continues to evolve. This is especially true in the technical methods of digital embedding [1][2]. Digital steganography has been used since the early 1980’s and network steganography techniques quickly evolved with the advent of the Internet and standardized multimedia formats used for data exchange [3].
    [Show full text]
  • Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model
    S S symmetry Article Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model William Steingartner 1,* , Darko Galinec 2 and Andrija Kozina 3 1 Faculty of Electrical Engineering and Informatics, Technical University of Košice, Letná 9, 042 00 Košice, Slovakia 2 Department of Informatics and Computing, Zagreb University of Applied Sciences, Vrbik 8, 10000 Zagreb, Croatia; [email protected] 3 Dr. Franjo Tudman¯ Croatian Defence Academy, 256b Ilica Street, 10000 Zagreb, Croatia; [email protected] * Correspondence: [email protected] Abstract: This paper aims to explore the cyber-deception-based approach and to design a novel conceptual model of hybrid threats that includes deception methods. Security programs primarily focus on prevention-based strategies aimed at stopping attackers from getting into the network. These programs attempt to use hardened perimeters and endpoint defenses by recognizing and blocking malicious activities to detect and stop attackers before they can get in. Most organizations implement such a strategy by fortifying their networks with defense-in-depth through layered prevention controls. Detection controls are usually placed to augment prevention at the perimeter, and not as consistently deployed for in-network threat detection. This architecture leaves detection gaps that are difficult to fill with existing security controls not specifically designed for that role. Rather than using prevention alone, a strategy that attackers have consistently succeeded against, defenders Citation: Steingartner, W.; are adopting a more balanced strategy that includes detection and response. Most organizations Galinec, D.; Kozina, A. Threat Defense: Cyber Deception Approach deploy an intrusion detection system (IDS) or next-generation firewall that picks up known attacks and Education for Resilience in or attempts to pattern match for identification.
    [Show full text]
  • SPYCATCHER by PETER WRIGHT with Paul Greengrass WILLIAM
    SPYCATCHER by PETER WRIGHT with Paul Greengrass WILLIAM HEINEMANN: AUSTRALIA First published in 1987 by HEINEMANN PUBLISHERS AUSTRALIA (A division of Octopus Publishing Group/Australia Pty Ltd) 85 Abinger Street, Richmond, Victoria, 3121. Copyright (c) 1987 by Peter Wright ISBN 0-85561-166-9 All Rights Reserved. No part of this publication may be reproduced, stored in or introduced into a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the publisher. TO MY WIFE LOIS Prologue For years I had wondered what the last day would be like. In January 1976 after two decades in the top echelons of the British Security Service, MI5, it was time to rejoin the real world. I emerged for the final time from Euston Road tube station. The winter sun shone brightly as I made my way down Gower Street toward Trafalgar Square. Fifty yards on I turned into the unmarked entrance to an anonymous office block. Tucked between an art college and a hospital stood the unlikely headquarters of British Counterespionage. I showed my pass to the policeman standing discreetly in the reception alcove and took one of the specially programmed lifts which carry senior officers to the sixth-floor inner sanctum. I walked silently down the corridor to my room next to the Director-General's suite. The offices were quiet. Far below I could hear the rumble of tube trains carrying commuters to the West End. I unlocked my door. In front of me stood the essential tools of the intelligence officer’s trade - a desk, two telephones, one scrambled for outside calls, and to one side a large green metal safe with an oversized combination lock on the front.
    [Show full text]
  • Net Neutrality Reloaded
    Luca Belli Editor Net Neutrality Reloaded: Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management Zero Rating, Specialised Service, Annual Report of the UN IGF Dynamic Coalition on Net Neutrality Ad Blocking and Traffic Management Luca Belli Editor Annual Report of the UN IGF This Report is the 2016 outcome of the IGF Dynamic Coalition on Network Neutrality (DCNN). The Report gathers a series of case studies on a variety Dynamic Coalition of net neutrality issues from the perspective of different stakeholders. The double purpose of this report is to trigger meaningful discussion on net on Net Neutrality neutrality trends, while providing informative material that may be used by researchers, policy-makers and civil society alike. Researchers, practitioners and policy-makers regularly contribute to the DCNN report, providing a wide range of heterogeneous views. Preface by Tim Wu In 2016, Zero Rating was by large the most debated net neutrality issue, as reflected by the considerable number of contributions focusing on the topic within this report. Such high number of analyses on zero rating seems particularly useful to meet the increasing demand of research exploring the pros and cons of price discrimination practices. Furthermore, the report examines other very relevant and discussed topics, such as specialised services, ad blocking and reasonable traffic management, providing useful insight on some of the most recent policy evolutions in a variety of countries. Net Neutrality Reloaded: Zero Rating,
    [Show full text]
  • Trend Micro Incorporated Research Paper 2012
    Trend Micro Incorporated Research Paper 2012 Detecting APT Activity with Network Traffic Analysis Nart Villeneuve and James Bennett Contents About This Paper .................................................................................................................................. 1 Introduction ........................................................................................................................................... 1 Detecting Remote Access Trojans ................................................................................................... 3 GhostNet......................................................................................................................................... 3 Nitro and RSA Breach .................................................................................................................4 Detecting Ongoing Campaigns .........................................................................................................5 Taidoor ............................................................................................................................................5 IXESHE ............................................................................................................................................5 Enfal aka Lurid ..............................................................................................................................6 Sykipot ...........................................................................................................................................
