ABSTRACT
In many respects, the System Security knowledge area (KA 5) is the glue that binds the knowledge areas associated with software (KA 2: Software Security), components (KA 3: Component Security), and connections (KA 4: Connection Security) into a single practical understanding. In essence, the System Security KA is the one place in the CSEC where the "holistic view", which is integral to ensuring suitably complete and correct cybersecurity solutions, is fully represented and discussed as well as practically applied.
Cybersecurity is a complex field. Dealing with that kind of complexity requires concrete organizing principles that will ensure that a diverse collection of essential elements are properly integrated into a multifaceted and systematic appreciation of cybersecurity as a whole. The resulting understanding will then provide a unified way to provide the desired assurance outcomes. In the case of cybersecurity, the ability to reliably counter any given real-world threat is inherently challenging. The problem stems from the fact that the constituent elements of the solution are diverse, often unique. And the requisite interactions, dependencies, or other types of relationships that exist between them are wide ranging and unpredictable. However, the principles that guide the creation of a rational cybersecurity response are no different than they would be for the construction of any other highly diverse and complex real-world system. Therefore, the concept of system applies to all cybersecurity solutions. In this chapter, you will learn the concepts and justification for a holistic approach to systems, the role of security policy in the creation and maintenance of holistic systems, and the central role of authentication in the assurance of System Security. The reader will see how access control maintains the integrity and confidentiality of systems and system monitoring maintains the assurance of overall secure operation. In addition, the reader will learn how recovery planning and procedure serve to assure trust in a system as well as how testing assures secure system operation. Finally, the role of documentation in the System Security life cycle process will be explored.
