Security Foundations for Future Systems Engineering (FuSE) Initiative Presentation
The Security Foundations for the Future of Systems Engineering (FuSE) Initiative presentation delves into agile security solutions and techno-social contracts in the context of systems engineering. Rick Dove, CEO of Paradigm Shift International, explores strategies for security system engineering and engineered system security, emphasizing the need for continual adaptation to combat agile adversaries. Attendees are encouraged to contemplate how these concepts can be applied in their work environments.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
A Few Words First Audio Connection Please mute phone (*6 toggle) or your GM left-side name Phone connections may be muted during presentation. Put questions in chat box. Upcoming Meetings: June 15: INCOSE webinar Randall Iliff, Dr. Eric Rebentisch, and Stephen Townsend, 3 Years Later Building the Mindset for PM/SE Integration, Register online, https://www.incose.org/about-incose/community/webinar-showcase July 8: Dr. Jon Wade, Systems Engineering 2.0 August 12: Sarah Hale, A Next Generation Model-Based Enterprise Maturity Index CSEP Courses by Certification Training International: Course details(with more locations and dates) Upcoming Course Schedule (somewhat nearby): 2020 Sep 28-Oct 2 | Austin, TX CTI currently is offering online course offerings, see https://certificationtraining-int.com/incose-sep-exam-prep- course/ Chapter SEP mentors: Ann Hodges alhodge@sandia.gov and Heidi Hahn hahn@lanl.gov And now - introductions
Enchantment Chapter Monthly Meeting 4:45pm 6:00pm MT Security Foundations for the Future of Systems Engineering (FuSE) Initiative Abstract: The Future of Systems Engineering (FuSE) is an INCOSE led multi-organization collaborative initiative that has identified several specific topics to be investigated. Rick leads the FuSE topic on security. The current focus in the security topic within the FuSE initiative is on foundation development general considerations that should shape the breadth and depth of necessary future solution strategies. Two IS20 papers offer two initial foundations. One addresses strategy for security system engineering as a process, the other addresses strategy for engineered system security as an operational product. This presentation reviews the content of these two papers: Contextually Aware Agile Security and Techno-Social Contracts for Security Orchestration. Agile security is a solution designed for continual dynamic adaptation, needed to contend with relentlessly innovative agile adversaries. A social contract, in historical context, is the cultural and/or lawful agreement that binds a community of people around mutual protection. A techno-social contract is equivalent; but exists principally among a community of technical elements in a system or system-of-systems. Download recording from the Library at www.incose.org/enchantment NOTE: This meeting will be recorded
Speaker Bio Rick Dove is CEO of Paradigm Shift International, specializing in agile systems and security research, engineering, and project management; and an adjunct professor at Stevens Institute of Technology teaching graduate courses in agile and self-organizing systems. He chairs the INCOSE working groups for Agile Systems and Systems Engineering, and for Systems Security Engineering. He is an INCOSE Fellow, and author of Response Ability, the Language, Structure, and Culture of the Agile Enterprise.
Todays Presentation Things to think about How can this be applied in your work environment? What did you hear that will influence your thinking? What is your take away from this presentation?
