Carol Woody, PhD
Software Engineering Institute
Dr. Carol Woody has been a senior member of the technical staff since 2001. Currently she is the technical manager for the Cyber Security Engineering (CSE) team, whose research focuses on meeting the challenges of cyber security in acquisition, system and software engineering. CSE is building capabilities in defining, acquiring, developing, measuring, managing, and sustaining secure software for highly complex networked systems as well as systems of systems.
Woody is an experienced technical researcher whose work has focused on government agencies, higher education, and medical organizations. She has helped them identify effective security risk management solutions, develop approaches to improve their ability to identify security and survivability requirements, and field software and systems with greater assurance.
As a consultant for ImageWork Technologies Corp., Woody managed the user testing for CITYTIME, a timekeeping application being developed for New York City. She also consulted with the Queens County District Attorney's Office of New York City to design and implement an electronic document management system. New York City's Administration for Child Services chose her to integrate financial information among state, city, and agency financial systems and also to construct a financial data warehouse and implement web-enabled processes for managing social service payments. As project manager at Yale University, Woody served as architect and implementing project manager for an integrated ID card solution, developed technical specifications and assisted users in vendor review and selection for a procurement package, designed and implemented expert system technology for distributed data collection, and managed a team of technicians supporting the financial operations of the university.
Woody holds a PhD in information science from Nova Southeastern University, an MBA from Wake Forest University, and a BS in mathematics from William and Mary.
Contact: Carol Woody
Publications by Carol Woody, PhD
-
Addressing Supply Chain Risk and Resilience for Software-Reliant Systems
February 20, 2023 • Webinar
Carol Woody, PhDCharles M. Wallen
In this webcast, Carol Woody and Charles Wallen discuss the Acquisition Security Framework (ASF) and how the ASF provides a roadmap to help organizations build security and resilience into a system.
watch -
Asking the Right Questions to Coordinate Security in the Supply Chain
February 09, 2023 • Podcast
Carol Woody, PhD
Carol Woody talks with Suzanne Miller about the SEI’s newly released Acquisition Security Framework, which helps programs coordinate the management of engineering and supply-chain risks across system components.
learn more -
Acquisition Security Framework (ASF): Managing Systems Cybersecurity Risk
November 11, 2022 • Technical Note
Christopher J. AlbertsMichael S. BandorCharles M. Wallen
This report provides an overview of the Acquisition Security Framework (ASF), a description of the practices developed thus far, and a plan for completing the ASF body of work.
read -
Preview of Developing the Acquisition Security Framework (ASF) towards Integrating Supply Chain Risk Management into the Program Acquisition and Engineering Lifecycles
November 07, 2022 • Video
Carol Woody, PhD
This short video provides an introduction to a research topic presented at the SEI Research Review 2022.
watch -
Acquisition Security Framework (ASF): An Acquisition and Supplier Perspective on Managing Software-Intensive Systems’ Cybersecurity Risk
October 04, 2022 • White Paper
Christopher J. AlbertsMichael S. BandorCharles M. Wallen
The Acquisition Security Framework (ASF) contains practices that support programs acquiring/building a secure, resilient software-reliant system to manage risks.
read -
Incorporating Supply Chain Risk and DevSecOps into a Cybersecurity Strategy
March 24, 2022 • Podcast
Carol Woody, PhD
Carol Woody, a principal researcher in the SEI's CERT Division, talks with Suzanne Miller about supply-chain issues and the planning needed to integrate software from the supply chain into operational environments.
learn more -
A Cybersecurity Engineering Strategy for DevSecOps
October 26, 2021 • Webinar
Carol Woody, PhD
In this webcast, Carol Woody presents a strategy for cybersecurity engineering in DevSecOps environments.
watch -
Security Engineering Risk Analysis (SERA) Threat Archetypes
December 16, 2020 • White Paper
Christopher J. AlbertsCarol Woody, PhD
This report examines the concept of threat archetypes and how analysts can use them during scenario development.
read -
What Is Cybersecurity Engineering and Why Do I Need It?
