Presentation on theme: "INFORMATION SYSTEMS SECURITY ENGINEERING: A CRITICAL COMPONENT OF THE SYSTEMS ENGINEERING LIFECYCLE Kevin Behr SE 516 – Technical Article Presentation."— Presentation transcript:
INFORMATION SYSTEMS SECURITY ENGINEERING: A CRITICAL COMPONENT OF THE SYSTEMS ENGINEERING LIFECYCLE Kevin Behr SE 516 – Technical Article Presentation James F. Davis, "Information systems security engineering: a critical component of the systems engineering lifecycle," ACM SIGAda Ada Letters, December, 2004,
Introduction Presented before Congress (Sept. 2003): “…there is a growing problem with the security of our cyberinfrastructure…” Federal Government Commercial Off-the Shelf Software (COTS) My Experience Why? No focus on Information Assurance in the Systems Development Life Cycle (SDLC)
Information Assurance What is Information Assurance (IA)? The protection of information and information systems by ensuring: Confidentiality Integrity Authentication Availability Non-Repudiation Where is IA handled in the SDLC today?
NSA sponsored framework (2002)
IA (cont’d) Due to high upfront costs and lack of end user awareness, IA is implemented post hoc Most users choose features, convenience, and performance over security Rising demand for IA awareness requires a new approach
Information Systems Security Engineering (ISSE) What is ISSE? “the systematic approach to building IA techniques and tools within a software systems engineering process.” NSA: “the art and science of discovering users’ information protection needs and then designing and making information systems, with economy and elegance, so they can safely resist the forces to which they me be subjected.” Objective of ISSE Addressing IA from the beginning of the SDLC… Approaching IA proactively to prevent need for security fixes
SDLC with ISSE
ISSE (cont’d) ISSE AdvantagesISSE Disadvantages Avert system vulnerabilities & failuresHigh upfront costs Save $ in the long-runLack of end user awareness
ISSE realization within… Federal Government “is making progress and is moving to a system-wide acceptance of ISSE” International Information Systems Security Certification Consortium (ISC) Information Systems Security Engineering Professional (ISSEP) Industries Demand for Security Engineers and ISSE principles is growing (in support of federal and commercial missions) Increasing residential bandwidth and globalization Academia Response has been broadened by federal ventures Design for Securability
Recommendations In order to incorporate IA in today’s system’s, ISSE is needed Build security engineers from the ground up Academia End User realization Incorporation of ISSE principles Certification Processes
Conclusion There exists a fundamental need for ISSE What is ISSE Use of ISSE Today Federal, Corporate, Academic Critical component of SDLC Without ISSE, post hoc security System vulnerabilities Long run failures and costs Growing Academic and Industrial awareness
Our Role (as SE students)? Think about the security needs for our Graduate Thesis System – are there any? How do we find out? What can we do to ensure IA? Interface Restrictions Encryption Code Minimalization Etc.