Security Foundations for the Future of Systems Engineering (FuSE) Initiative Enchantment Chapter 11-June-2020 Rick Dove 5 dove@parshift.com, attributed copies permitted
Abstract The Future of Systems Engineering (FuSE) is an INCOSE led multi-organization collaborative initiative that has identified several specific topics to be investigated. Rick leads the FuSE topic on security. The current focus in the security topic within the FuSE initiative is on foundation development general considerations that should shape the breadth and depth of necessary future solution strategies. Two IS20 papers offer two initial foundations. One addresses strategy for security system engineering as a process, the other addresses strategy for engineered system security as an operational product. This presentation reviews the content of these two papers: Contextually Aware Agile Security and Techno-Social Contracts for Security Orchestration. Agile security is a solution designed for continual dynamic adaptation, needed to contend with relentlessly innovative agile adversaries. A social contract, in historical context, is the cultural and/or lawful agreement that binds a community of people around mutual protection. A techno-social contract is equivalent; but exists principally among a community of technical elements in a system or system-of-systems. 6 dove@parshift.com, attributed copies permitted
Emerging Challenges The future environment is becoming: More dynamic and nondeterministic Increasingly evolutionary, with an accelerating rate of change Resource constrained driving a need for sustainability Highly interactive among individuals, communities, organizations, and systems There are growing expectations for SE solutions: Increased level of functionality providing more comprehensive solutions Higher order of intelligence and adaptability augmenting human performance Greater level of connectivity and interoperability across and between systems Trust, safety, and security of digital representations Increased inclusivity, growing the scale and scope of solutions Emerging technologies provide opportunities to enhance the practice of SE: Machine Learning Autonomous Physical Systems 3D Printing, Genomics Quantum and Nano Technology Biomimicry Complexity Science Systems Sciences Data Science (Big Data) Smart Everything Connected Everything (IoT) Artificial Intelligence Cybersecurity Slide Credit: Bill Miller 3/11/20 7 7 dove@parshift.com, attributed copies permitted
Charter Purpose: Evolve the practice, instruction and perception of SE to: 1) Position SE to leverage new technologies in collaboration with allied fields 2) Enhance SE s ability to solve the emerging challenges 3) Promote SE as essential for achieving success and delivering value Goal: Create a road map that drives the evolution of SE to: 1) beincreasingly adaptable, evolvable and fit for purpose 2) account for human abilities & needs as an integral system element and their interactions with a system 3) be more responsive in resolving increasingly challenging societal needs 4) realize and enhance Systems Engineering Vision 2025 and other visionary inputs Scope: Identify the needs, priorities and means for transforming SE including: 1) underlying foundations, systems theory and principles 2) people, methods, tools, processes, education and training 3) the future social and ethical duties, contributions, and responsibilities of future systems engineers Slide Credit: Bill Miller 3/11/20 8 8 dove@parshift.com, attributed copies permitted
Intended Outcomes of FuSE The SE community is focused on realising the Systems Engineering Vision 2025 and beyond The SE community is aligned to the common goals of the FuSE road map Our road map is the point of differentiation for the future of SE Our road map forms the focal point for SE transformational activities INCOSE is positioned to monitor progress against the road map and adapts it to the emerging needs of the SE community Slide Credit: Bill Miller 3/11/20 9 9 dove@parshift.com, attributed copies permitted
FuSE Collaborative Community FuSE Road Map 10 dove@parshift.com, attributed copies permitted
Project: Systems Security in the Future of Systems Engineering Initial Team Members: Rick Dove (INCOSE), SSE working group chair, FuSE Sec topic lead Keith Willett (INCOSE), SSE working group cochair, FuSE Agile SE topic lead Tom McDermott (SERC), Deputy Director and CTO Holly Dunlap (NDIA), SSE Committee chair Corry Oker (NDIA), SSE Committee chair Delia Pembrey MacNamara (ISSS), President Shankar Sankaran (ISSS), Past President Activities So Far: IEEE/INCOSE/NDIA Security Symposium 2020 Paper: Contextually Aware Agile-Security in the Future of Systems Engineering (Dove, Willett) INCOSE IS 2020 Papers: Contextually Aware Agile-Security in the Future of Systems Engineering (Dove, Willett) Techno-Social Contracts for Security Orchestration in the Future of Systems Engineering (Dove, Willett) Toward Architecting the Future of System Security (Willett) Team Bi-Weekly Workshops Developing a roadmap of foundation concepts 11 11 dove@parshift.com, attributed copies permitted
