Germany – IT services: consulting, software development, Internet and support – KI im Secure Software Development Life Cycle (KISDL)

Methods of artificial intelligence (AI) demonstrate remarkable performance in many application areas and are increasingly being used in areas that impact daily life. The field of cybersecurity is also not unaffected by AI. New AI tools are being published in this context almost daily, and large language models (LLMs) are already being used for various purposes today. At the same time, the threat landscape is changing rapidly, as benevolently intended models are being misused for attack purposes (dual use). Consequently, it must be assumed that vulnerabilities will be discovered and exploited more quickly with the increasing capabilities of AI. Against this background, the defensive side must also become active, which is why this project aims to investigate how AI can be profitably used in the Secure Software Development Life Cycle (SSDLC) and what impact the advancing developments have on software security. The project is divided into three parts, with interconnected but different services: In AP 1-4 [HM1.1], a study on the current state of the art and science in the field of AI in the Secure Software Development Life Cycle is to be created. Furthermore, best practices for the use of identified AI tools are to be developed. The results are to be published. In AP 5-6 [HM2.1], the contractor, based on the study and in cooperation with the BSI, is to review and update the evaluation criteria for the AVA scoring in the Common Criteria certification in light of the new circumstances. In addition, an implementation plan for the use of AI tools for testing bodies is to be created. In AP 7, a reference architecture for the Open CoDE platform is to be created, which shows how AI tools can be integrated into the Secure Software Development Life Cycle and the software environment of Open CoDE. Suitable tools are to be proposed.