November 18, 2020 • Webinar
Carol Woody, PhDRita C. Creel
In this webcast, Carol Woody and Rita Creel discuss how cybersecurity engineering knowledge, methods, and tools throughout the lifecycle of software-intensive systems will reduce their inherent cyber risk and increase their operational cyber resilience.
watch -
DevSecOps Pipeline for Complex Software-Intensive Systems: Addressing Cybersecurity Challenges
September 01, 2020 • Article
Carol Woody, PhDTimothy A. ChickAaron K. Reffett
This paper describes the cybersecurity challenges that Department of Defense programs faced when adopting DevSecOps practices and how they addressed them.
read -
Agile Cybersecurity
July 16, 2020 • Podcast
Carol Woody, PhDWill Hayes
Dr. Carol Woody and Will Hayes discuss an approach that allows organizations to integrate cybersecurity into the agile pipeline.
learn more -
Attack Surface Analysis - Reduce System and Organizational Risk
June 08, 2020 • White Paper
Carol Woody, PhDRobert J. Ellison
This paper offers system defenders an overview of how threat modeling can provide a systematic way to identify potential threats and prioritize mitigations.
read -
Cloud Increases the Role of Acquisition in Cybersecurity
April 06, 2020 • Article
Carol Woody, PhDChristopher J. AlbertsJohn Klein
This article describes how an organization might address cybersecurity when it adopts cloud technology to replace physical data centers and monitoring and testing can no longer be performed directly on the equipment the system uses.
read -
Women in Software and Cybersecurity: Dr. Carol Woody
January 30, 2020 • Podcast
Carol Woody, PhD
Dr. Carol Woody discusses the career path that led to her current role as technical manager for the Cybersecurity Engineering (CSE) team in the SEI's CERT Division.
learn more -
Selecting Metrics for Software Assurance
September 24, 2019 • Podcast
Carol Woody, PhD
Dr. Carol Woody discusses the selection of metrics for measuring the software assurance of a product as it is developed and delivered to function in a specific system context.
learn more -
Operational Test & Evaluation (OT&E) Roadmap for Cloud-Based Systems
September 02, 2019 • White Paper
Carol Woody, PhDChristopher J. AlbertsJohn Klein
This paper provides an overview of the preparation and work that the AEC needs to perform to successfully transition the Army to cloud computing.
read -
Exploring the Use of Metrics for Software Assurance
March 07, 2019 • Technical Note
Carol Woody, PhDRobert J. EllisonCharlie Ryan
This report proposes measurements for each Software Assurance Framework (SAF) practice that a program can select to monitor and manage the progress it's making toward software assurance.
read -
An Approach for Integrating the Security Engineering Risk Analysis (SERA) Method with Threat Modeling
February 06, 2019 • White Paper
Christopher J. AlbertsCarol Woody, PhD
This report examines how cybersecurity data generated by a threat modeling method can be integrated into a mission assurance context using the SERA Method.
read -
Program Manager's Guidebook for Software Assurance
December 14, 2018 • Special Report
Kenneth NidifferCarol Woody, PhDTimothy A. Chick
This guidebook helps program managers address the software assurance responsibilities critical in defending software-intensive systems, including mission threads and cybersecurity.
read -
Threat Modeling for Cyber-Physical System-of-Systems: Methods Evaluation
September 25, 2018 • White Paper
Nataliya ShevchenkoBrent FryeCarol Woody, PhD
This paper compares threat modeling methods for cyber-physical systems and recommends which methods (and combinations of methods) to use.
read -
Threat Modeling: A Summary of Available Methods
August 09, 2018 • White Paper
Nataliya ShevchenkoTimothy A. ChickPaige O'Riordan
This paper discusses twelve threat modeling methods from a variety of sources that target different parts of the development process.
