Enabling FuSE Security Objectives through Cyber Survivability Methods

Cybersecurity;FuSE Security;Cyber Survivability;Mission Based Cybersecurity Analysis MBSE

The importance of system security, especially cybersecurity, continues to grow as systems become more complex, more connected, and more vulnerable. The INCOSE Vision 2035 sets goals for systems engineering (SE) as a discipline in enabling engineering solutions for a better world: “Cybersecurity will be as foundational a perspective in systems design as system performance and safety are today”. A key objective of the INCOSE Future of Systems Engineering (FuSE) Security Foundations Roadmap is to recognize cybersecurity as a fundamental part of the mission, integrated into the system architecture, and not “bolted-on” as a separate subsystem or set of features in the detailed design. To achieve this, systems engineering must address cybersecurity early in the system lifecycle, during the mission analysis and concept development phase. Cybersecurity needs must be treated as fundamental system capability.
The INCOSE FuSE Security foundations roadmap identifies six (6) objectives and eleven (11) foundational concepts necessary to achieve the FuSE vision for cybersecurity. Five of the objectives and five of the foundational concepts are directly related to systems acquisition and engineering lifecycle processes. The five objectives are: Stakeholder Alignment, Security as a Capability, Security as a Functional Requirement, Loss Driven Engineering and Modeled Trustworthiness.
This paper examines these foundational concepts in comparison to several directives and publications addressing cybersecurity analysis from a specific organizational or engineering perspective. For each publication, we examine the methods used to support cybersecurity and the benefits the method can bring to a holistic cybersecurity analysis approach.
The Cyber Test and Evaluation community has extensive cyber assessment and execution processes mandated through numerous Department of Defense (DoD) and individual service policies and directives. While cybersecurity affects both the commercial industry as well as defense programs, DoD methods and processes are more mature, better documented, and largely accessible. Each of the examined DoD-based documents includes processes and methods that directly support or enable the five FuSE foundation concepts related to system acquisition and systems engineering.
This paper studies several of the cybersecurity assessment and process guidebooks, analyzing the processes and methods to identify areas where systems engineering should be responsible, and which SE activities and outputs are needed to enable the requirements of each guidebook. Next, the paper proposes a set of common activities represented across the various guides and explains how these commonalities enable the FuSE security objectives.
This paper propositions an initial ontology to be examined by the system engineering community to enable a thorough definition and analysis of cyber survivability across the system design lifecycle.