Trustworthy Software Foundation

The Trustworthy Software Foundation (TSFdn)[1] is a UK not-for-profit organisation, with stated aim of improving software.

History

TSFdn evolved from a number of previous activities:

  • A study by the Cabinet Office, Central Sponsor for Information Assurance (CSIA) in 2004-5 which identified a pervasive lack of secure software development practices as a matter for concern
  • A Department of Trade and Industry (DTI – predecessor of BIS) Global Watch Report in 2006 which noted a relative lack of secure software development practices in the UK
  • The Technology Strategy Board (TSB) Cyber Security Knowledge Transfer Network (CSKTN) Special Interest Group (SIG) on Secure Software Development (SSD, 2007-8)
  • The TSB / Foreign and Commonwealth Office (FCO) Science and Innovation Network (SIN) Multinational Workshop “Challenges to building in … information security, privacy and assurance”, held in Paris in March 2009
  • The Secure Software Development Partnership (SSDP) Study Period, funded jointly by the UK government' TSB and the Centre for the Protection of National Infrastructure (CPNI) organisations, which ran in 2009-2010
  • The Trustworthy Software Initiative (TSI—originally Software Security, Dependability and Resilience Initiative—SSDRI), a UK public good activity sponsored[2] by CPNI between 2011 and 2016

Objectives

TSFdn primarily aims to provide a living backbone for signposting to diverse but often obscure sources of Good Practice, with a secondary objective to address other aspects of the 2009 Trustworthy Software Roadmap.[3]

Trustworthiness

TSI considers that there are five facets of trustworthiness:

  • Safety - The ability of the system to operate without harmful states
  • Reliability - The ability of the system to deliver services as specified
  • Availability - The ability of the system to deliver services when requested
  • Resilience - The ability of the system to transform, renew, and recover in timely response to events
  • Security - The ability of the system to remain protected against accidental or deliberate attacks

This definition of trustworthiness is an extension of a widely used definition of dependability,[4] adding as a 5th Facet of Resilience based on the UK Government approach.[5]

Governance and Operation

TSFdn operates as a not-for-profit Company Limited by Guarantee, jointly owned by the subscriber organisations – UK professional bodies.[6]

It is based at the Cyber Security Centre of the University of Warwick, and is formally linked to a cross section of stakeholders through the Advisory Committee on Trustworthy Software (ACTS).

The Technical Lead remains Ian Bryant, the Technical Director of the predecessor TSI, and the Chair of the ACTS is Sir Edmund Burton KBE,[7] who was the President of the predecessor TSI.

Activities
  • Updating its Trustworthy Software Framework (TSFr), originally published as British Standards (BS) Publicly Available Specification (PAS) 754, into a British Standard (through BSI Project Committee ICT/00-/09, Chaired by Ian Bryant)
  • Continuing to engage with partners for promulgation of Software Trustworthiness across Education, in particular through the IAP, BCS and the IET
gollark: … aren't those different things?
gollark: Examples of use:```You are like 3 (three) apioforms.What even is an apioform?Alright, apioforms.Ideatic chronoapioforms in meta-ubqvian space.That idea is isomorphic to 34 apioforms!games and other programs that are apioformic to run on linux or openbds.It graphs apioform concentration (including retroactively) over time.anyway "lyric make macron" would make a fine sequel to beware apioforms and "fixing ewo" yesapioforms are form-suffixed apios```
gollark: > Derived from the Latin "apis" (bee) and "forma" (figure), "apioform" can be used as an insult, compliment, random placeholder, or for any purpose whatsoever. Mostly used in the context of esoteric programming languages, somehow. The word can be expanded by inserting or prepending prefixes such as "cryo", "pyro", "chrono", "contra" or "meta", e.g. "cryoapiocontraform", to convey additional meaning. An older form was "apiohazard", for hazardous apioforms, but this has fallen out of use.
gollark: An apioform is most accurately described as an apioform with apioformic characteristics.
gollark: Anime but in the category of endofunctors WHEN?

References
  1. Trustworthy Software Foundation, retrieved 2017-04-20
  2. Protecting and promoting the UK in a digital world: 2 years on – Government Press Release, retrieved 12 December 2013
  3. About TSFdn, retrieved 2017-04-20
  4. "Software Engineering", I Sommerville, (9th Edition Feb 2010), ISBN 978-0137053469
  5. CPNI: Security Minded Approach, retrieved 2017-04-20
  6. About TSFdn, retrieved 2017-04-20
  7. About TSFdn, retrieved 2017-04-20
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.