Premium
A PATH TOWARDS CYBER RESILIENT AND SECURE SYSTEMS METRICS AND MEASURES
Author(s) -
Dunlap Holly
Publication year - 2016
Publication title -
insight
Language(s) - English
Resource type - Journals
eISSN - 2156-4868
pISSN - 2156-485X
DOI - 10.1002/inst.12090
Subject(s) - computer security , survivability , security information and event management , security testing , software security assurance , computer science , security service , risk analysis (engineering) , countermeasure , system lifecycle , security through obscurity , risk management , engineering management , process management , engineering , information security , cloud computing security , software , business , application lifecycle management , cloud computing , computer network , programming language , finance , aerospace engineering , operating system
A holistic and defense in depth approach to program protection must be taken to increase system survivability. Systems security engineers (SSE) work with security specialty subject matter experts in specialties such as cyber security, software and hardware assurance, supply chain, anti‐tamper and general program security to integrate a security perspective throughout the systems engineering process and product development lifecycle. Today security specialties have varying methods, metrics, and measures to evaluate their threats, vulnerabilities, and likelihood of impact to the system's operational mission. This variability causes significant challenges throughout the system development lifecycle starting with articulating customer system security requirements to validating and verifying countermeasure implementation effectiveness to achieve acceptable levels of risk mitigation. To manage, balance, and conduct risk based trades, SSEs need a common metric with a common scale to evaluate security quality system attributes. This article explores concepts for consideration, which include establishing a common system security risk metric, integrating cyber resilient design within the system architecture, and methods for proving system security. These concepts apply to each security specialty and each security specialty contributes to the overall survivability of a system.