read -
Cybersecurity Engineering & Software Assurance: Opportunities & Risks
July 26, 2018 • Podcast
Carol Woody, PhD
Carol Woody discusses opportunities and risks in cybersecurity engineering, software assurance, and the resulting CERT Cybersecurity Engineering and Software Assurance Professional Certificate.
learn more -
CERT Cybersecurity Engineering and Software Assurance
May 24, 2018 • Video
Carol Woody, PhD
The SEI has launched the “CERT Cybersecurity Engineering and Software Assurance Professional Certificate” program. This program addresses the growing need to educate the current workforce to make good cybersecurity choices.
watch -
The CERT Software Assurance Framework
August 31, 2017 • Podcast
Carol Woody, PhDChristopher J. Alberts
In this podcast, Carol Woody and Christopher Alberts introduce the prototype Software Assurance Framework, a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain.
learn more -
Assessing DoD System Acquisition Supply Chain Risk Management
May 01, 2017 • Article
Christopher J. AlbertsJohn HallerCharles M. Wallen
In this Crosstalk article, the authors discuss the growing challenge of cyber risks in the defense supply chain.
read -
Prototype Software Assurance Framework (SAF): Introduction and Overview
April 06, 2017 • Technical Note
Christopher J. AlbertsCarol Woody, PhD
In this report, the authors discuss the Software Assurance Framework (SAF), a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain.
read -
Security Measurement: Establishing Confidence that Security Is Sufficient
March 23, 2017 • Presentation
Carol Woody, PhDChristopher J. Alberts
The SEI is researching how measurement can be used to establish confidence in software security. This presentation shares our progress to date.
read -
Cyber Security Engineering for Software and Systems Assurance
December 08, 2016 • Podcast
Nancy R. MeadCarol Woody, PhD
In this podcast Nancy Mead and Carol Woody discuss their new book, Cyber Security Engineering: A Practical Approach for Systems and Software Assurance, which introduces a set of seven principles for software assurance.
learn more -
Cyber Security Engineering: A Practical Approach for Systems and Software Assurance
November 15, 2016 • Book
Nancy R. MeadCarol Woody, PhD
Pioneering software assurance experts Dr. Nancy R. Mead and Dr. Carol C. Woody present the latest practical knowledge and case studies.
read -
Predicting Quality Assurance with Software Metrics and Security Methods
October 13, 2016 • Podcast
Carol Woody, PhD
In this podcast, Dr. Carol Woody explores the connection between measurement, methods for software assurance, and security.
learn more -
Wireless Emergency Alerts Commercial Mobile Service Provider (CMSP) Cybersecurity Guidelines
June 09, 2016 • Special Report
Christopher J. AlbertsAudrey J. DorofeeCarol Woody, PhD
This report provides members of the Commercial Mobile Service Provider (CMSP) community with practical guidance for better managing cybersecurity risk exposure, based on an SEI study of the CMSP element of the Wireless Emergency Alert pipeline.
read -
Identifying the Architectural Roots of Vulnerabilities
February 04, 2016 • Podcast
Rick KazmanCarol Woody
In this podcast, Rick Kazman and Carol Woody discuss an approach for identifying architecture debt in a large-scale industrial software project by modeling software architecture as design rule spaces.
learn more -
Extending AADL for Security Design Assurance of Cyber-Physical Systems
December 16, 2015 • Technical Report
Robert J. EllisonAllen D. HouseholderJohn J. Hudak
This report demonstrates the viability and limitations of using the Architecture Analysis and Design Language (AADL) through an extended example that allows for specifying and analyzing the security properties of an automotive electronics system.
