Software & System Security
Software developers eliminate vulnerabilities to increase software reliability and value. The right security strategies deliver optimal stability and increased robustness. As cyberattacks grow more sophisticated and legislation tightens, security integration is no longer optional. Yet organisations often perceive secure by design to be too difficult, burdensome, or expensive.
Making secure by design more accessible
As a product manufacturer, you recognise that cybersecurity is quickly becoming a key quality parameter. But how can you seamlessly integrate security into your design and engineering processes without burdening your staff or negatively impacting time-to-market? And how do you solidify and prove the return on investment?
TNO shows you how to implement secure by design principles, even in your legacy software and systems. We develop technology innovations that make secure by design easier. We collaborate with partners to create proofs-of-concept, and tune and configure them for specific client environments. This helps systems manufacturers integrate secure by design principles more effectively into their engineering process and apply beneficial technologies at each development stage.
Security at every stage
The common misconception: secure-by-design only applies to the earliest development stages. Or applying it means starting over. In reality, secure by design principles benefit every stage of the software development lifecycle (SDLC), including stages when a system reaches deployment. Security layers incorporated at the design stage and thorough testing during development protect the system against attack, while at the same time ensuring the software remains stable and reliable. They also improve general system quality and resilience against benign failures. Secure by design principles protect software and systems for their entire lifetime.
TNO enables organisations to implement robust secure by design practices into their development cycle – not only for software development, but also to ensure secure by design systems. Public and private sector partners uncover the full benefit of these principles and minimise the challenges they might otherwise encounter.
Our activities may include one or more of the following:
DevSecOps frameworks integrate security practices into every phase of the SDLC and ensure secure applications at speed and scale. Continuous security integration incorporates automated security checks and practices into every stage of software development and delivery through executing pipelines. TNO researches, investigates, and provides proofs of concept for these crucial security concepts so that companies can integrate them as part of their overarching secure by design practices. We address the specific challenges and vulnerabilities of a system, find the most efficient integration approaches, and validate their efficacy in production environments.
Software security testing techniques and tools are varied. Each provides a unique and important glimpse into the security and stability of a system. From manual code review to fuzzing, and from Software Composition Analysis (SCA) to Dynamic Application Security Testing (DAST), TNO identifies the right testing, implements the right procedures, and demonstrates their feasibility and long-term benefits. Software developers apply these testing techniques into their development process as a crucial component of their secure by design ambitions. Read TNO’s recent overview of the techniques and tools currently employed for software testing, and their specific value.
Modern software applications rely heavily on third-party components. This makes them vulnerable to attacks and errors that compromise the entire product, with major reputational, financial, or even legal consequences. An effective Software Bill of Materials (SBOM) lists all software components and dependencies, and provides transparency into the supply chain, which must also be secured against vulnerabilities. TNO guides companies through the development of SBOMs and supply chain strengthening. Together with the National Cyber Security Centre (NCSC) from the Dutch Ministry of Justice and Safety, TNO is publishing a series of papers to guide organisations through SBOM development. Download the SBOM What, Why and How starter’s guide.
High-assurance software and systems used for national security or other crucial and highly confidential communication and data exchange need higher levels of verification and protection. TNO has extensive experience and expertise in this process. The security of systems can be mathematically proven, and provides a 100% guarantee of the absence of bugs and security flaws. We apply the techniques necessary to secure the systems that secure our society.
Sector-specific solutions
Secure by design practices depend on the sector, their software systems, and their specific security definitions and goals. Operational technology (OT) systems, such as those in the energy domain, demand ultimate security for safety reasons, but also because their critical technologies must be trusted by the public. That means zero downtime and the highest levels of reliability. Manufacturers of critical industrial products depend to a large extent on external suppliers and need ultimate availability to remain competitive. Governments and other public sector organisations require guaranteed security and mathematical proof of integrity and confidentiality.
TNO takes specific sector conditions into account when developing solutions. We work with a multidisciplinary approach that accounts for all relevant factors.
Securing the future, today
Whether you’re in the public or private sector, developing brand-new software or operating decades-old systems, secure by design principles can benefit you. TNO develops the frameworks and technologies you need to adopt secure by design principles, and be sure your software and systems are both robust and compliant. We can help make your secure by design or software supply chain security implementation more accessible, less challenging, and more beneficial.
Contact us
-
Thomas Rooijakkers
Functie:Cyber Security ResearcherThomas Rooijakkers, a cybersecurity researcher at TNO, is dedicated to improving software quality and security. As Lead Scientist, he integrates cybersecurity into product development, creating resilient cyber-physical systems. In his role as Interim Portfolio Manager, he strategically guides TNO’s cybersecurity portfolio, driving innovative, secure solutions for industry and accelerating the digital transition.
-
Standplaats:Den Haag - New Babylon
-
Email:Email Thomas
-
Get inspired
Cybersecure AI and Emerging Technology
Autonomous Cyber Resilience
Advanced Detection and Threat Management for IT and OT
Province Noord-Brabant, TNO and partners join forces on cybersecurity
Cybersecurity by design: our vision
