Chapter 3 Flashcards
Systems Security Engineering Framework
A structured approach that ensures security objectives are met throughout a system’s lifecycle, providing trustworthy, secure systems.
Conceptual View
It defines the contexts for systems security engineering activities, focusing on stakeholder security objectives.
Holistic Perspective
Promotes an integrated and holistic security perspective across all system lifecycle stages.
Three Contexts
The framework outlines three critical contexts: problem context, solution context, and trustworthiness context.
Problem-Driven Approach
Ensures that the engineering process is driven by a complete understanding of the problem to provide a solution with adequate security.
Iterative Approach
The framework is implemented in a closed-loop iterative manner, allowing continuous refinement of problem statements, solutions, and trustworthiness objectives.
Systems Security Analyses
The foundation of the framework, providing data, technical interpretations, and supporting decision-making.
Customisation of Security Analyses
System security analyses are tailored to align with the scope and objectives of the framework contexts.
Assurance Case for Trustworthiness
An assurance case is structured set of arguments and evidence that proves a system satisfies specific claims, essential for demonstrating trustworthiness.
Maintaining Assurance Cases
Assurance cases are essential to demonstrate complex properties like security and need to be maintained as the engineering effort evolves.
Problem Context
The problem context in the Systems Security Engineering Framework focuses on defining stakeholder needs, concerns, security objectives, and constraints to create a secure system.
Solution Context
The solution context defines the security aspects and constraints for the system’s architecture and design, aiming to meet the requirements and objectives set in the problem context.
Trustworthiness Context
The trustworthiness context is where the trustworthiness of a system is determined based on claims derived from security objectives. It involves developing an assurance case and demonstrating that the assurance case is satisfied to show the system’s trustworthiness.