read -
Extending AADL for Security Design Assurance of the Internet of Things Poster (SEI 2015 Research Review)
October 22, 2015 • Poster
Rick KazmanCarol Woody
This poster describes a project that aims to extend AADL to better address security in the architecture
read -
Extending AADL for Security Design Assurance of the Internet of Things
October 16, 2015 • Presentation
Carol WoodyRick Kazman
This project aims to extend AADL to better address security in the architecture
read -
Model-Based Engineering for Supply Chain Risk Management
September 01, 2015 • Article
Dan Shoemaker (University of Detroit Mercy)Carol Woody
In this article, the authors discuss how model-based engineering (MBE) offers a means to design, develop, analyze, and maintain a complex system architecture.
read -
Predicting Software Assurance Using Quality and Reliability Measures
January 29, 2015 • Podcast
William NicholsCarol Woody
In this podcast, the authors discuss how a combination of software development and quality techniques can improve software security.
learn more -
Predicting Software Assurance Using Quality and Reliability Measures
December 22, 2014 • Technical Note
Carol WoodyRobert J. EllisonWilliam Nichols
In this report, the authors discuss how a combination of software development and quality techniques can improve software security.
read -
Introduction to the Security Engineering Risk Analysis (SERA) Framework
December 04, 2014 • Technical Note
Christopher J. AlbertsCarol WoodyAudrey J. Dorofee
This report introduces the SERA Framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle.
read -
Software Assurance Engineering—Integrating Assurance into System and Software Engineering
November 01, 2014 • Video
Carol Woody, PhD
In this video, Carol Woody discusses software assurance, which is implementing software with confidence that it functions as intended and is free of vulnerabilities.
watch -
Security Engineering Risk Analysis Project
October 28, 2014 • Poster
Carol Woody
In this poster, the Security Engineering Risk Analysis Project is illustrated, including causes of security design weaknesses and the use of risk analysis.
read -
Quality and Software Assurance Project
October 28, 2014 • Poster
Carol Woody
In this poster, a Quality and Software Assurance Project is illustrated, including highlights of a literature review, a workflow, and working hypothesis.
read -
Security and Wireless Emergency Alerts
June 26, 2014 • Podcast
Christopher AlbertsCarol WoodySuzanne Miller
In this podcast Carol Woody and Christopher Alberts discuss guidelines that they developed to ensure that the WEA service remains robust and resilient against cyber attacks.
learn more -
Software Assurance
May 07, 2014 • Book Chapter
Nancy R. MeadDan Shoemaker (University of Detroit Mercy)Carol Woody
In this book chapter, the authors discuss modern principles of software assurance and identify a number of relevant process models, frameworks, and best practices.
read -
Best Practices for Trust in the Wireless Emergency Alerts Service
April 29, 2014 • Podcast
Robert EllisonCarol WoodySuzanne Miller
In this podcast, CERT researchers Robert Ellison and Carol Woody discuss research aimed at increasing alert originators' trust in the WEA service and the public's trust in the alerts that they receive.
learn more -
Maximizing Trust in the Wireless Emergency Alerts (WEA) Service
February 28, 2014 • Special Report
Carol WoodyRobert J. Ellison
This 2014 report presents recommendations for stakeholders of the Wireless Emergency Alerts (WEA) service that resulted from the development of two trust models, focusing on how to increase both alert originators' and the public's trust in WEA.
read -
Best Practices in Wireless Emergency Alerts
February 19, 2014 • Special Report
John McGregorJoseph P. ElmElizabeth Trocki Stark (SRA International, Inc.)
This report presents four best practices for the Wireless Emergency Alerts (WEA) service, including implementing WEA in a local jurisdiction, training emergency staff in using WEA, cross-jurisdictional governance of WEA, and cybersecurity risk management.
read -
Foundations for Software Assurance
December 16, 2013 • White Paper
Carol WoodyNancy R. MeadDan Shoemaker (University of Detroit Mercy)
In this paper, the authors highlight efforts to address the principles of software assurance and its educational curriculum.
read -
Agile Security - Review of Current Research and Pilot Usage
November 21, 2013 • White Paper
Carol Woody
This white paper was produced to focus attention on the opportunities and challenges for embedding information assurance considerations into Agile development and acquisition.
