Security Engineering Awarenessfor Systems Engineers

摘要

Systems engineers generally are not trained in computer systems security, and thosernwho are trained often have limited exposure to narrow areas of computer security. The result isrnthat system-wide security requirements often are not understood or addressed adequately, andrndelivered systems may contain hidden security flaws and vulnerabilities that are later exploited.rnReactive efforts to patch or harden system security later in the system lifecycle are very costlyrnand only can address flaws and vulnerabilities after they have been discovered. Given both thernexplosive growth of the Internet and our ever-increasing reliance on critical information infrastructure,rnit is no longer sufficient for systems engineers to remain technically na?ve about securityrnconsiderations. This paper discusses some of the reasons for this new urgency; the areasrnwhere knowledge of computer systems security is important to systems engineers; and somerntopics that must be considered when eliciting, analyzing, and specifying system-wide securityrnrequirements.