SlideShare a Scribd company logo
2
Most read
3
Most read
8
Most read
SECURITY MANAGEMENT
CONCEPTS AND PRINCIPLES
SECURITY & RISK MANAGEMENT
MODULE 5
DIVYA TIWARI
MEIT
TERNA ENGINEERING COLLEGE
INTRODUCTION
• Security management concepts and principles are inherent elements in a security policy and
solution deployment.
• They define the basic parameters needed for a secure environment.
• They also define the goals and objectives that both policy designers and system
implementers must achieve to create a secure solution. It is important for real-world
security professionals.
• The primary goals and objectives of security are contained within the CIA Triad, which is
the name given to the three primary security principles:
1. Confidentiality
2. Integrity
3. Availability
• A complete security solution should adequately address each of these tenets.
• Vulnerabilities and risks are also evaluated based on the threat they pose against one or
more of the CIA Triad principles.
• Thus, it is a good idea to be familiar with these principles and use them as guidelines for
judging all things related to security.
MEASURING ROI ON SECURITY
• Future security system improvements showing the return on investment (ROI) is one of the
most important tools you must show the need for system improvements.
• The return on investment calculation will compare the net benefits of a project to total
project costs.
• The benefits to a new system can be obvious- the improved safety for building occupants
and improved security for company assets.
• To prepare a ROI case for your security project the first step is to collect data to show the
costs and benefits for the proposed system.
• What are the costs of the project?
• The cost of not doing the project. What happens in the organization if you do not
implement the upgrades?
• After collecting all of the costs it is time to focus on the benefits. Benefits of a security
system upgrade can be direct or indirect.
• Once you have compiled all the cost and benefit information it is time to calculate the
return on investment.
ROI = (
𝑩𝒆𝒏𝒆𝒇𝒊𝒕 𝒂𝒇𝒕𝒆𝒓 𝑺𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕 −𝑪𝒐𝒔𝒕 𝒐𝒇 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕
𝑪𝒐𝒔𝒕 𝒐𝒇 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕
) x 100
SECURITY PATCH MANAGEMENT
• Security patches protect the security of devices and the data on them by applying the latest
updates that respond to the latest threats.
• In software engineering a patch refers to small adjustments to the code of software.
• Patch updates one component of the software to fix a bug or error discovered after product
release.
• Security patches address vulnerabilities in the software cybercriminals might use to gain
unauthorized access to device and data.
• Security patches for the operating system (OS) of device like Windows, iOS, Android are
crucial because an OS vulnerability can have far-reaching implications.
• For individuals and their devices, effective patch management can be as simple as turning
on automatic updates.
• Google and Apple, for example, make it easy to have smartphone manage the work of
keeping the OS and all of your apps patched to the most recent version.
• To check Android device’s security patch level, Google offers an easy online tool.
• For organizations, patch management they need to oversee a wide range of equipment,
often in different locations.
• A patch that requires time to install may also interrupt the functioning of the device, so it’s
vital to plan the timing of patches around the schedules of the people using the device.
• For systems that need to operate 24/7, patching is not an easy process.
Importance of Patch Management
1.Reduce exposure to cyberattacks
1.Avoid lost productivity
1.Protect your data
1.Protect customer data
1.Protect others on your network
PURPOSE OF INFORMATION SECURITY
MANAGEMENT
• The purpose of the information security management process is to align IT security with
business security and ensure that the confidentiality, integrity and availability of the
organization’s assets, information, data and IT services always matches the agreed needs of
the business.
• The Objectives of Information security management are:
1. Protect the interests of those relying on information.
2. Protect the systems and communications that deliver the information.
BUILDING BLOCKS OF INFORMATION
SECURITY
• Encryption: Modification of data for security reasons prior to their transmissions so that it
is not comprehensible without the decoding method.
• Cipher: Cryptographic transformation that operates on characters or bits of data.
• Cryptanalysis: Methods to break the cipher so that encrypted message can be read.
• Electronic Signature: Process that operates on a message to assure message source
authenticity, integrity and non-repudiation.
• Non-Repudiation: Methods by which the transmitted data is tagged with sender’s identity
as a proof so neither can deny the transmission.
• Steganography: Method of hiding the existence of data. The bit map images are regularly
used to transmit hidden messages.
