Systems security engineering

Security work that lands on a systems engineering spine instead of running alongside it. This is my working set of material for that: the discipline itself, guides for the individual engineering tasks, and the framework that consumes the output.

30 processes 475 tasks 9 guides November 2022

What it is, briefly

Systems security engineering is the discipline of getting security into the engineering rather than bolted on at the end. NIST frames it around a single idea: a system is built to satisfy a set of stakeholder needs, and the security aspects of those needs have to be carried through the same processes as everything else. Protection needs get defined while the problem is still being scoped. They become requirements. Those requirements get allocated to the elements of an architecture. The design then has to carry them, and somebody has to be able to show evidence that it did.

Where to go

Guides How to Short guides for the engineering tasks where security work lands. None are written yet, they are all still in progress. 0 of 9 written →

Related on the site

  • SP 800-53 Explorer Search the Rev 5 control catalogue by control ID or family.
  • CCI Explorer Any DoD CCI, its control mappings, and the STIG findings it sits inside.
  • CSEIG Explorer The ten cyber survivability attributes and the Rev 5 controls mapped onto them.

References

Everything on this section of the site is built from the publications below. Where a page quotes a publication, the quotation is shown as published and the page says so. Where I have drawn a conclusion rather than quoted one, it is labelled as my reading.

  • Primary NIST SP 800-160 Vol 1 Rev 1, Engineering Trustworthy Secure Systems, November 2022. The source for the process structure and the design principles. All quotations on this section of the site come from here unless stated otherwise.
  • Primary NIST SP 800-37 Rev 2, Risk Management Framework for Information Systems and Organizations, December 2018. The seven step framework that consumes the engineering output of these processes.
  • Primary NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations, September 2020. The control set that gets allocated into the design. The explorer indexes the Rev 5 catalogue.
  • Companion NIST SP 800-160 Vol 2 Rev 1, Developing Cyber-Resilient Systems, December 2021. The resilience companion. Overlaps with a lot of the Vol 1 process material and extends it for mission critical systems.
  • Underlying standard ISO/IEC/IEEE 15288, Systems and software engineering, System life cycle processes. The process names and the life cycle purposes are reprinted from this standard with permission. SP 800-160 adds the security purpose, outcomes, activities and tasks on top rather than replacing the tasks underneath, which is worth remembering if you are tracing anything back to 15288.

See the changelog for what has changed here recently.