SWAMP Instructional Videos

SWAMP Chief Scientist and PI, Bart Miller, along with his colleague, Elisa Heymann, from the University of Wisconsin-Madison’s Computer Sciences department created an educational guide to using the SWAMP: https://vimeo.com/255608773. Be sure to check out their video and links to all of the other SWAMP recordings, webinars, etc. on our website: https://continuousassurance.org/about-us/video-tutorials/.

Software Assurance Conference 2018

The SWAMP will be presenting and demonstrating at Software Assurance Conference 2018! SwACon is a software assurance (SwA) conference dedicated to advancing the state of the art in software assurance disciplines. The theme of this year’s event is open source tools and techniques that are available for SwA activities. The event is hosted by the Software Engineering Institute (SEI) in collaboration with the DoD Joint Federated Assurance Center (JFAC).

SwACon 2018 will be held on Tuesday, November 27 at the NRECA Conference Center (4301 Wilson Blvd. Arlington, VA – 1st floor). There will be presentations all day, roughly from 9am to 5pm Eastern, and you may attend only selected presentations, if needed. The event is free of charge but does require advance registration. Remote participation will also be available. To register, email swamp@continuousassurance.org for details before November 18.

 

Agenda:

SwACon 2018
November 27th, 2018
NRECA Conference Center (1st floor)
Arlington, VA

8:45AM to 9:30AM    Check-in and Registration; Light breakfast items to be served

9:30AM to 10:45AM   Getting Started with ROSE Compiler Infrastructure – Dan Quinlan

ROSE is an open source compiler infrastructure to build source-to-source program transformation and analysis tools for large-scale C (C89 and C98), C++ (C++98 and C++11), UPC, Fortran (77/95/2003), OpenMP, Java, Python, and PHP applications. ROSE is developed at Lawrence Livermore National Laboratory (LLNL). Presented by Dr. Dan Quinlan, LLNL.

10:45AM to 11:00AM  Morning beverage break

11:00AM to 12:00PM  Introduction to Binary Analysis with Pharos – Cory Cohen

The SEI’s Pharos project is an open-source static binary analysis framework that is primarily targeted at malware analysis but can also be used for software assurance tasks. Presented by Cory Cohen, SEI.

12:00PM to 1:00PM   Lunch break – participants on their own for lunch

1:00PM to 2:30PM    Introduction to Software Assurance Marketplace (SWAMP) - Von Welch & Brian Aydemir

Join us to learn about the Software Assurance Marketplace (SWAMP) – a Continuous Software Assurance Platform. During this presentation, we will introduce the SWAMP project and team, describe SWAMP’s capabilities, present a live demo, and explain how you can start using the SWAMP. Presented by Von Welch, Director of Indiana University – Center for Applied Cybersecurity Research (CACR) & Brian Aydemir, Systems Integration Developer, Morgridge Institute for Research/SWAMP.

2:30PM to 2:45PM    Afternoon break; Light snacks to be served

2:45PM to 3:45PM    Securing Software with Trail of Bits – Peter Goodman & Trent Brunson

3:45PM to 3:55PM    Short transition break

3:55PM to 4:55PM    Introduction to Source Code Analysis Laboratory (SCALe)  - Lori Flynn

SWAMP-in-a-Box Update v1.33.4

SWAMP-in-a-Box version 1.33.4 is now available from GitHub or the SWAMP-in-a-Box download server.

Noteworthy changes include:New

  • An updated version of the Ubuntu Linux version 16.04 platform is now available and will be automatically installed with SWAMP-in-a-Box 1.33.4.
  • SWAMP-in-a-Box now automatically re-tries (up to three additional times) assessments that finish with an error related to networking. This includes assessments for which a VM does not have network connectivity or for which OS dependencies cannot be installed. In many cases, these assessments succeed on the first retry.
  • SWAMP-in-a-Box administrators can now configure which viewer is initially selected on the Assessment Results page. When SWAMP-in-a-Box 1.33.4 is installed, this configuration is set to use the Native Viewer. Note that this is only applicable if a third-party viewer has been added to SWAMP-in-a-Box.
  • Parasoft C/C++test versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft C/C++test and obtain either the 32-bit or 64-bit tool archive files separately from Parasoft.
  • Parasoft Jtest versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft Jtest and obtain the 64-bit tool archive files separately from Parasoft. 
  • General enhancements and bug fixes.

Let us know if you have any questions at support@continuousassurance.org.

SWAMP Plug-Ins Updates

Updates are now available for the following SWAMP plug-ins:

If a user submits an assessment with a tool that they do not have permission to use, the assessment is not submitted and an error is reported to the user.

SWAMP plug-ins can be found in the Jenkins and Eclipse marketplaces and on GitHub: https://github.com/mirswamp.

New Updates on MIR-SWAMP.org

The following updates were made to the SWAMP at mir-swamp.org.

  1. We have updated the Acceptable Use Policy (AUP) for the SWAMP. The updated AUP replaces all previous versions.
  2. We’ve replaced version 10.3.3 of Parasoft C/C++test and Jtest with version 10.3.4.
  3. We’ve added version 10.4.0 of Parasoft C/C++test and Jtest.
  4. The Native viewer is now the default results viewer selected on the Assessment Results page.
  5. General enhancements and bug fixes

Please let us know if you have any questions at support@continuousassurance.org.

 

SWAMP Tutorials this Fall

The SWAMP team has a busy fall schedule! We have four more events coming up, including tutorials.

« Older Entries