Security engineering

Security engineering is a specialized field of engineering that deals with the development of detailed engineering plans and designs for security features, controls and systems. It is similar to other systems engineering activities in that its primary motivation is to support the delivery of engineering solutions that satisfy pre-defined functional and user requirements, but with the added dimension of preventing misuse and malicious behavior. These constraints and restrictions are often asserted as a security policy.

In one form or another, Security Engineering has existed as an informal field of study for several centuries. For example, the fields of locksmithing and security printing have been around for many years.

Due to recent catastrophic events, most notably 9/11, Security Engineering has quickly become a rapidly growing field. In fact, in a recent report completed in 2006, it was estimated that the global security industry was valued at US$150 billion.^[1]

Security engineering involves aspects of social science, psychology (such as designing a system to 'fail well' instead of trying to eliminate all sources of error) and economics, as well as physics, chemistry, mathematics, architecture and landscaping.[1] Some of the techniques used, such as fault tree analysis, are derived from safety engineering.

Other techniques such as cryptography were previously restricted to military applications. One of the pioneers of security engineering as a formal field of study is Ross Anderson.

Qualifications[]

Typical qualifications for a security engineer are:

Security+ - Entry Level
Professional Engineer, Chartered Engineer, Chartered Professional Engineer
CPP - International Certification by ASIS International
PSP - International Certification by ASIS International
CISSP
Bachelor of Science (Security) - Bsc(Sec) - Edith Cowan University, Perth, Australia
Bachelor of Science (Security Management) - Bsc (Secmgt) - Edith Cowan Univesity, Perth, Australia
Graducate Certificate in Security Management - GradCertSecMgt - Edith Cowan University, Perth, Australia
Graduate Diploma of Security (Security Science) - GradDipSecSci - Edith Cowan University, Perth, Australia
Master of Securty Management - MSecMgt - Edith Cowan University, Perth, Australia
Master of Science (Security Science) - MScSecSc - Edith Cowan Universtiy, Perth, Australia
Docotor of Philisophy (Security Science) - Edith Cowan University, Perth, Australia

However, multiple qualifications, or several qualified persons working together, may provide a more complete solution.[2]

Security Stance[]

The 2 possible default positions on security matters are:

1 Default deny - "Everything, not explicitly permitted, is forbidden"

Improves security at a cost in functionality.

This is a good approach if you have lots of security threats.

See secure computing for a discussion of computer security using this approach.

2 Default permit - "Everything, not explicitly forbidden, is permitted"

Allows greater functionality by sacrificing security.

This is only a good approach in an environment where security threats are non-existent or negligible.

See computer insecurity for an example of the failure of this approach in the real world.

Core practices[]

Security Requirements Analysis
Security architecture
Secure coding
Security testing
Security Operations and Maintenance
Economics of security

Sub-fields[]

Physical security

deter attackers from accessing a facility, resource, or information stored on physical media.

Information security

protecting data from unauthorized access, use, disclosure, destruction, modification, or disruption to access.
See esp. Computer security

Economics of security

the economic aspects of economics of privacy and computer security.

Methodologies[]

Technological advances, principally in the field of computers, have now allowed the creation of far more complex systems, with new and complex security problems. Because modern systems cut across many areas of human endeavor, security engineers not only need consider the mathematical and physical properties of systems; they also need to consider attacks on the people who use and form parts of those systems using social engineering attacks. Secure systems have to resist not only technical attacks, but also coercion, fraud, and deception by confidence tricksters.

Web Applications[]

According to the Microsoft Developer Network the patterns & practices of Security Engineering consists of the following activities:

Security Objectives
Security Design Guidelines
Security Modeling
Security Architecture and Design Review
Security Code Review
Security Testing
Security Tuning
Security Deployment Review

These activities are designed to help meet security objectives in the software life cycle.

Physical[]

File:Canadian Embassy DC 2007 002.jpg

Canadian Embassy in Washington, D.C. showing planters being used as vehicle barriers, and barriers and gates along the vehicle entrance

Understanding of a typical threat and the usual risks to people and property.
Understanding the incentives created both by the threat and the countermeasures.
Understanding risk and threat analysis methodology and the benefits of an empirical study of the physical security of a facility.
Understanding how to apply the methodology to buildings, critical infrastructure, ports, public transport and other facilities/compounds.
Overview of common physical and technological methods of protection and understanding their roles in deterrence, detection and mitigation.
Determining and prioritizing security needs and aligning them with the perceived threats and the available budget.

Target Hardening[]

Whatever the target, there are multiple ways of preventing penetration by unwanted or unauthorised persons. Methods include placing Jersey barriers, stairs or other sturdy obstacles outside tall or politically sensitive buildings to prevent car and truck bombings. Improving the method of Visitor management and some new electronic locks take advantage of technologies such as fingerprint scanning, iris or retinal scanning, and voiceprint identification to authenticate users.

Employers of Security Engineers[]

US Department of State, Bureau of Diplomatic Security (ABET certified institution degree in engineering or physics required)^[2]

Criticisms[]

Use of the term Engineer[]

Main article: Controversies over the term Engineer

Some criticize this fieldTemplate:Who as not being a bona fide field of engineering because the methodologies of this field are less formal or excessively ad-hoc compared to other fields and many in the practice of security engineering have no engineering degree.