How to
Short guides for the engineering tasks where security work actually lands, one per task. None are written yet. They are listed as I work through them, so the shape of the series is visible.
In progress
These are the ones I am working through. Nothing to click yet, they are listed so the shape of the series is visible. Each one names the processes it comes out of.
How to allocate security controls to system elements In progress Turning a control set into requirements that sit on a specific element of the design, so somebody can build it and somebody else can check it. SNSRARDE
How to define protection needs In progress Working out what has to survive, what it costs if it does not, and where the boundaries of the problem are before anything is designed. BASN
How to write security requirements you can verify In progress Writing requirements so that verification is possible at all, and so a structural requirement is not dressed up as a functional one. SR
How to describe a security architecture In progress Views and viewpoints that show where trust boundaries and enforcement points are, rather than a diagram of boxes with arrows on them. AR
How to design a security mechanism In progress The essential design criteria applied to a single mechanism, plus the failure analysis you owe the rest of the design once it exists. DESA
How to run a security trade study In progress Comparing design alternatives when the security position is a selection criterion rather than a review gate that arrives afterwards. SADM
How to verify security requirements In progress Analysis, demonstration, inspection and test, chosen deliberately per requirement, and the evidence that comes out the other end. VE
How to validate a system in operation In progress Checking the delivered system against stakeholder needs in its real environment, which is a different question from verification. VAOP
How to plan secure disposal In progress The end of life work that gets skipped, including what happens to the key material and the media that held the protected assets. DS
Provenance
- DERIVED: the process codes on each entry are the SP 800-160 Vol 1 process codes from the page data, shown so you can see which part of the life cycle each task sits in.
- ENGINEERING INTERPRETATION: the list itself, the titles and the blurbs. This series is my own outline for the site, not a taxonomy that NIST publishes. Grouping the tasks this way is my choice and a different engineer would draw the boundaries in different places.