• Identification: It is a method by which a user claims his identity to a system.
• Authentication: It is the method by which a system verifies the identity of a user or
another system.
• Accountability: It is the method by which a system tracks the actions performed by a user
or a process.
• Authorization: It is a method by which a system grants certain permissions to a user.
• Privacy: It is protection on individual data and information.
OVERVIEW OF SSE CMM
• The Systems Security Engineering Capability Maturity Model (SSE-CMM) describes
the essential characteristics of an organization’s security engineering process that must
exist to ensure good security engineering.
• The model is a standard metric for security engineering practices covering:
1. The entire life cycle, including development, operation, maintenance, and
decommissioning activities.
2. The whole organization, including management, organizational, and engineering
activities.
3. Concurrent interactions with other disciplines, such as system, software, hardware,
human factors, and test engineering; system management, operation, and
maintenance.
4. Interactions with other organizations, including acquisition, system management,
certification, accreditation, and evaluation.
• The objective of the SSE-CMM Project is to advance security engineering as a defined,
mature, and measurable discipline.
• The SSE-CMM model and appraisal methods are being developed to enable:
1. Focused investments in security engineering tools, training, process definition,
management practices, and improvements by engineering groups.
2. Capability-based assurance, that is, trustworthiness based on confidence in the
maturity of an engineering group’s security practices and processes.
3. Selection of appropriately qualified providers of security engineering through
differentiating bidders by capability levels and associated programmatic risks.
• The scope of the SSE-CMM encompasses the following:
1. The SSE-CMM addresses security engineering activities that span the entire trusted
product or secure system life cycle, including concept definition, requirements analysis,
design, development, integration, installation, operations, maintenance, and
decommissioning.
2. The SSE-CMM applies to secure product developers, secure system developers and
integrators, and organizations that provide security services and security engineering.
3. The SSE-CMM applies to all types and sizes of security engineering organizations, such
as commercial, government, and academic.
Benefits of using
SSE-CMM
To Engineering Organizations To Acquiring Organizations To Evaluation Organizations
SSE-CMM RELATIONSHIP TO OTHER
INITIATIVES
CAPABILITY LEVELS
• Capability Level 1 – Performed Informally
• Capability Level 2 – Planned and Tracked
• Capability Level 3 – Well Defined
• Capability Level 4 – Quantitatively Controlled
• Capability Level 5 – Continuously Improving
SECURITY ENGINEERING PROCESS
OVERVIEW
Security Engineering Process has three main areas
Risk
security risk process involves threats, vulnerabilities and impact
Engineering
security is an integral part of the overall engineering process
Assurance
Assurance process builds an argument establishing confidence
CONFIGURATION MANAGEMENT
• An information system infrastructure is a complex and evolving system.
• Changes to the system affect its ability to effectively enforce the security policies and
therefore protect the organization’s assets.
• The process of managing the changes to the system and its components is referred to as
configuration management.
• Configuration management is the process of identifying configuration items, controlling
their storage, controlling change to configuration items, and reporting on their status.
1. Configuration Items—Configuration items (CIs) are unique work products that are
individually controlled, tracked, and reported on.
2. CI Protection—Configuration items must be protected from unauthorized changes.
Without protection of the CIs, a configuration management system cannot function.
3. Change Control—There must exist a process by which changes to configuration items
are reviewed, approved, and controlled.
4. Status Reporting—Configuration management systems must be able to report the status
of any configuration item and its history of changes. Moreover, the reporting feature
must be capable of generating a version of the system based on the correct version of
each of the configuration items.
CONFIGURATION MANAGEMENT
FRAMEWORK
MU Exam Questions
May 2017
• Give a brief overview of the SSE-CMM maturity model. 10 marks
Dec 2017
• Explain role of configuration management in security of an organization. Give the
configuration management framework. 10 marks
May 2018
• What is security engineering? Give a brief overview of the SSE-CMM model. 10 marks
• Discuss role of Configuration Management in the security of an organization. 10 marks
Dec 2018
• Discuss role of CM in the security of an organization. 10 marks
May 2019
• Explain role of configuration management in security of an organization. Give the
configuration management framework. 10 marks
Security management concepts and principles