    [Show full text]
  • Introducing Traffic Analysis
    Introducing Traffic Analysis George Danezis and Richard Clayton January 26, 2007 1 Introduction In the Second World War, traffic analysis was used by the British at Bletchley Park to assess the size of Germany's air-force, and Japanese traffic analysis countermeasures contributed to the surprise of their 1941 attack on Pearl Harbour. Nowadays, Google uses the incidence of links to assess the relative importance of web pages, credit card companies examine transactions to spot fraudulent patterns of spending, and amateur plane-spotters revealed the CIA's `extraordinary rendition' programme. Diffie and Landau, in their book on wiretapping, went so far as to say that “traffic analysis, not cryptanalysis, is the backbone of communications intelligence" [1]. However, until recently the topic has been neglected by Computer Science academics. A rich literature discusses how to secure the confidentiality, integrity and availability of communication content, but very little work has considered the information leaked from communications ‘traffic data' and how these compromises might be minimised. Traffic data records the time and duration of a communication, and traffic analysis examines this data to determine the detailed shape of the communication streams, the identities of the parties communicating, and what can be established about their locations. The data may even be sketchy or incomplete { simply knowing what `typical' communication patterns look like can be used to infer information about a particular observed communication. Civilian infrastructures, on which state and economic actors are increasingly reliant, are ever more vulnerable to traffic analysis: wireless and GSM telephony are replacing traditional systems, routing is transparent and protocols are overlaid over others { giving plenty of opportunity to observe, and take advantage of the traffic data.
    [Show full text]
  • Mass Surveillance
    Mass Surveillance Mass Surveillance What are the risks for the citizens and the opportunities for the European Information Society? What are the possible mitigation strategies? Part 1 - Risks and opportunities raised by the current generation of network services and applications Study IP/G/STOA/FWC-2013-1/LOT 9/C5/SC1 January 2015 PE 527.409 STOA - Science and Technology Options Assessment The STOA project “Mass Surveillance Part 1 – Risks, Opportunities and Mitigation Strategies” was carried out by TECNALIA Research and Investigation in Spain. AUTHORS Arkaitz Gamino Garcia Concepción Cortes Velasco Eider Iturbe Zamalloa Erkuden Rios Velasco Iñaki Eguía Elejabarrieta Javier Herrera Lotero Jason Mansell (Linguistic Review) José Javier Larrañeta Ibañez Stefan Schuster (Editor) The authors acknowledge and would like to thank the following experts for their contributions to this report: Prof. Nigel Smart, University of Bristol; Matteo E. Bonfanti PhD, Research Fellow in International Law and Security, Scuola Superiore Sant’Anna Pisa; Prof. Fred Piper, University of London; Caspar Bowden, independent privacy researcher; Maria Pilar Torres Bruna, Head of Cybersecurity, Everis Aerospace, Defense and Security; Prof. Kenny Paterson, University of London; Agustín Martin and Luis Hernández Encinas, Tenured Scientists, Department of Information Processing and Cryptography (Cryptology and Information Security Group), CSIC; Alessandro Zanasi, Zanasi & Partners; Fernando Acero, Expert on Open Source Software; Luigi Coppolino,Università degli Studi di Napoli; Marcello Antonucci, EZNESS srl; Rachel Oldroyd, Managing Editor of The Bureau of Investigative Journalism; Peter Kruse, Founder of CSIS Security Group A/S; Ryan Gallagher, investigative Reporter of The Intercept; Capitán Alberto Redondo, Guardia Civil; Prof. Bart Preneel, KU Leuven; Raoul Chiesa, Security Brokers SCpA, CyberDefcon Ltd.; Prof.