FuSE System Security Charter v200408 Owner: Rick Dove Initial Team: Rick Dove, Keith Willett (INCOSE), Tom McDermott (SERC), Holly Dunlap, Corey Ocker (NDIA), Delia Pembrey MacNamara, Shankar Sankaran (ISSS). Title: Systems Security in the Future of Systems Engineering (a FuSE initiative topic project) What will good look like when we use FuSE to deliver systems? 1.Security Engineers will be active members of the Systems Engineering team. 2.Security will be rapidly reconfigurable, augmentable, and composable. 3.System and component behavior will be monitored for anomalous operation. 4.Modeling will be used to predict variations and prepare contingent courses of action. 5.Security will support rather than impede personal and organizational productivity. 6.System components will be self protective. What is stopping us from doing this now? 1. SE relates to SecE as an independent specialty practice. 2. Security is viewed as a non-functional cost. 3. Security standards compliance is considered sufficient. 4. Actionable research is in early stages. 5. SE contracts and projects detail features and requirements up front rather than desired capabilities that allow innovative solutions. What will good look like in 2023-2025? 1.Security Engineering will have full involvement on SE-team. 2.Rapid security reconfiguration and augmentation will have some effective working patterns in practice as an early base line. Action Plan 1. IS20 initial foundation papers: Techno-Social Contracts for Security Orchestration. Contextually Aware Agile Security. Architecting the Future of System Security. 2. Ongoing: Recruit additional team members. 3. Mid 2020: Periodic web workshops in process identifying additional foundation areas. 4. Late 2020: Addition foundation papers in process What will good look like by end of 2020? 1.Multi-organization collaboration will be active. 2.Initially needed foundation material (TRL-1) for FuSE Security identified. 3.Projects to develop and publish some of the needed foundation material (TRL-1 and -2) active. 12 dove@parshift.com, attributed copies permitted
No Guessing Needed About the Future The future is already here, it s just not evenly distributed. William Gibson* * Gibson verbally delivers his famous quotation in a 30-Nov-1999 NPR recording. He claims he never wrote it. https://ondemand.npr.org/anon.npr-mp3/npr/totn/1999/11/19991130_totn_science_fiction_becoming_science_fact.mp3. See https://quoteinvestigator.com/2012/01/24/future-has-arrived/ for more detail on origin. 13 dove@parshift.com, attributed copies permitted
IS20 Paper: Contextually Aware Agile Security in the Future of Systems Engineering www.parshift.com/s/200718IS20-FuSEAgileSecurity.pdf Rick Dove Keith D. Willett Department of Defense, USA Keith.Willett@incose.org Paradigm Shift International dove@parshift.com 14 dove@parshift.com, attributed copies permitted
Paper Purpose Goal: Provide a succinct foundation for SE to appreciate and incorporate the needs and intents of agile security in the Future of Systems Engineering. Objectives: Characterize the problem space that is shaping the future. Suggest considerations for strategies compatible with the problem space. 15 dove@parshift.com, attributed copies permitted
Method for Deriving General Strategies Needs General Sys Eng CURVE Profile Provides Structure Security Sys Eng CURVE Profile Security Sys Eng General Strategies Intents General Sys Eng Response Strategies Minor Rewording Security Sys Eng Response Strategies 16 dove@parshift.com, attributed copies permitted
Framework for Characterizing an Agile Problem Space (background for the record, doesn t need discussion) CURVE Caprice: unanticipated system-environment change (randomness among unknowable possibilities) Uncertainty: kinetic and potential forces present in the system (randomness among known possibilities with unknowable probabilities) Risk: relevance of current system-dynamics understanding (randomness among known possibilities with knowable probabilities) Variation: temporal excursions on existing behavior attractor (randomness among knowable variables and knowable variance ranges) Evolution: experimentation and natural selection at work (relatively gradual successive developments) 17 dove@parshift.com, attributed copies permitted
FuSE General SE CURVE FuSE System Security CURVE Caprice 1. Survivability (i.e., current order compatibility) 2. Occurrence and nature of emergent behavior 3. Game-changing technologies 4. Availability of symbiotic social relationships C1. Innovative attack and response methods C2. Emergent cascades and complexity effects C3. Artificial intelligence and quantum technologies C4. Collaborative symbiosis Uncertainty U1. Cost vs. value evaluations U2. Operational physical relationships U3. Operational social relationships Risk R1. Design and execution R2. Addressing adversity effectively R3. Knowledge assimilation Variation V1. Attack and response criticality V2. Peer and community behavior V3. Adequacy of incident response capability Evolution E1. External SoS E2. Internal SoS E3. Growing attack community (skills and scope) E4. Increasing technical innovation E5. Increasing attack value E6. Increasing collaborative connectivity 1. Relevance (i.e., appropriate to current desires) 2. Cohesion in systems and SoSs 3. Integrity and symbiosis of social relationships 1. Viability (i.e., capable of working successfully) 2. Cohesion among constituent parts 3. Inadequate recall of lessons learned 1. Operational environments 2. Social compatibility 3. Human resource loading 1. More operating environment complexity 2. More SoI complexity 3. Shorter SoI static viability 4. New technology options 5. New malevolent threats to viability 6. Greater social involvement 18 dove@parshift.com, attributed copies permitted