More Related Content

What's hot (20)

PPTX
Cybersecurity Attack Vectors: How to Protect Your Organization
TriCorps Technologies
 
PPT
information security management
Gurpreetkaur838
 
PPTX
Information security
avinashbalakrishnan2
 
PPSX
8 Access Control
Alfred Ouyang
 
PPTX
Logging, monitoring and auditing
Piyush Jain
 
PPTX
Cybersecurity Audit
EC-Council
 
PPTX
Security risk management
Prachi Gulihar
 
PPTX
Types of cyber attacks
krishh sivakrishna
 
PPTX
Information Security Risk Management
Nikhil Soni
 
PPTX
Network security
Estiak Khan
 
PPTX
System security
sommerville-videos
 
PPTX
Information security management system
Arani Srinivasan
 
PPTX
Network Security
Manoj Singh
 
PPTX
Introduction to security
Mostafa Elgamala
 
PDF
Secure software design
Ashis Kumar Chanda
 
PPTX
Network security
hajra azam
 
PPTX
Protection and security
mbadhi
 
PPTX
Domain 1 - Security and Risk Management
Maganathin Veeraragaloo
 
PPTX
Access Controls
primeteacher32
 
PPTX
Network security
Madhumithah Ilango
 
Cybersecurity Attack Vectors: How to Protect Your Organization
TriCorps Technologies
 
information security management
Gurpreetkaur838
 
Information security
avinashbalakrishnan2
 
8 Access Control
Alfred Ouyang
 
Logging, monitoring and auditing
Piyush Jain
 
Cybersecurity Audit
EC-Council
 
Security risk management
Prachi Gulihar
 
Types of cyber attacks
krishh sivakrishna
 
Information Security Risk Management
Nikhil Soni
 
Network security
Estiak Khan
 
System security
sommerville-videos
 
Information security management system
Arani Srinivasan
 
Network Security
Manoj Singh
 
Introduction to security
Mostafa Elgamala
 
Secure software design
Ashis Kumar Chanda
 
Network security
hajra azam
 
Protection and security
mbadhi
 
Domain 1 - Security and Risk Management
Maganathin Veeraragaloo
 
Access Controls
primeteacher32
 
Network security
Madhumithah Ilango
 

Similar to Security management concepts and principles (20)

PDF
CISSP Preview - For the next generation of Security Leaders
NUS-ISS
 
PDF
Andrew kozma - security 101 - atlseccon2011
Atlantic Security Conference
 
PPT
Secure Software Development Models and Methods integrated with CMMI.ppt
Neha Sharma
 
PDF
Chapter 3 - Security Management Concepts & Principles.pdf
aishahmrawy
 
PDF
1-Computer_Security_EENG-524_Lecture-01.pdf
Umarr Alie Sesay
 
PPT
Unit 4 standards.ppt
ClashWithGROUDON
 
PDF
Unit 1&2.pdf
Ndheh
 
DOCX
mangement MEASURE OF CYBER SECURITY MANAGMNET
sachinpd1008
 
PPTX
crisc_wk_5.pptx
dotco
 
DOCX
Project Quality-SIPOCSelect a process of your choice and creat.docx
wkyra78
 
PDF
1. Security and Risk Management
Sam Bowne
 
PDF
CIA-Triad-Presentation.pdf
BabyBoy55
 
PDF
Security Level Analysis of Academic Information Systems Based on Standard ISO...
IJCSIS Research Publications
 