    [Show full text]
  • CBEST Threat Intelligence-Led Assessments
    Implementation guide CBEST Threat Intelligence-Led Assessments January 2021 CBEST Threat Intelligence-Led Assessments 1 Forward Operational disruption can impact financial stability, threaten the viability of individual firms and financial market infrastructures (FMIs), or cause harm to consumers and other market participants in the financial system. Firms and FMIs need to consider all of these risks when assessing the appropriate levels of resilience within their respective businesses. Dealing with cyber risk is an important element of operational resilience and the CBEST framework is intelligence-led penetration testing which aims to address this risk. CBEST is part of the Bank of England and Prudential Regulation Authority’s (PRA’s) supervisory toolkit to assess the cyber resilience of firms’ important business services. This prioritised and focused assessment allows us and firms to better understand weaknesses and vulnerabilities and take remedial actions, thereby improving the resilience of systemically important firms and by extension, the wider financial system. Continued use of CBEST has confirmed its use as a highly effective regulatory assessment tool, which can now also be conducted on a cross-jurisdictional basis, in collaboration with other international regulators and frameworks. This latest version of the CBEST Implementation Guide builds upon the previous framework and contains improvements learned from the extensive testing which has taken place. In particular, we have analysed and implemented changes with the aim of clarifying CBEST roles and responsibilities as well as regulatory expectations for different CBEST activities. While the underlying intelligence-led penetration testing approach remains the same, we have reviewed and updated the technical guidance for most activities, prepared new templates (eg Penetration Testing Report) and incorporated important references to cross-jurisdictional assessments.
    [Show full text]
  • Espionage Against the United States by American Citizens 1947-2001
    Technical Report 02-5 July 2002 Espionage Against the United States by American Citizens 1947-2001 Katherine L. Herbig Martin F. Wiskoff TRW Systems Released by James A. Riedel Director Defense Personnel Security Research Center 99 Pacific Street, Building 455-E Monterey, CA 93940-2497 REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188 The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704- 0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 1. REPORT DATE (DDMMYYYY) 2. REPORT TYPE 3. DATES COVERED (From – To) July 2002 Technical 1947 - 2001 4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER 5b. GRANT NUMBER Espionage Against the United States by American Citizens 1947-2001 5c. PROGRAM ELEMENT NUMBER 6. AUTHOR(S) 5d. PROJECT NUMBER Katherine L. Herbig, Ph.D. Martin F. Wiskoff, Ph.D. 5e. TASK NUMBER 5f. WORK UNIT NUMBER 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8.
    [Show full text]
  • MISSILE DEFENSE Further Collaboration with the Intelligence Community Would Help MDA Keep Pace With
    United States Government Accountability Office Report to Congressional Committees December 2019 MISSILE DEFENSE Further Collaboration with the Intelligence Community Would Help MDA Keep Pace with Emerging Threats GAO-20-177 December 2019 MISSILE DEFENSE Further Collaboration with the Intelligence Community Would Help MDA Keep Pace with Highlights of GAO-20-177, a report to Emerging Threats congressional committees Why GAO Did This Study What GAO Found MDA is developing missile defense The Missile Defense Agency (MDA) is experiencing delays getting the threat capabilities to defend the United assessments needed to inform its acquisition decisions. Officials from the States, deployed forces, and regional defense intelligence community—intelligence organizations within the allies from missile attacks. However, Department of Defense (DOD)—told GAO this is because they are currently missile threats continue to emerge, as overextended due to an increased demand for threat assessments from a adversaries continue to improve and recent upsurge in threat missile activity, as well as uncertainties related to their expand their missile capabilities. transition to new threat processes and products. The delays are exacerbated The National Defense Authorization because MDA does not collectively prioritize the various types of threat Act for Fiscal Year 2012 included a assessment requests submitted to the defense intelligence community or provision that GAO annually assess provide resources for unique requests, as other major defense acquisition and report on the extent to which MDA programs are generally required to do. Without timely threat assessments, has achieved its acquisition goals and MDA risks making acquisition decisions for weapon systems using irrelevant objectives, and include any other or outdated threat information, which could result in performance shortfalls.
    [Show full text]
  • The FBI's Counterterrorism Program
    U.S. Department of Justice Federal Bureau of Investigation Report to the National Commission on Terrorist Attacks upon the United States: The FBI’s Counterterrorism Program Since September 2001 April 14, 2004 Report to The National Commission on Terrorist Attacks upon the United States The FBI’s Counterterrorism Program Since September 2001 TABLETABLE OF OFCONTENTS CONTENTS I EXECUTIVE SUMMARY....................................................................11 II FBI ORGANIZATIONAL CHART................................................. 3 III TIMELINE OF SIGNIFICANT REFORMS AND INITIATIVES SINCE 9/11/01.......................................................... 4 IV INTRODUCTION......................................................................................66 V PRIORITIZATION....................................................................................77 The New Priorities.........................................................................................77 1 Protect the United States from Terrorist Attack..........................................77 2 Protect the United States Against Foreign Intelligence Operations and Espionage........................................................................................77 3 Protect the United States Against Cyber-based Attacks and High-Technology Crimes..................................................................88 4 Combat Public Corruption at all Levels.......................................................88 5 Protect Civil Rights......................................................................................88
    [Show full text]
  • Cyber Intelligence Tradecraft Report the State of Cyber Intelligence Practices in the United States Copyright 2019 Carnegie Mellon University
    Cyber Intelligence Tradecraft Report The State of Cyber Intelligence Practices in the United States Copyright 2019 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation. References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Internal use:* Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works.
    [Show full text]