Response Situation Analysis (RSA) Need: Understand necessary response requirements to address the environment CURVE. Intent: Profile response needs that address the CURVE in 4 Proactive and 4 Reactive response domains as guidance for developing necessary strategies. Note: RSA establishes the why of strategy needs, so the how (which can be done many ways) has a clear intended goal. 19 dove@parshift.com, attributed copies permitted
RSA Strategy Framework (background for the record, doesn t need discussion) Proactive strategies are triggered by an opportunity of choice: Creation: What artifacts/data/knowledge can be created or eliminated during operational activity? Improvement: What performance characteristics can be improved during operational life cycle? Migration: What likely events can be anticipated that would require an infrastructure change? Modification: What resource changes can be anticipated to augment operational capability? Reactive strategies are triggered by a threat of no choice. Correction: What will impair/obstruct agility that will need systemic detection and response? Variation: What variables critical to performance will need accommodation? Expansion: What will need elastic-capacity to accommodate possible range in performance capability? Reconfiguration: What resource relationship configurations will need changed during operation? 20 dove@parshift.com, attributed copies permitted
Proactive Strategies Addressing CURVE (strategy needs traced to CURVE detail discussed in the paper) Need CURVE Intent Creation/Elimination (of artifacts, data, knowledge): Awareness of opportunity and threat Response actions and options Assimilated memory Response action decisions Improvement (of performance): Awareness of impediments during engineering Memory in culture, actions/options, ConOpsCon Action and option effectiveness Migration (of infrastructure): New fundamentally-different types of opportunities New fundamentally-different types of threats Modification (of capability) Actions and options appropriate for needs Personnel appropriate for needs Processes appropriate for needs All S-CURVE elements C1, C4, R1 C1, R3, V3, E1 C1, V1, E4 C1, C4, U3, R1 R3 C1, V3 E1, E2, E4, E6 E3, E4, E5, E6 C1, C4, R1 R1, U3 C4, U3, R3, V3 21 dove@parshift.com, attributed copies permitted
Proactive Strategies to Consider Creation/Elimination Consider a participating role for security engineering on the systems engineering team and means and instrumentation to monitor engineering performance. Consider tasks and responsibilities for developing/evolving a knowledge base of possible collaborative resources and techniques. Consider tasks and responsibilities for memory assimilation with shared stories to enculturate and document in ConOps and OpsCon, and in reusable response methods and attack analysis techniques. Consider building and maintaining quick-use decision-making trees and/or AI capability to automate or human-assist engineering decision making. Improvement Consider a collaborative role for security engineering on the systems engineering team. Consider tasks and responsibilities for indoctrinating new people appropriately before their need to perform. Consider a participating role for knowledgeable security engineers on the systems engineering team. Migration Consider an agile architecture for security development processes and for security systems that enables affordable and timely infrastructure change; ad hoc briefings to policy makers as evolving opportunities emerge; designated internal or subcontracted responsibilities for monitoring evolution in all opportunity categories; instrumented monitoring of system operation during test and during delivered usage for unexpected emergent security-relevant behavior; early experimental evaluations of promising technologies; distributed remote teaming. Modification Consider an agile architecture that enables the addition of new collaborators, new action options, and the modification of existing action options in minimal time and no side effects; maintain a stable of potential SME collaborators and know the real-time availability of current collaborators. Consider reviewing staff knowledge, experience, and capabilities in anticipation of evolving needs; maintaining knowledge of means to augment skills quickly; monitor degree and breadth of assimilated knowledge. Consider designated responsibilities for timely modification of ConOpsCon documentation, and full team indoctrination of changes in both external and internal collaborative partners, knowledge assimilation strategies, and adequacy of incident response strategies. 22 dove@parshift.com, attributed copies permitted