ODP
CISSP Week 12
jemtallon
 
PDF
Mergers and Acquisition Security - Areas of Interest
Matthew Rosenquist
 
PPT
chapter 1. Introduction to Information Security
elmuhammadmuhammad
 
PDF
(eBook PDF) Information Security: Principles and Practices 2nd Edition
rrnohojhxx852
 
PPTX
Information Systems.pptx
KnownId
 
DOCX
11What is Security 1.1 Introduction The central role of co.docx
moggdede
 
PPT
Network Security, Change Control, Outsourcing
Nicholas Davis
 
CISSP Preview - For the next generation of Security Leaders
NUS-ISS
 
Andrew kozma - security 101 - atlseccon2011
Atlantic Security Conference
 
Secure Software Development Models and Methods integrated with CMMI.ppt
Neha Sharma
 
Chapter 3 - Security Management Concepts & Principles.pdf
aishahmrawy
 
1-Computer_Security_EENG-524_Lecture-01.pdf
Umarr Alie Sesay
 
Unit 4 standards.ppt
ClashWithGROUDON
 
Unit 1&2.pdf
Ndheh
 
mangement MEASURE OF CYBER SECURITY MANAGMNET
sachinpd1008
 
crisc_wk_5.pptx
dotco
 
Project Quality-SIPOCSelect a process of your choice and creat.docx
wkyra78
 
1. Security and Risk Management
Sam Bowne
 
CIA-Triad-Presentation.pdf
BabyBoy55
 
Security Level Analysis of Academic Information Systems Based on Standard ISO...
IJCSIS Research Publications
 
CISSP Week 12
jemtallon
 
Mergers and Acquisition Security - Areas of Interest
Matthew Rosenquist
 
chapter 1. Introduction to Information Security
elmuhammadmuhammad
 
(eBook PDF) Information Security: Principles and Practices 2nd Edition
rrnohojhxx852
 
Information Systems.pptx
KnownId
 
11What is Security 1.1 Introduction The central role of co.docx
moggdede
 
Network Security, Change Control, Outsourcing
Nicholas Davis
 
Ad

More from Divya Tiwari (13)

PPTX
Digital stick by Divya & Kanti
Divya Tiwari
 
PPTX
Predicting house price
Divya Tiwari
 
PPTX
Testing strategies -2
Divya Tiwari
 
PPTX
Testing strategies part -1
Divya Tiwari
 
PPTX
Performance measures
Divya Tiwari
 
PPTX
Programming using MPI and OpenMP
Divya Tiwari
 
PPTX
IoT applications and use cases part-2
Divya Tiwari
 
PPTX
Io t applications and use cases part-1
Divya Tiwari
 
PPTX
Planning for security and security audit process
Divya Tiwari
 
PPTX
Web services
Divya Tiwari
 
PPTX
Responsive web design with html5 and css3
Divya Tiwari
 
PPTX
Mac protocols for ad hoc wireless networks
Divya Tiwari
 
PPTX
Routing protocols for ad hoc wireless networks
Divya Tiwari
 
Digital stick by Divya & Kanti
Divya Tiwari
 
Predicting house price
Divya Tiwari
 
Testing strategies -2
Divya Tiwari
 
Testing strategies part -1
Divya Tiwari
 
Performance measures
Divya Tiwari
 
Programming using MPI and OpenMP
Divya Tiwari
 
IoT applications and use cases part-2
Divya Tiwari
 
Io t applications and use cases part-1
Divya Tiwari
 
Planning for security and security audit process
Divya Tiwari
 
Web services
Divya Tiwari
 
Responsive web design with html5 and css3
Divya Tiwari
 
Mac protocols for ad hoc wireless networks
Divya Tiwari
 
Routing protocols for ad hoc wireless networks
Divya Tiwari
 
Ad

Recently uploaded (20)

PPTX
Arduino Based Gas Leakage Detector Project
CircuitDigest
 
PDF
AI TECHNIQUES FOR IDENTIFYING ALTERATIONS IN THE HUMAN GUT MICROBIOME IN MULT...
vidyalalltv1
 
PDF
Electrical Engineer operation Supervisor
ssaruntatapower143
 
PPTX
Mechanical Design of shell and tube heat exchangers as per ASME Sec VIII Divi...
shahveer210504
 
