CS 5150
Software Engineering
Lecture 19
Security 2
(and maybe Reliability)
Administrivia
•
•
CS 5150
Quiz 2 done
•
“loop” in the sequence diagram
Milestone 3 this week
•
•
Presentation
Report
2
SE in the News
•
CS 5150
Electronic voting
•
Michigan fight song
3
CWE Top-25
•
CS 5150
http://cwe.mitre.org/top25/index.html
4
Privacy
•
•
•
CS 5150
If you remember nothing else about privacy
from 5150:
Store as little data about people as you can
Consult a lawyer before launching a publiclyaccessible service that retains personal
information
5
Privacy
•
•
•
•
•
CS 5150
Computers challenge assumptions about the
division between public and private
Government records
Cameras and microphones in public places
RFID everywhere
Network monitoring
6
Dependable and Reliable Systems:
The Royal Majesty
•
•
•
CS 5150
From the report of the National Transportation Safety
Board:
"On June 10, 1995, the Panamanian passenger ship
Royal Majesty grounded on Rose and Crown Shoal
about 10 miles east of Nantucket Island,
Massachusetts, and about 17 miles from where the
watch officers thought the vessel was. The vessel,
with 1,509 persons on board, was en route from St.
George’s, Bermuda, to Boston, Massachusetts."
"The Raytheon GPS unit installed on the Royal
Majesty had been designed as a standalone
navigation device in the mid- to late1980s, ...The
Royal Majesty’s GPS was configured by Majesty
Cruise Line to automatically default to the Dead
Reckoning mode when satellite data were not
7
The Royal Majesty: Analysis
•
•
•
•
•
CS 5150
The ship was steered by an autopilot that relied on
position information from the Global Positioning
System (GPS).
If the GPS could not obtain a position from satellites,
it provided an estimated position based on Dead
Reckoning (distance and direction traveled from a
known point).
The GPS failed one hour after leaving Bermuda.
The crew failed to see the warning message on the
display (or to check the instruments).
34 hours and 600 miles later, the Dead Reckoning
error was 17 miles.
8
The Royal Majesty: Software Lessons
•
•
•
•
•
•
CS 5150
All the software worked as specified (no bugs), but ...
Since the GPS software had been specified, the
requirements had changed (stand alone system now part
of integrated system).
The manufacturers of the autopilot and GPS adopted
different design philosophies about the communication of
mode changes.
The autopilot was not programmed to recognize
valid/invalid status bits in message from the GPS (NMEA
0183).
The warnings provided by the user interface were not
sufficiently conspicuous to alert the crew.
The officers had not been properly trained on this
equipment.
9