Reactive Strategies Addressing CURVE (strategy needs traced to CURVE detail discussed in the paper) Need CURVE Intent Correction (of operational problems): Insufficient awareness Ineffective actions Wrong decisions Variation (of operational reality): Effectiveness of actions and options Effectiveness of evaluations Expansion/Contraction (of capacity): Capacity for necessary simultaneous activities Reconfiguration (of resource relationships): Reusable actions Participants involved in activities C1, C2, V2, V3 C1, R2, V3 C4, U1, V1 All S-CURVE elements All S-CURVE elements C1, C4, R1 All-S-CURVE Elements All S-CURVE elements 23 dove@parshift.com, attributed copies permitted
Reactive Strategies to Consider Correction Consider proactive monitoring and systemic means for detecting these situations. Consider real-time collaborative team evaluations; an agile architecture for security design time processes and for security systems that enables rapid experimentation and recovery from ineffective approaches. Consider continuous monitoring and evaluation of collaborative partners for cost benefit ratio; reevaluating security cost vs. value decisions frequently; an open-ended ability for continuous evaluation of criticality as the environment evolves. Variation Consider procedures for attentive updating of actions and options with lessons learned after every event. Consider having uninvolved third-party review and adjudication of evaluations, as ineffective evaluations can haunt. Expansion/Contraction Consider daily (or as needed) responsible decision-maker involvement in reevaluating or affirming the immediate activity priorities; scalable resource availability. Reconfiguration Consider avoiding or minimizing sequence dependency in action design. Consider satisfying both need and value in being able to reconfigure the personnel involved in activities for including newly needed skills and for bench depth. 24 dove@parshift.com, attributed copies permitted
Key Takeaways Agile security is necessary to contend with agile attack. Knowledge of the problem space drives strategy for the solution space. Vigilant awareness of internal and external process and product environments is essential. Systemic monitoring of behavior and performance of both security process and product can identify problems early. Systems engineering benefits from integrated security engineering. System security is a functional requirement. Security engineering is continuous throughout the system life cycle. Knowledge relevant to all stakeholders needs effective assimilation. Reusability of modular security actions should be facilitated. Social interaction and collaboration effectiveness needs strategy attention. Adequacy of incident response is constrained and enabled by the adequacy of continuous engineering. 25 dove@parshift.com, attributed copies permitted
References Dove, R., K.D. Willett. 2020. Contextually Aware Agile Security in the Future of Systems Engineering. International Council on Systems Engineering, INCOSE International Symposium, Cape Town, South Africa, July 18-23. www.parshift.com/s/200718IS20-FuSEAgileSecurity.pdf Dove, R., W. Schindel. 2019. Agile Systems Engineering Life Cycle Model for Mixed Discipline Engineering. Proceedings International Symposium. International Council on Systems Engineering. Orlando, FL, July 20-25. www.parshift.com/s/ASELCM-05Findings.pdf INCOSE. nd. The Future of Systems Engineering. An INCOSE initiative with charter at: www.incose.org/about-systems-engineering/fuse accessed 2/28/2020 Willett, K.D. 2020. Systems Engineering the Conditions of the Possibility (Towards Systems Engineering v2.0). International Council on Systems Engineering, International Symposium, Cape Town, South Africa. July 18-23. www.parshift.com/s/2020Willett-SystemsEngineeringTheConditionsOfThePossibility.pdf 26 dove@parshift.com, attributed copies permitted
IS20 Paper: Techno-Social Contracts for Security Orchestration in the Future of Systems Engineering www.parshift.com/s/200718IS20-FuSETechnoSocialContracts.pdf Rick Dove Keith D. Willett Department of Defense, USA Keith.Willett@incose.org Paradigm Shift International dove@parshift.com 27 dove@parshift.com, attributed copies permitted
Paper Purpose Goal: Outline an innovative strategic concept that addresses security need. Need: Quick detection and mitigation of innovative attacks. Intent: Behavior-based threat detection with immediate response, distributed among a team of collaborating and cooperating system components. Objectives: Introduce the concept of human social contracts for mutual protection. Extend the concept to techno-social contracts Review some prior techno-social work. Suggest techno-social security strategies based on familiar patterns. 28 dove@parshift.com, attributed copies permitted
