1. Stevens Institute of Technology Security Systems Engineering
Jennifer Bayuk
Cybersecurity Program Director
School of Systems and Enterprises
3/27/2017

2. Stevens Institute Security Research
National Center for Secure and Resilient Maritime Commerce
Naval Security Infrastructure Technology Laboratory
Center for the Advancement of Secure Systems and Information Assurance
National Cybersecurity Center of Excellence in Information Assurance Education
National Cybersecurity Center of Excellence in Information Assurance Research
Leader of the DoD University Affiliated Research Center for Systems Engineering Systems Security Core Research Topic
Why new focus on Systems Engineering Security?

3. Isolate and Harden Servers
Key Management
Identity
Mgmt
EXTERNAL THREATS
Secure Storage
User Terminal
Personal Computers V
Physical Perimeter
::::::
Firewall
Certificate
Authority
AntiVirus
Mgmt
Procedure
Multiplexor
LAN
User Workstation
Wireless
VPN
Modem
Modem
Mainframe
Remote Access Server
VPN
Isolate and Harden Servers
::::::
Firewall
Token Admin
Policy Servers
SIM
::::::
Firewall
Time Sharing or Bulletin Board Service
Online Services and Outsourcing Arrangements
Proxy
Server
Content
Filters
External Servers
Server
Server Farm
IPS
All rights reserved.
IDS
Web Servers
Router
Internet
WAFW
Router
The Problem
Current attacker path to data

4. SERC Security Engineering
Research Roadmap
Define systems security
Measure systems security
Devise system security frameworks
Improve the proficiency of the security engineering workforce

5. 1. Define systems security
Security Roadmap
1. Define systems security
Reassess periphery models
Focus on whole systems
Examine interfaces and interactions
Understand similarities and differences across domains

6. 2. Measure systems security
Security Roadmap
2. Measure systems security
Achievable and comparable security attributes
Outcome-based rather than vulnerability-based
Identify systemic value of currently available control standards
Identify and measure trade-offs with respect to security features

7. 3. Devise systems security frameworks
Security Roadmap
3. Devise systems security frameworks
Include policy, process and technology
Provide basis for evaluation
New classes of system-level solutions
Security-receptive architectures

8. 4. Improve the proficiency of the security engineering workforce
Security Roadmap
4. Improve the proficiency of the security engineering workforce
Encourage and educate workforce
Operational security requirements
Community force multipliers
Engage stakeholders

9. Example: Systemic Security
Systemigram software from: Boardman and Sauser, Systems Thinking: Coping with 21st century problems, Taylor & Francis, 2008.

10. Example System
::::::

11. Metaphorical Construct

12. 2 4 3 1 5 Discovery ISO 27005:2008 Security Risk Assessment
Task Order:
1. Identification of assets
2. Identification of threats
3. Identification of existing controls
4. Identification of vulnerabilities
5. Identification of consequences 5

13. Questions? Discussion? Follow-up: jennifer.bayuk@stevens.edu