Application of security principles to integration of enterprise, system and software engineering methods

A considerable amount of research and development effort by various engineering communities has been directed towards the engineering of complex Information Technology (IT) systems. As a result there are a number of non-proprietary processes, methods and tools designed to support the engineering of complex systems. A critical limitation has been the lack of examples relevant to specialist domains, particularly for secure IT systems. This paper summarizes the results of a study funded by the Government of Canada's Communication Security Establishment to apply security principles throughout a development life cycle for a sample IT system. The study demonstrates how traditional development methods are tailored to ensure security needs are included and how different engineering methods and design criteria are integrated and managed during IT system development.