read -
Strengthening Ties Between Process and Security
July 31, 2013 • White Paper
Carol Woody
In this paper, Carol Woody summarizes recent key accomplishments, including harmonizing security practices with CMMI and using assurance cases.
read -
Improving Software Assurance
July 05, 2013 • White Paper
Carol WoodyRobert J. Ellison
In this paper, the authors discuss what practitioners should know about software assurance, where to look, what to look for, and how to demonstrate improvement.
read -
Scale: System Development Challenges
July 05, 2013 • White Paper
Carol WoodyRobert J. Ellison
In this paper, the authors describe software assurance challenges inherent in networked systems development and propose a solution.
read -
Supply-Chain Risk Management: Incorporating Security into Software Development
July 02, 2013 • White Paper
Carol WoodyRobert J. Ellison
In this paper, the authors describe practices that address defects and mechanisms for introducing these practices into the acquisition lifecycle.
read -
Strengths in Security Solutions
May 31, 2013 • White Paper
Arjuna Shunn (Microsoft)Carol WoodyRobert C. Seacord
In this white paper, the authors map eight CERT tools, services, and processes to Microsoft's Simplified Security Development Lifecycle.
read -
A Systemic Approach for Assessing Software Supply-Chain Risk
May 14, 2013 • White Paper
Audrey J. DorofeeCarol WoodyChristopher J. Alberts
In this paper, the authors highlight the approach being implemented by SEI researchers for assessing and managing software supply-chain risks and provides a summary of the status of this work.
read -
Foundations for Software Assurance
May 14, 2013 • White Paper
Carol WoodyDan Shoemaker (University of Detroit Mercy)Nancy R. Mead
In this paper, the authors highlight efforts underway to address our society's growing dependence on software and the need for effective software assurance.
read -
Guest Editorial Preface for 2013 Special Issue of the International Journal of Secure Software Engineering
January 01, 2013 • Article
Nancy R. MeadIvan Flechais (University of Oxford)Dan Shoemaker (University of Detroit Mercy)
In this preface, the guest editors of this special edition provide a context for the articles that comprise the issue.
read -
Principles and Measurement Models for Software Assurance
January 01, 2013 • Book Chapter
Nancy R. MeadDan Shoemaker (University of Detroit Mercy)Carol Woody
In this book chapter, the authors present a measurement model with seven principles that capture the fundamental managerial and technical concerns of development and sustainment.
read -
DoD Information Assurance and Agile: Challenges and Recommendations Gathered Through Interviews with Agile Program Managers and DoD Accreditation Reviewers
November 01, 2012 • Technical Note
Stephany BellomoCarol Woody
This paper discusses the natural tension between rapid fielding and response to change (characterized as agility) and DoD information assurance policy. Data for the paper was gathered through interviews with DoD project managers and IA representatives.
read -
Introduction to System Strategies
June 27, 2012 • White Paper
Robert J. EllisonCarol Woody
In this paper, the authors discuss the effects of the changing operational environment on the development of secure systems.
read -
Supply Chain Assurance Overview
September 01, 2011 • CERT Research Report
Robert J. EllisonChristopher J. AlbertsRita C. Creel
In this section of the research report, the authors attempt to integrate development and acquisition practices with risk-based evaluations and mitigations.
read -
Software Supply Chain Risk Management: From Products to Systems of Systems
December 01, 2010 • Technical Note
Robert J. EllisonChristopher J. AlbertsRita C. Creel
In this report, the authors consider current practices in software supply chain analysis and suggest some foundational practices.
read -
A Framework for Modeling the Software Assurance Ecosystem: Insights from the Software Assurance Landscape Project
August 01, 2010 • Technical Report
Lisa BrownswordCarol WoodyChristopher J. Alberts
In this report, the authors describe the SEI Assurance Modeling Framework, piloting to prove its value, and insights gained from that piloting.