Social Contract In 1762 the French philosopher Jean-Jacque Rousseau wrote On the Social Contract. The book deals with the concept of a social contract among members of a society to counter the deleterious effects of individual self-centered behavior. A social contract is an implicit cultural agreement or contract among members of a society that essentially binds the members into a community that exists for mutual preservation. A social contract may be cultural (emergent from behavior) and/or authoritative (laws set by a governing body). 29 dove@parshift.com, attributed copies permitted
A Conceptual Example Peyton Quinn resides in a gated community that has a social contract for mutual protection. A bit like neighborhood watch, but a lot more. The gate didn t stop an intruder, evidenced by a mess made around the place where a neighbor s keys were kept. Payton s conscience gets the upper hand and notifies the community association as well as the neighbors. The association responds shortly thereafter with a community broadcast that says a few residents are noticing security problems and recommends all go on high alert. Peyton double locks the doors, increases surveillance by cutting back on editing some videos as planned, and calls the cleaners to fix the mess that the intruder made. Peyton Quinn is a blazing fast hardware/software techno-social device pay a ton for your edits, quintuple what software would have cost. 30 dove@parshift.com, attributed copies permitted
Some Prior Thought DHS white paper, section on Attributes of Healthy Participants spoke specifically to eleven attributes of healthy cyber devices (DHS 2011, pp. 24-25). Self Aware. User Aware. Environmentally Aware. Smart. Dynamic. Collaborative. Autonomously Reacting. Heterogeneous. Diversifying. Resilient. Trustworthy. Brian Duffy (Duffy 2004), suggests social functionality manifests from four social attributes possessed by technical entities: Identity: When social interaction exists, each element of the social group must be able to be differentiated from others. [They] require a sense of themselves as distinct and autonomous individuals obliged to interact with others in a social environment. Character: The combination of perceived features or qualities that distinguishes one entity from another in that entity s social envelope. Stereotypical representation: perceived identity of another should be strongly founded on some fundamental set of internal and external attributes that describe [entities]. This is achieved by the use of stereotypical representations, or stereotypes. A fixed subset of internal and external attributes comprises the stereotype with which each [entity] is associated. Role: The characteristic and expected behaviour of an individual with regard to a particular social goal or task within a social collective of individuals. 31 dove@parshift.com, attributed copies permitted
Strategies to Consider1/2 Self Protection. When a techno-social contract is present there is an obligation for participants to perform on that contract, seemingly to the benefit of others; but in reality it is a contract entered into for purposes of optimizing self-protection. Self Aware. Techno-social capabilities rely on self awareness, as socialness is a relationship between self and others. Minimally, awareness of the functional exchanges that establish interactive relationships with other participants that warrant attentive interest. Maximally, perhaps, as follows. Self Behavior Judgement. This approach doesn t rely on the sustained integrity of others to make that judgement, distributes watchfulness diversely and widely, and is independent of potentially aberrant performance mechanisms, regardless of cause. Self Behavior Mitigation. A self judgement may have different levels of confidence. Some may be sufficient for unilateral immediate action. A less confident judgement may call for consensus among peer participants or appeal to a higher authoritythat functions as community overwatch. Adaptable Attention Priorities. Maslow s [human] hierarchy of needs contends that fuel and security are the first two of six, sustained existence needs taking precedence over higher level purpose needs. This is seen in robotic mobile devices that interrupt their tasks to seek an electrical outlet, and in devices and operating systems with a variety of anti-tamper detection and prevention capabilities. 32 dove@parshift.com, attributed copies permitted
Strategies to Consider2/2 Peer Behavior Judgement. A techno-social participant interacts with other participants through communication and observed behavior, can learn or be told what to expect as normal, and vet for normalcy before, during, or after acting upon it. Trust but verify might be a polite operable phrase; but at core that phrase is fundamentally about the need for distrust. Peer Behavior Mitigation. Nodes in secure ad hoc networks will take a vote on questionable communication behaviors experienced with specific nodes and take collective action to refuse further interaction with a node that gets bad vote results. Peer Collaboration. Vehicular communication systems are computer networks in which vehicles and roadside units are the communicating nodes, providing each other with information, such as safety warnings and traffic information. Diversity. All members don t have to participate, and all participants shouldn t be looking for exactly the same list of things. Spread the socially attentive load. Heterogeneous Awareness. Technical participants that can receive signals about the general state of alarm or calm in other participants not in direct peer communication can be used to ratchet the relative device attention level between self protective activity and purpose. 33 dove@parshift.com, attributed copies permitted
