1. SERC Security Systems Engineering Initiative Dr. Clifford Neuman, Director USC Center for Computer Systems Security Information Sciences Institute University of Southern California CSE Annual Research Review USC 9 March 2010

2. RT8: Security Systems Engineering Early Exploration in Security Systems Engineering Create a roadmap of research on security in systems Engineering Organizing a workshop to obtain input regarding roadmap Potential future work to address problems identified in roadmap

3. Workshop: New Approaches to Security Engineering Workshop details March 31 to April 1 in Washington DC http://www.sercuarc.org/news-events/security-research-workshop/call-for-participation/ Focus Definition of security, as an “ity”, a property of a system that must be considered, measured, and specified with other requirements. Interactions with systems interfaces and systems-of-systems issues important. Taking a high-level holistic approach that includes organizational issues including workforce issues, metrics, and system frameworks for security. Not focused on point solutions to security problems, but instead how to evaluate inclusion of such solutions as part of high level system requirements for security.

4. Potentia Problem Areas - 1 Organizational Issues Workforce Development Stakeholder Education Understanding of Security Policy These are my own thoughts, and not the output of the workshop (which has not yet occurred)

5. Potentia Problem Areas - 2 System Design and Development Issues Determining the security requirements, understanding consequences Mapping of security requirements to mechanism Methodology for evaluation of system architecture Metrics for evaluation of system security as a property of systems These are my own thoughts, and not the output of the workshop (which has not yet occurred)

6. Potentia Problem Areas - 3 Infrastructural Issues Enforcing security requirements in the parts of the system not created by the systems engineers. Network hardware and software Operating Systems and Hypervisors Middleware Software development tools / compilers These are my own thoughts, and not the output of the workshop (which has not yet occurred)