read -
Survivability Analysis Framework
June 01, 2010 • Technical Note
Robert J. EllisonCarol Woody
In this report, the authors describe the Survivability Analysis Framework, which is used to evaluate critical operational capabilities.
read -
Evaluating and Mitigating Software Supply Chain Security Risks
May 01, 2010 • Technical Note
Robert J. EllisonJohn B. GoodenoughCharles B. Weinstock
In this 2010 report, the authors identify software supply chain security risks and specify evidence to gather to determine if these risks have been mitigated.
read -
Cyber Assurance
March 01, 2010 • White Paper
Christopher J. AlbertsRobert J. EllisonCarol Woody
This paper, extracted from the 2009 CERT Research Report, describes planned research tasks in the field of cyber assurance.
read -
Multi-View Decision Making (MVDM) Workshop
February 01, 2009 • Special Report
Christopher J. AlbertsJames SmithCarol Woody
In this report, the authors describe the value of multi-view decision making, a set of practices that reflect the realities of complex development efforts.
read -
Survivability Assurance for System of Systems
May 01, 2008 • Technical Report
Robert J. EllisonJohn B. GoodenoughCharles B. Weinstock
In this report, the authors describe the Survivability Analysis Framework, a structured view of people, process, and technology.
read -
Process Improvement Should Link to Security: SEPG 2007 Security Track Recap
September 01, 2007 • Technical Note
Carol Woody
In this document, Carol Woody summarizes the content shared at the 2007 SEPG conference and steps underway toward ties between security and process improvement.
read -
System Strategies References
July 17, 2007 • White Paper
Robert J. EllisonCarol Woody
In this paper, the authors provide references related to system strategies.
read -
Considering Operational Security Risk During System Development
January 03, 2007 • Article
Carol WoodyChristopher J. Alberts
In this article, the authors examine OCTAVE, an operational security-risk methodology, and apply it to security-related risks during system development.
read -
Sustaining Software-Intensive Systems
May 01, 2006 • Technical Note
Mary Ann LaphamCarol Woody
This 2006 report discusses questions about sustaining new and legacy systems; the report presents definitions, related issues, future considerations, and recommendations for sustaining software-intensive systems.
read -
Applying OCTAVE: Practitioners Report
May 01, 2006 • Technical Note
Carol WoodyJohnathan Coleman (No Affiliation)Michael Fancher (No Affiliation)
In this report, the authors describe how OCTAVE has been used and tailored to fit a wide range of organizational risk assessment needs.
read -
Software Acquisition Planning Guidelines
December 01, 2005 • Handbook
William E. NovakJulie B. CohenAnthony J. Lattanze
This 2005 handbook presents guidance for acquisition planning and strategy topics in a condensed form, and references the primary resources available for each topic.
read -
Eliciting and Analyzing Quality Requirements: Management Influences on Software Quality Requirements
March 01, 2005 • Technical Note
Carol Woody
In this 2005 report, Carol Woody documents how environments for system development can support or reject improved quality requirements elicitation mechanisms.
read -
OCTAVE-S Implementation Guide, Version 1
January 01, 2005 • Handbook
Christopher J. AlbertsAudrey J. DorofeeJames F. Stevens
In this 2005 handbook, the authors provide detailed guidelines for conducting an OCTAVE-S evaluation.
read -
Results of SEI Independent Research and Development Projects and Report on Emerging Technologies and Technology Trends (FY 2004)
October 01, 2004 • Technical Report
John K. BergeyEdwin J. MorrisJeannine Siviy
This report describes the IR&D projects that were conducted during fiscal year 2004 (October 2003 through September 2004).
read -
Introduction to the OCTAVE Approach
August 01, 2003 • User's Guide
Christopher J. AlbertsAudrey J. DorofeeJames F. Stevens
In this 2003 report, the authors describe the OCTAVE method, an approach for managing information security risks.
read