PPTX
Green Building & Energy Conservation ppt
Sagar Sarangi
 
PDF
Ethics and Trustworthy AI in Healthcare – Governing Sensitive Data, Profiling...
AlqualsaDIResearchGr
 
PDF
Set Relation Function Practice session 24.05.2025.pdf
DrStephenStrange4
 
PPTX
Worm gear strength and wear calculation as per standard VB Bhandari Databook.
shahveer210504
 
PDF
Zilliz Cloud Demo for performance and scale
Zilliz
 
PPTX
Damage of stability of a ship and how its change .pptx
ehamadulhaque
 
PDF
AI TECHNIQUES FOR IDENTIFYING ALTERATIONS IN THE HUMAN GUT MICROBIOME IN MULT...
vidyalalltv1
 
PPTX
artificial intelligence applications in Geomatics
NawrasShatnawi1
 
PPTX
What is Shot Peening | Shot Peening is a Surface Treatment Process
Vibra Finish
 
DOCX
CS-802 (A) BDH Lab manual IPS Academy Indore
thegodhimself05
 
PPTX
Introduction to Design of Machine Elements
PradeepKumarS27
 
PDF
Viol_Alessandro_Presentazione_prelaurea.pdf
dsecqyvhbowrzxshhf
 
PDF
Biomechanics of Gait: Engineering Solutions for Rehabilitation (www.kiu.ac.ug)
publication11
 
PPTX
The Role of Information Technology in Environmental Protectio....pptx
nallamillisriram
 
PDF
Introduction to Productivity and Quality
মোঃ ফুরকান উদ্দিন জুয়েল
 
PPTX
Solar Thermal Energy System Seminar.pptx
Gpc Purapuza
 
Arduino Based Gas Leakage Detector Project
CircuitDigest
 
AI TECHNIQUES FOR IDENTIFYING ALTERATIONS IN THE HUMAN GUT MICROBIOME IN MULT...
vidyalalltv1
 
Electrical Engineer operation Supervisor
ssaruntatapower143
 
Mechanical Design of shell and tube heat exchangers as per ASME Sec VIII Divi...
shahveer210504
 
Green Building & Energy Conservation ppt
Sagar Sarangi
 
Ethics and Trustworthy AI in Healthcare – Governing Sensitive Data, Profiling...
AlqualsaDIResearchGr
 
Set Relation Function Practice session 24.05.2025.pdf
DrStephenStrange4
 
Worm gear strength and wear calculation as per standard VB Bhandari Databook.
shahveer210504
 
Zilliz Cloud Demo for performance and scale
Zilliz
 
Damage of stability of a ship and how its change .pptx
ehamadulhaque
 
AI TECHNIQUES FOR IDENTIFYING ALTERATIONS IN THE HUMAN GUT MICROBIOME IN MULT...
vidyalalltv1
 
artificial intelligence applications in Geomatics
NawrasShatnawi1
 
What is Shot Peening | Shot Peening is a Surface Treatment Process
Vibra Finish
 
CS-802 (A) BDH Lab manual IPS Academy Indore
thegodhimself05
 
Introduction to Design of Machine Elements
PradeepKumarS27
 
Viol_Alessandro_Presentazione_prelaurea.pdf
dsecqyvhbowrzxshhf
 
Biomechanics of Gait: Engineering Solutions for Rehabilitation (www.kiu.ac.ug)
publication11
 
The Role of Information Technology in Environmental Protectio....pptx
nallamillisriram
 
