@Flyslinger2 wrote:
Ron suggests that NIST Publication 800-160 is the foundation for getting stakeholders involved early in the SDLC to get security throughout the process.
Every security professional should be familiar with NIST Special Publication 800-160, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems.
AP 800-160 brings the principles of systems engineering into the security space. The seed for 800-160 was the nearly-lost Chapter 3 of NSA's Information Assurance Technical Framework (IATF) that defined Information Systems Security Engineering (ISSE). The NIST publication, however, is not just about information systems; it is about security engineering in any system. The starting point of any system design is determining the requirements for the system operation, and ensuring all known stakeholders have input to the requirements development process.
In keeping with the BSIMM concept of "build it in, don't add it on," the SSE process gives us the way to figure out what to build in!
Historical notes: The original version of the CISSP-ISSEP concentration was based on IATF Chapter 3, and was developed specifically under an (ISC)2 contract with NSA. The earliest discussions with Dr. Ross that eventually led to the development of SP 800-160 came from a panel discussion at an ISSA chapter meeting on how to "build it in." By that time, NSA was no longer maintaining the IATF, and Chapter 3 was no longer generally available on the web. Dr. Ross realized he could generate the replacement guidance at NIST. I was present at that meeting. Also, 800-160 co-author Michael McEvilley was a colleague at my company as he worked on the publication.
