Germany – IT services: consulting, software development, Internet and support – AI in the Secure Software Development Life Cycle (KISDL)

Opportunity description

Artificial intelligence (AI) methods demonstrate remarkable performance in many areas of application and are increasingly being used in areas that affect daily life. The field of cybersecurity has also not remained untouched by AI. New AI tools are released in this context almost daily, and large AI language models (LLMs), in particular, are already being used today for various application purposes. At the same time, the threat landscape is also changing significantly, as models intended for benign purposes are misused for attack purposes (dual use). As a result, it must sometimes be assumed that, with the increasing capabilities of AI, vulnerabilities will be discovered and exploited ever more quickly in the future. Against this background, the defensive side must also take action, which is why this project is intended to investigate how AI can be used beneficially in the SSDLC and what impact ongoing developments have on software security. To this end, the project is divided into three parts, with related but different services: In work packages 1-4 [HM1.1], a study on the current state of the art and research in the field of AI in the Secure Software Development Life Cycle is to be prepared. Furthermore, best practices for the use of identified AI tools are to be developed. The results are to be published. In work packages 5-6 [HM2.1], based on the study and in cooperation with the BSI, the contractor is to review the evaluation criteria for AVA scoring in Common Criteria certification and update them in view of the new circumstances. In addition, an implementation plan for the use of AI tools by evaluation facilities is to be prepared. In work package 7, a reference architecture is to be created for the Open CoDE platform, showing how AI tools can be integrated into the Secure Software Development Life Cycle and the Open CoDE software environment. Suitable tools are to be proposed. Procedure: open. Review the original TED notice for the complete requirement, lots, amendments and attachments.