# JPL Deliverable Data Sheet

**NASA Office of Safety and Mission Assurance (OSMA) Software Program**

Administered by NASA Goddard Space Flight Center (GSFC) - Code IT

Software Independent Verification & Validation Facility

Fairmont, WV 26554

**Product Name:** Security Assessment Tools Report

**Date Completed:** Q4 FY00

**Product Version Number:** 1.0

**Center Initiative Title:** Reducing Software Security Risk Through an
Integrated Approach

**NASA Program Officer:** Ken McGill

**Center Initiative Task Lead:** Dr. David Gilliam, 323-08

**Contributors/Authors:** David Gilliam, Ph.D., John Kelly, Ph.D., JPL,
and Matt Bishop, Associate Professor UC Davis

**Deliverable:** Security Assessment Tools

**Clearance:** UC Davis web site containing the security assessment
tools has been reviewed and accepted for public release by JPL and is
awaiting final release pending the NASA IV&V Center approval

**NASA Project Collaboration:** None

**JPL Archive Location:**
[http://security.jpl.nasa.gov/projects.html](http://seclab.cs.ucdavis.edu/projects/testing/)

## Abstract

The fourth quarter delivery, FY'00 for this RTOP is a Security
Assessment Tools report. The security assessment tools are a list of
tools that can be used to check compiled and pre-compiled code for
potential security weaknesses that could be exploited by hackers. and,
with JPL and NASA approval, provided to the SANS organization to provide
access to it by the network security community.

**[Keywords:]{.underline}** Software safety, software engineering,
survey, directions

## Deliverable Contents / Attachments

Security Assessment Tools Report on current security tools used to test
both source and binary code for security weaknesses. A description of
these tools along with their uses is provided on the JPL Security web
site at <http://security.jpl.nasa.gov/projects.html> and a report on the
tools in pdf format can be obtained there. The report is also
accompanying this data sheet.

The security assessment tools can be used to test various security
properties in software code accessed over the network to help secure it
from being used as a source of intrusion. With NASA's approval, this
collection of tools will be made available to the internet community and
will be maintained by UC Davis on their web site at
<http://seclab.cs.ucdavis.edu/projects/testing/tools>.

A graphic of the web site is depicted below:

![](media/image1.jpeg){width="6.749305555555556in"
height="6.253472222222222in"}

Figure 1

(RTOP Work -- Opening Page)

The opening page describes the project and links to the matrix and other
ongoing RTOP activities conducted by JPL and UC Davis.

The web site includes the vulnerability matrix which lists and explains
vulnerabilities by name. It also includes the security assessment tools
that can be used to check source code and compiled code for security
weaknesses.

![](media/image2.jpeg){width="6.679861111111111in"
height="5.295833333333333in"}

Figure 2

(List of Collected Security Assessment Tools)

Figure 2 shows the list of security assessment tools. Some of these
tools will check source code for security weaknesses, others will check
compiled code for security. The description of tools and a report on the
use of the tools is provided on the Code-Checking Tools link as shown in
Figure 2.

![](media/image3.jpeg){width="6.80625in" height="5.39375in"}

Figure 3

(Security Tool Description and Pertinent Information)

Each tool includes a description of the tool, its purpose, scope, and
use along with an evaluation of the tool (Figure 3). The view shown here
shows a summary of the tool and its general purpose.

![](media/image4.jpeg){width="6.929861111111111in"
height="5.491666666666666in"}

Figure 4

(Security Tool Evaluation)

Figure 4 shows additional notes and description of the tool with a list
of pros and cons to help programmers determine its potential for use.

The current web site where the RTOP work is located is at UC Davis at
<http://seclab.cs.ucdavis.edu/projects/testing/>. This web site and the
vulnerability matrix database will continue to be updated. The original
site will be preserved on the JPL Network and Computer Security (NCS)
web site as well at
[http://security.jpl.nasa.gov](http://security.jpl.nasa.gov/).

If JPL and NASA approval is granted, the vulnerability matrix will be
maintained by UC Davis and the SANS Organization (System Administrators'
and Network Security) and made available for the internet community.

JPL Document Review has reviewed and accepted the UC Davis web site
containing the vulnerability matrix and the security assessment tools
for external release.