Proposed Technical Hierarchy of Needs Self-actualization Provide value-delivery; seek opportunity; seek gain; transcendence Reputation Quality reputation; dependable Belonging Intra-enclave and inter-enclave [trusted] relationships Safety and security Personal security, contribution, access to resources, health, survivability Physiological needs Power, space, cooling, shelter from elements Security as a viability requirement to enable the achievement of purpose. 34 dove@parshift.com, attributed copies permitted
Summary This paper s thesis is that mutual protection behavior among technical system components is both beneficial and possible. Beneficial in that collaboration, cooperation, and teaming among system elements during system operation offers novel strategy for quick detection and mitigation of innovative security threats. Possible in that human and animal communities employ effectively demonstrated approaches, and some work in non-human socially behaving system aggregations already exists. 35 dove@parshift.com, attributed copies permitted
References DHS. 2011. Enabling Distributed Security in Cyberspace Building a Healthy and Resilient Cyber Ecosystem with Automated Collective Action. 23 March. www.dhs.gov/xlibrary/assets/nppd-cyber-ecosystem-white-paper-03-23-2011.pdf Dove, R., K.D. Willett. 2020. Techno-Social Contracts for Security Orchestration in the Future of Systems Engineering. International Council on Systems Engineering, International Symposium, Cape Town, South Africa. July 18-23. www.parshift.com/s/200718IS20-FuSETechnoSocialContracts.pdf Duffy, B. 2004. Robots Social Embodiment in Autonomous Mobile Robotics. International Journal of Advanced Robotic Systems, Volume 1, Number 3, pp. 155-170. https://journals.sagepub.com/doi/pdf/10.5772/5632 INCOSE. nd. The Future of Systems Engineering. An INCOSE initiative with charter at: www.incose.org/about-systems-engineering/fuse accessed 2/28/2020 Rousseau, J-J. 1762. On the Social Contract. English translation by Maurice Cranston, Penguin Publishing Group, 28-June-1968. SparkNotes. nd. The Social Contract. Barnes & Noble. www.sparknotes.com/philosophy/socialcontract/characters 36 dove@parshift.com, attributed copies permitted
Current Foundation Concept Topics Being Considered (to be consolidated by end of June 2020) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Product line security architecture. 11. Loss driven attribute integration (across security, safety, relability, et al.). 12. Social contract among those involved in SE and SecE. 13. Security value measurement. 14. Discerning weak signals and normal behavior patterns. 15. Critical Systems Thinking applied to security. 16. Operational monitoring. Competencies needed of security engineers that would be part of the systems engineering team. AI employment in system security. Detecting and countering AI being used to probe or attack. The role for modeling. Agile security. Security that supports rather than impedes personal and organizational productivity. Capability and intent based security acquisition wording. Cyber-relevant threat response. Techno-social contract design, management, and operation mechanisms. 37 dove@parshift.com, attributed copies permitted
Foundation Concept Topic Criteria Concept can provide new and useful value to the state of practice. Concept has relevance to systems engineering considerations. Concept value proposition can be articulated in SE terms. Concept is supported by referenceable knowledge base. Concept doesn t yet have sufficient published exposure for SE consideration. Concept could be prototyped now. Concept has sufficient ecosystem/infrastructure in place to support application. Purpose of foundation concept papers is to inspire and instigate pursuit in the systems engineering community, which includes security engineers with systems-level interests. 38 dove@parshift.com, attributed copies permitted
FuSE Security Project Next Steps Consolidate and develop an overview paper on the foundation concepts (in process) Recruit people to develop and write specific concept papers To be a part of this activity contact Rick at dove@parshift.com 39 dove@parshift.com, attributed copies permitted
Todays Presentation Things to think about How can this be applied in your work environment? What did you hear that will influence your thinking? What is your take away from this presentation?
Please The link for the online survey for this meeting is www.surveymonkey.com/r/2020_06_MeetingEval Look in GlobalMeet chat box for cut & paste link Slide presentation can be downloaded now/anytime from: The library page at: www.incose.org/enchantment