Introduction to Productivity and Quality
মোঃ ফুরকান উদ্দিন জুয়েল
 
Solar Thermal Energy System Seminar.pptx
Gpc Purapuza
 

Security management concepts and principles

  • 1. SECURITY MANAGEMENT CONCEPTS AND PRINCIPLES SECURITY & RISK MANAGEMENT MODULE 5 DIVYA TIWARI MEIT TERNA ENGINEERING COLLEGE
  • 2. INTRODUCTION • Security management concepts and principles are inherent elements in a security policy and solution deployment. • They define the basic parameters needed for a secure environment. • They also define the goals and objectives that both policy designers and system implementers must achieve to create a secure solution. It is important for real-world security professionals. • The primary goals and objectives of security are contained within the CIA Triad, which is the name given to the three primary security principles: 1. Confidentiality 2. Integrity 3. Availability • A complete security solution should adequately address each of these tenets. • Vulnerabilities and risks are also evaluated based on the threat they pose against one or more of the CIA Triad principles. • Thus, it is a good idea to be familiar with these principles and use them as guidelines for judging all things related to security.
  • 3. MEASURING ROI ON SECURITY • Future security system improvements showing the return on investment (ROI) is one of the most important tools you must show the need for system improvements. • The return on investment calculation will compare the net benefits of a project to total project costs. • The benefits to a new system can be obvious- the improved safety for building occupants and improved security for company assets. • To prepare a ROI case for your security project the first step is to collect data to show the costs and benefits for the proposed system. • What are the costs of the project? • The cost of not doing the project. What happens in the organization if you do not implement the upgrades? • After collecting all of the costs it is time to focus on the benefits. Benefits of a security system upgrade can be direct or indirect.
  • 4. • Once you have compiled all the cost and benefit information it is time to calculate the return on investment. ROI = ( 𝑩𝒆𝒏𝒆𝒇𝒊𝒕 𝒂𝒇𝒕𝒆𝒓 𝑺𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕 −𝑪𝒐𝒔𝒕 𝒐𝒇 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕 𝑪𝒐𝒔𝒕 𝒐𝒇 𝑰𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕 ) x 100
  • 5. SECURITY PATCH MANAGEMENT • Security patches protect the security of devices and the data on them by applying the latest updates that respond to the latest threats. • In software engineering a patch refers to small adjustments to the code of software. • Patch updates one component of the software to fix a bug or error discovered after product release. • Security patches address vulnerabilities in the software cybercriminals might use to gain unauthorized access to device and data. • Security patches for the operating system (OS) of device like Windows, iOS, Android are crucial because an OS vulnerability can have far-reaching implications. • For individuals and their devices, effective patch management can be as simple as turning on automatic updates. • Google and Apple, for example, make it easy to have smartphone manage the work of keeping the OS and all of your apps patched to the most recent version.
  • 6. • To check Android device’s security patch level, Google offers an easy online tool. • For organizations, patch management they need to oversee a wide range of equipment, often in different locations. • A patch that requires time to install may also interrupt the functioning of the device, so it’s vital to plan the timing of patches around the schedules of the people using the device. • For systems that need to operate 24/7, patching is not an easy process. Importance of Patch Management 1.Reduce exposure to cyberattacks 1.Avoid lost productivity 1.Protect your data 1.Protect customer data 1.Protect others on your network
  • 7. PURPOSE OF INFORMATION SECURITY MANAGEMENT • The purpose of the information security management process is to align IT security with business security and ensure that the confidentiality, integrity and availability of the organization’s assets, information, data and IT services always matches the agreed needs of the business. • The Objectives of Information security management are: 1. Protect the interests of those relying on information. 2. Protect the systems and communications that deliver the information.
  • 8. BUILDING BLOCKS OF INFORMATION SECURITY • Encryption: Modification of data for security reasons prior to their transmissions so that it is not comprehensible without the decoding method. • Cipher: Cryptographic transformation that operates on characters or bits of data. • Cryptanalysis: Methods to break the cipher so that encrypted message can be read. • Electronic Signature: Process that operates on a message to assure message source authenticity, integrity and non-repudiation. • Non-Repudiation: Methods by which the transmitted data is tagged with sender’s identity as a proof so neither can deny the transmission. • Steganography: Method of hiding the existence of data. The bit map images are regularly used to transmit hidden messages. • Identification: It is a method by which a user claims his identity to a system.
