The Mysterious Disappearance of Systems Security Engineering

A National Blindspot with Potential Adverse Consequences

I recently downloaded a copy of the Aspen Cybersecurity Group Report and read all of the content with great anticipation. Much to my surprise, I noticed a conspicuous absence of references to systems security engineering as part of the report’s recommendations. This prompted me to go back and look at variety of previous reports and grand strategies from cybersecurity commissions, advisory committees, and Blue-Ribbon panels. A couple of the more notable ones I reviewed included the Cyberspace Solarium Commission Report and the NSTAC Report to the President on a Cybersecurity Moonshot. Once again, references to systems security engineering are totally absent from these reports as well. The foundational engineering principles, concepts, and processes that form the bedrock for trustworthy, secure, and resilient systems are nowhere to be found in the recommendations. I started thinking about why these omissions are important and whether it is possible that we have a national “blind spot” in our attempts to safeguard the systems that are critical to protecting our economic and national security interests. Here are a few observations that will hopefully add to the national conversation on this important topic.

The Stakeholders

There are many stakeholder perspectives when addressing the topic of system security. These  include the “developers” who build the systems, the “consumers” who acquire and use the systems, the “sustainers” who operate and maintain the systems, and the “regulators” who enforce the policies and requirements for the systems. Each of these stakeholders has specific needs, equities, and priorities; solving complex security problems requires an understanding and appreciation of the various stakeholder perspectives and approaches. Let's take a closer look at a few of these stakeholders.

Tactical and Reactive Security from Consumers and Regulators

Consumers and regulators spend a significant amount of time, effort, and resources on cybersecurity compliance (a.k.a., cyber hygiene). This is largely a “tactical” approach to the problem and addresses security from the perspective of ensuring the confidentiality, integrity, and availability of information processed, stored, and transmitted by organizational systems. It typically involves continuous monitoring of an ever-expanding universe of cyber threats and vulnerabilities, implementing ever-increasing numbers of software patches, and managing a mountain of security incident and event information that can overwhelm the most capable organizations. The security toolbox in this realm includes a variety of frameworks, controls, and assessment procedures to demonstrate compliance and manage cybersecurity risk. This view of cybersecurity is long standing, has provided significant value historically, and is an important component in a well-rounded protection strategy for organizations. However, while necessary, a cybersecurity compliance and risk management approach—largely “reactive” in nature—is not sufficient for the types of protections we need for the systems and system components that are part of the United States critical infrastructure—systems that are ongoing targets of sophisticated adversaries and the advanced persistent threat.

Strategic and Proactive Security from Developers

In contrast to consumers and regulators, many system developers employ a “strategic” and “proactive” approach to security—viewing security as a “system property” and achieving system security through the application of rigorous security design principles, development models, security architectures, and disciplined and structured systems engineering processes. Systems engineers must address complex cyber-physical systems that collectively include trillions of lines of code, billions of devices, and ubiquitous connectivity across ever-expanding networks. These systems could include weapons systems supporting the Defense Department, industrial control systems supporting the manufacturing, transportation, or energy sectors, or medical technology supporting the healthcare sector.

Working in the world of systems engineers and addressing security issues requires a totally different mindset. Systems are designed to provide specific capabilities for stakeholders to be able to conduct organizational missions and business functions. Such systems must be engineered to protect all the assets that stakeholders value. The needs, equities, and priorities to achieve security as a fundamental property of the system must be based on sound engineering principles akin to how systems engineering addresses safety considerations.

Engineering involves making informed trades and decisions—which demand the application of rigorous systems analysis methods based on the cyber-physical characteristics of systems, not the nature of the adversarial threat. Systems engineering is about proactive, assured control of the intended behaviors and outcomes of system functions. Achieving security is an intentional by-product of the systems engineering process and not something that can be treated as an afterthought and therefore, either “added in” or “bolted on.” These systems engineering concepts are codified in NIST Special Publication 800-160, Volume 1.

Why It Matters

The danger for organizations focusing primarily on security compliance—and failing to recognize the importance of systems engineering—is an assumption that everything in the underlying system is built to “appropriate” engineering standards or best practices. If that assumption turns out to be false, then the organization’s security efforts centered around compliance and risk management are constructed on a weak and flawed foundation. Best case, this can give organizations a false sense of security. Worst case, it can result in a system failure—either from a successful cyber-attack or from weaknesses in a poorly engineered system—resulting in potentially severe or catastrophic adverse impacts for organizations and the nation.

Conclusion

So, what is the bottom line from these observations? The systems engineering view of security is rather invisible in many of the strategic reports on cybersecurity and cyber resiliency—a potentially serious “blind spot” in our long-term, strategic national planning efforts. It is important that we have confidence in the systems we acquire and use—including the engineering processes, development models, and approaches used to build those systems. A renewed focus on systems and security engineering as central components in any future recommendations in these types of reports will go a long way toward helping to ensure our cybersecurity compliance and risk management expectations are aligned with the engineering activities forming the basis of secure systems. And, at the end of the day, every “moonshot” including a “cyber moonshot” requires sound engineering.

A special note of thanks to Mark Winstead, Michael McEvilley, Keyaan Williams, and Tony Cole, long-time cybersecurity and SSE colleagues, who graciously reviewed and provided sage advice for this article.