In June 2014, DARPA launched the Cyber Grand Challenge (CGC) to spur innovation in fully automated software vulnerability analysis and repair. The competitors' automated systems evaluated challenges in the CGC Qualifying Event, with the top seven including the University of Idaho's Center for Secure and Dependable Systems team moving on to the fully automated capture-the-flag competition, which will be held in August 2016.

Past efforts at designing and implementing ultra high assurance systems for government security and safety have centered on the concept of a monolithic security kernel responsible for a system-wide security policy. This approach leads to inflexible, overly complex operating systems that are too large to evaluate at the highest assurance levels (e.g., Common Criteria EAL 5 and above). We describe a new multi-layered approach to the design and verification of embedded trustworthy systems that is currently being used in the implementation of real time, embedded applications. The framework supports multiple levels of safety and multiple levels of security, based on the principle of creating separate layers of responsibility and control, with each layer responsible for enforcing its own security policy.

Database-as-a-service is one of many services being marketed as part of cloud computing. It has several major issues and concerns related to security, including data security, trust, expectations, regulations, and performance issues. Proposed resolutions include risk management and better contractual agreements, while solutions include database encryption and authenticity techniques. Other cloud computing issues include hardware security concerns and the balance of trust and risk.

DARPA initiated the Cyber Grand Challenge (CGC) in 2014 to encourage innovation in fully automated software vulnerability analysis and repair. In the June 2015 CGC Qualifying Event, the competitors' automated systems were given one day to evaluate 131 challenges. The top seven teams, including the University of Idaho's Center for Secure and Dependable Systems, will compete in the August 2016 CGC Final Event. This second of two CGC articles describes lessons learned about automated cybersecurity defensive systems.

Automated cyber defense tools require the ability to analyze binary applications, detect vulnerabilities and automatically patch those vulnerabilities. The insertion of security mechanisms that operate at function boundaries (e.g, control flow mitigation, stack guards) require automated detection of those boundaries. This paper introduces a publicly available function boundary detection tool for 32 and 64-bit Intel binaries running under Linux, that is more accurate than other reported approaches.