  • 9. • Authentication: It is the method by which a system verifies the identity of a user or another system. • Accountability: It is the method by which a system tracks the actions performed by a user or a process. • Authorization: It is a method by which a system grants certain permissions to a user. • Privacy: It is protection on individual data and information.
  • 10. OVERVIEW OF SSE CMM • The Systems Security Engineering Capability Maturity Model (SSE-CMM) describes the essential characteristics of an organization’s security engineering process that must exist to ensure good security engineering. • The model is a standard metric for security engineering practices covering: 1. The entire life cycle, including development, operation, maintenance, and decommissioning activities. 2. The whole organization, including management, organizational, and engineering activities. 3. Concurrent interactions with other disciplines, such as system, software, hardware, human factors, and test engineering; system management, operation, and maintenance. 4. Interactions with other organizations, including acquisition, system management, certification, accreditation, and evaluation.
  • 11. • The objective of the SSE-CMM Project is to advance security engineering as a defined, mature, and measurable discipline. • The SSE-CMM model and appraisal methods are being developed to enable: 1. Focused investments in security engineering tools, training, process definition, management practices, and improvements by engineering groups. 2. Capability-based assurance, that is, trustworthiness based on confidence in the maturity of an engineering group’s security practices and processes. 3. Selection of appropriately qualified providers of security engineering through differentiating bidders by capability levels and associated programmatic risks. • The scope of the SSE-CMM encompasses the following: 1. The SSE-CMM addresses security engineering activities that span the entire trusted product or secure system life cycle, including concept definition, requirements analysis, design, development, integration, installation, operations, maintenance, and decommissioning. 2. The SSE-CMM applies to secure product developers, secure system developers and integrators, and organizations that provide security services and security engineering.
  • 12. 3. The SSE-CMM applies to all types and sizes of security engineering organizations, such as commercial, government, and academic. Benefits of using SSE-CMM To Engineering Organizations To Acquiring Organizations To Evaluation Organizations
  • 13. SSE-CMM RELATIONSHIP TO OTHER INITIATIVES
  • 14. CAPABILITY LEVELS • Capability Level 1 – Performed Informally • Capability Level 2 – Planned and Tracked • Capability Level 3 – Well Defined • Capability Level 4 – Quantitatively Controlled • Capability Level 5 – Continuously Improving
  • 15. SECURITY ENGINEERING PROCESS OVERVIEW Security Engineering Process has three main areas
  • 16. Risk security risk process involves threats, vulnerabilities and impact
  • 17. Engineering security is an integral part of the overall engineering process
  • 18. Assurance Assurance process builds an argument establishing confidence
  • 19. CONFIGURATION MANAGEMENT • An information system infrastructure is a complex and evolving system. • Changes to the system affect its ability to effectively enforce the security policies and therefore protect the organization’s assets. • The process of managing the changes to the system and its components is referred to as configuration management. • Configuration management is the process of identifying configuration items, controlling their storage, controlling change to configuration items, and reporting on their status. 1. Configuration Items—Configuration items (CIs) are unique work products that are individually controlled, tracked, and reported on. 2. CI Protection—Configuration items must be protected from unauthorized changes. Without protection of the CIs, a configuration management system cannot function. 3. Change Control—There must exist a process by which changes to configuration items are reviewed, approved, and controlled.
  • 20. 4. Status Reporting—Configuration management systems must be able to report the status of any configuration item and its history of changes. Moreover, the reporting feature must be capable of generating a version of the system based on the correct version of each of the configuration items.
  • 22. MU Exam Questions May 2017 • Give a brief overview of the SSE-CMM maturity model. 10 marks Dec 2017 • Explain role of configuration management in security of an organization. Give the configuration management framework. 10 marks May 2018 • What is security engineering? Give a brief overview of the SSE-CMM model. 10 marks • Discuss role of Configuration Management in the security of an organization. 10 marks Dec 2018 • Discuss role of CM in the security of an organization. 10 marks May 2019 • Explain role of configuration management in security of an organization. Give the configuration management framework. 10 marks