Keys to Cybersecurity Engineering Activities for Building a Cybersecurity Strategy

Today’s missions rely on highly integrated and complicated technology that must work in a dynamic and conflicted environment. Reliance on operational security controls simply for mission protection has proved inadequate. With today’s adversaries, cybersecurity must be developed into the technology to continue functioning successfully, which needs the integration of cybersecurity engineering. Cybersecurity engineering applies the precision of engineering with the understanding of operational security into all phases of the lifecycle to build, configure, operate, and manage systems for secure and flexible operation. An acquisition program’s cybersecurity strategy explains how this integration will be done.

The importance of cybersecurity engineering is developing as the capabilities demonstrated by our adversaries improve and systems shift from integrating “built for purpose” components to enhanced reliance on multi-use components, including legacy, third-party software, and external services (e.g., Azure Cloud and Platform One). This post, which improves a recent webcast and a future white paper, highlights the importance of the cybersecurity strategy in determining how the technology from an acquisition will be designed, built, integrated, and fielded to efficiently complete a mission even when the technology is below attack.

A cybersecurity strategy cannot be completed without planning, designing, monitoring, and implementing considerations of cybersecurity at all levels. It is important to consider compliance necessities, mandates for an authority to operate, and good cybersecurity hygiene. These moves alone, however, are not sufficient to assure that the composition is safe enough. These responsibilities impact each aspect of the lifecycle and effectiveness needs a high level of collaboration overall activities. The strategy should explain how this unprecedented level of collaboration will be delivered.

The owners of the cybersecurity strategy as assigned by an acquisition program office are responsible for determining how a system’s cybersecurity works to meet its mission, even below attack. These responsibilities include activities that accomplish the following:

• Plan and design trusted relationships.
• Negotiate suitable security requirements to assure confidentiality, integrity, and availability with adequate monitoring in systems and software.
• Plan and design sufficient resiliency to identify, resist and recover from attacks.
• Plan for operational security below all circumstances, including designed-in methods of discarding critical information to an adversary to avoid or reduce mission impact.
• Assess alternatives to discover the level of accepted cybersecurity risk.

Cybersecurity engineering resources should concentrate on the following six key areas that are important for building technology to work in today’s highly challenging environments:

1. Risk determination–Cybersecurity engineering includes the effective consideration of warnings and mission risk. Thoughts of risk drive assurance conclusions and the lack of cybersecurity expertise in risk analysis can lead to poor assurance options. Involving individuals with information about successful attacks and how threats can influence the system’s operational mission can be important in the decision-making steps for appropriate prioritization.

2. Defining and monitoring system and component interactions–Cybersecurity engineering examines the risk to systems from the communication among technology elements and external systems. Highly connected systems need the arrangement of cybersecurity risk overall stakeholders, system elements, and connected systems; otherwise, significant threats can remain unaddressed (i.e., missed or ignored) at various points of interaction.

The following risk areas should be recognized in design and process decisions:

• Interactions must be designed to be ensured, and segments of the design will be spread across various interacting parts; verification that the parts are all effectively working together must be a component of the validation of this integration.
• There are costs to inscribing assurance, and tradeoffs must be done among performance, reliability, usability, maintainability, etc. These costs and tradeoffs must be adjusted against the influence of the risks. Then options must be consistently implemented across the range of participating components.
• Interactions happen at many technology levels (e.g., network, security appliances, architecture, applications, data storage) and are backed by a wide range of roles. The decisions made at each level must be consistently implemented across all levels for effective results.

3. Trusted dependencies–Cybersecurity engineering assesses the dependencies and inherited risk to assure that the appropriate level of trust is built. The following are key dependency considerations where trust is included:

• Each dependency describes a risk that requires to be shared amongst interfacing components.
• Dependency decisions should be based on a practical assessment of the warnings, impacts, and opportunities described by an interaction. Controls set on the interaction should display this analysis.
• Dependencies are not static, and trust relationships should be evaluated periodically to recognize changes that warrant reconsideration.
• Using many administered components (e.g., reuse, open-source, collaboration environments) to develop technology applications and infrastructure improves the dependency on others’ assurance choices that may not meet mission requirements.

4. Attacker response–Cybersecurity engineering should manage this responsibility to ensure that system capabilities are incorporated to enable effective handling of the kinds of attacks that can be mission-critical. A broad community of attackers has increased their technology capabilities, allowing them to compromise the confidentiality, integrity, and availability of each and all of a system’s technology assets. Moreover, this attacker profile is continually changing and growing in sophistication and lethality.

There are no perfect protections and attacker abilities continue to grow, so effective coordination must acknowledge the need to identify, resist, and recover. Assuring that a system will operate even when under attack needs extensive planning and coordination across all segments and technologies. 

5. Coordination of security throughout the lifecycle–This area is the ability of cybersecurity engineering. Every step of the lifecycle should involve preparing for the fielded system. Attackers often take advantage of all potential entry points, so security must be applied broadly over people, processes, and technology. This extent of protection includes acquisition choices about software and services combined into the system. The role of executing a cybersecurity approach needs coordination among systems and software engineering, architects and planners, developers, testers, verifiers, and implementers to recognize potential gaps and methods of addressing them to ensure the operational mission.

6. Measurement for cybersecurity development–Cybersecurity engineering should be accountable for coordinating data from the several lifecycle steps, decision-making levels, and system-component evaluations to confirm that the steps intended to address cybersecurity are achieving expected results. Tools can track vulnerabilities in code, testing can show errors, and architecture analyses can recognize design weaknesses. Until these components are integrated, however, the operational risk perspective is missing. All components of the socio-technical environment (e.g., practices, processes, procedures, products) must join together and analyses must be compatible.

An assurance case can be used as a framework to connect the different elements of this analysis to determine gaps and adequacy. By mapping evidence that is appropriately produced and selected from the different steps of the lifecycle into an assurance case, considerations for how the system should operate and how it should not operate can be collected and analyzed. 

TestUnity experts will help you demonstrate that the system effectively addresses software assurance. Connect with our experts to build a Cybersecurity strategy. Schedule a discussion with our experts to know more about Cybersecurity. 

TestUnity

Testunity is a SaaS-based technology platform driven by a vast community of testers & QAs spread around the world, powered by technology & testing experts to create the dedicated testing hub. Which is capable of providing almost all kind of testing services for almost all the platforms exists in software word.