A Unified Model for System Security Engineering Support

In the course of performing their duties, system security engineers must develop a detailed understanding of cyber systems, the missions those systems support, the associated cyber threat, and the risk the threat poses to mission. They use this information to specify and track cyber requirements, security controls, and the architectural aspects that allow the controls to be coordinated and implemented across the cyber environment. When attempted manually, the process of gathering, interrelating, verifying, querying, analyzing, sharing, and reusing this information can be an overwhelming data management and cognitive challenge. While models exist that focus on isolated portions of the system security engineering process, this paper puts forward a unified model as a first step towards a common platform to manage this information. The model facilitates the development of analytics to assist with activities such as threat modeling, risk assessment, security requirements development, and control tracking and tailoring.