Cilk Plus and OpenMP are parallel language extensions for the C and C++ programming languages. The CPLEX Study Group of the ISO/IEC C Standards Committee is developing a proposal for a parallel programming extension to C that combines ideas from Cilk Plus and OpenMP. We conducted a preliminary comparison of Cilk Plus and OpenMP in a master's level course on security to evaluate the design tradeoffs in the usability and security of these two approaches. The eventual goal is to inform decision-making within the committee. We found several usability problems worthy of further investigation based on student performance, including declaring and using reductions, multi-line compiler directives, and the understanda-bility of task assignment to threads.

Software is critical to life in the 21st century. It drives financial, medical, and government computer systems as well as systems that provide critical infrastructures in areas such as transportation, energy, networking, and telecommunications. As the number and severity of attacks that exploit software vulnerabilities increase, writing reliable, robust, and secure programs will substantially improve the ability of systems and infrastructure to resist such attacks. Education plays a critical role in addressing cybersecurity challenges of the future, such as designing curricula that integrate principles and practices of secure programming into educational programs. To help guide this process, the National Science Foundation Directorates of Computer and Information Science and Engineering (CISE) and Education and Human Resources (EHR) jointly sponsored the Summit on Education in Secure Software (SESS), held in Washington, DC in October, 2010. The goal of this session is to share some of the key findings and challenges identified by the summit and to actively engage the community in the discussions. Each of the speakers participated in the summit and brings a unique viewpoint to the session.

Integers represent a growing and underestimated source of vulnerabilities in C and C++ programs. This paper presents the As-if Infinitely Ranged (AIR) Integer model for eliminating vulnerabilities resulting from integer overflow, truncation, and unanticipated wrapping. The AIR Integer model either produces a value equivalent to that obtained using infinitely ranged integers or results in a runtime-constraint violation. With the exception of wrapping (which is optional), this model can be implemented by a C99-conforming compiler and used by the programmer with little or no change to existing source code. Fuzz testing of libraries that have been compiled using a prototype AIR integer compiler has been effective in discovering vulnerabilities in software with low false positive and false negative rates. Furthermore, the runtime overhead of the AIR Integer model is low enough that typical applications can enable it in deployed systems for additional runtime protection.

Planning and management of software sustainment is impaired by a lack of consistently applied, practical measures. Without these measures, it is impossible to determine the effect of efforts to improve sustainment practices. In this paper we provide a context for evaluating sustainability and discuss a set of measures developed at the Software Engineering Institute at Carnegie Mellon University.

The question of which design methods are appropriate for component-based development (CBD) is complicated by different understandings of the end objectives of CBD. A further complication is different understandings of what is meant by "component." These differences lead to entirely distinct classes of design problem. The aim of this tutorial is to, first, outline the different classes of design problem that span these differing interpretations of CBD, and, second, to outline the required methodological responses to these design problems.

The question of which design methods are appropriate for component-based development (CBD) is complicated by different understandings of the end objectives CBD. A further complication is different understandings of what is meant by "component." These differences lead to entirely distinct classes of design problem. The aim of this tutorial is to, first, outline the differing interpretations of CBD, and, second, to outline the required methodological responses to these design problems.

Information systems are critical assets for modern enterprises and incorporate key knowledge acquired over the life of an organization. These systems must be updated continuously to reflect evolving business practices. Unfortunately, repeated modification has a cumulative effect on system complexity, and the rapid evolution of technology quickly renders existing technologies obsolete. Eventually, the existing information systems become too fragile to modify and too important to discard. For this reason, organizations must consider modernizing these legacy systems to remain viable. The commercial market provides a variety of solutions to this increasingly common problem of legacy system modernization. Understanding the strengths and weaknesses of each modernization technique is paramount to select the correct solution and the overall success of a modernization effort. This paper provides a survey of modernization techniques, including screen scraping, database gateways, XML integration, CGI integration, object-oriented wrapping and "componentization" of legacy systems. This general overview enables engineers performing legacy system modernization to pre-select a subset of applicable modernization techniques for further evaluation.

Members of the COTS-based system initiative at the Software Engineering Institute have developed the Generic Enterprise Ensemble (GEE), a generic approach to building distributed, transaction based, secure enterprise information systems (EIS). GEE is a tool to help in the selection of technologies and architectural choices when building enterprise information systems. Enterprise JavaBeans/sup TM/ (EJB) is a specification from Sun Microsystems for an application server based on Java technology. a comparison is made between GEE based solutions and off-the-shelf solutions based on the EJB specification.

More and more organizations are using intranets and even the Internet as the communications media for important data. However, such communications media are inherently insecure and subject to hijacking. To secure these connections, mechanisms must be built on top of the underlying communications facilities. We discuss one such security mechanism and describe an implementation using common object request broker architecture (CORBA) based interceptors.