As the subtitle claims, this book offers a practical approach to cyber security engineering. It does not introduce yet another set of methodologies; instead, it attempts to give guidance on how to use all of the existing information in your context, for the maturity your organization has or wants to have. Doing so, it provides answers to some of the tough questions that pop up when trying to build a cyber security engineering capability, including nontechnical aspects like the competencies that are required. It will appeal primarily to a management-level audience, or those aspiring to be at that level.

The first chapter is about lifecycle assurance of systems and software. Quoting author Woody, software assurance is “implementing software with a level of confidence that the software functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software, throughout the life cycle.” This chapter also introduces the principles of software assurance. The three case studies used throughout the book are introduced as well.

The title “Risk Analysis--Identifying and Prioritizing Needs,” covers the contents of the second chapter pretty well. First, it discusses risk types, like development, acquisition, and mission risks. It contains references to existing methodologies such as mission risk diagnosis, and security engineering risk analysis.

Chapter 3, “Secure Software Development Management and Organizational Models,” briefly presents both software development and acquisition process models using maturity models (MM) such as CMMI for development (CMMI-DEV), CMMI for acquisition (CMMI-ACQ), and CMMI for services (CMMI-SVC). It introduces software security frameworks and models, including building security in MM (BSIMM), software assurance MM, Microsoft security development lifecycle, and the National Institute of Standards and Technology (NIST) cybersecurity framework. An important addition is the maturity level assigned to features of the approaches, from unproven proposal (L1) through a proven one (L4). This supports the selection of features appropriate to your situation.

“Engineering Competencies” (chapter 4) focuses on a fundamental pillar of a security engineering capability: competent people. It presents software assurance competency models and zooms in on two: the Department of Homeland Security (DHS) competency model and the Software Engineering Institute (SEI) software assurance competency model. The latter presents five levels, from L1 (technician) to L5 (expert), and maps these to knowledge areas and associated competencies.

Chapter 5, “Performing Gap Analysis,” presents two use cases. The first is a gap analysis on competencies using the SEI software assurance competency model, and the second analysis addresses the gap in the maturity of security in the development life cycle using BSIMM.

Chapter 6, “Metrics,” starts by stating why there are plenty of metrics for security and why they are difficult to collect. Yet, by mainly measuring workload and throughput, the best-in-class organization does very well. Another angle from which to attack the problem is via metrics to evaluate and monitor the security capability. The last part discusses how to collect, evaluate, and manage evidence for the metrics.

“Special Topics in Cyber Security Engineering,” chapter 7, contains five parts, focusing on governance, standards, security requirements engineering for acquisition, operational competencies, and using malware analysis.

“Summary and Plan for Improvements in Cyber Security Engineering Performance” is the last chapter. It builds on the previous chapters, and adds a table with maturity levels for the major content items. This should indeed get readers going in the right direction.

The references and bibliography conclude this part of the book.

The seven appendices consume over 100 pages, and are linked to the chapters of the book. Appendix A is a case study, evaluating security risks using mission threads, including both human and technical steps. In the case study, the STRIDE methodology for threat analysis is used. “The [Master of Software Assurance] (MSwA) Body of Knowledge with Maturity Levels Added,” Appendix B, is a great help to get one going. Appendix C, on the Software Assurance Curriculum Project, mostly references other documents. Appendix D, “The Software Assurance Competency Model Designations,” provides an annotated list with maturity levels.

Appendix E contains one big table showing proposed software assurance competency mappings, organized per knowledge area, unit, and job title, with each of the latter assigned a level from 1 to 5.

Appendix F, “BSIMM Assessment Final Report,” is the full report linked to chapter 5. The final appendix, G, supports chapter 6, on metrics.

More reviews about this item: Amazon