A Customizable Framework for Prioritizing Systems Security Engineering Processes, Activities, and Tasks
Document Type
Article
Publication Date
7-2017
Abstract
As modern systems become increasingly complex, current security practices lack effective methodologies to adequately address the system security. This paper proposes a repeatable and tailorable framework to assist in the application of systems security engineering (SSE) processes, activities, and tasks as defined in the recently released National Institute of Standards and Technology (NIST) Special Publication 800-160. First, a brief survey of systems-oriented security methodologies is provided. Next, an examination of the relationships between the NIST-defined SSE processes is conducted to provide context for the engineering problem space. These findings inform a mapping of the NIST SSE processes to seven system-agnostic security domains which enable prioritization for three types of systems (conventional IT, cyber-physical, and defense). These concrete examples provide further understanding for applying and prioritizing the SSE effort. The goal of this paper is assist practitioners by informing the efficient application of the 30 processes, 111 activities, and 428 tasks defined in NIST SP 800-160. The customizable framework tool is available online for developers to employ, modify, and tailor to meet their needs.
DOI
10.1109/ACCESS.2017.2714979
Source Publication
IEEE Access
Recommended Citation
S. Khou, L. O. Mailloux, J. M. Pecarina and M. Mcevilley, "A Customizable Framework for Prioritizing Systems Security Engineering Processes, Activities, and Tasks," in IEEE Access, vol. 5, pp. 12878-12894, 2017. https://doi.org/10.1109/ACCESS.2017.2714979
Comments
The "Link to Full Text" button on this page loads the open access article, hosted at IEEE. The publisher retains permissions to re-use and distribute this article.
The linked article is subject to the following terms by the publisher: © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.