A new draft National Institute of Standards and Technology (NIST) publication recommends ways to incorporate time-tested security design principles into cyber-physical systems from concept to implementation.

According to NIST, organizations currently buy commercial components, such as operating systems and applications, and then add on security measures such as firewalls, encryption and monitoring systems. “But those things do not go far enough in reducing and managing complexity, developing sound security architectures and applying fundamental security design principles,” says NIST Fellow Ron Ross. “Many of the engineering-related activities must be done by industry, as consumers can't design or modify source code, or do the other tasks necessary for full-spectrum security.”

The new NIST publication is intended for anyone who designs, builds or implements systems from smartphones to industrial and process control systems. Image credit: Pixabay.The new NIST publication—the follow-up to a first draft published in May 2014—is intended for anyone who designs, develops, builds, implements, organizes or sustains any type of system from smartphones to industrial and process control systems. The report sets out to create a comprehensive, engineering-based approach that includes security considerations from the original design throughout the system’s entire lifecycle—including how to retire the system and its data securely.

"Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems" (NIST Special Publication 800-160) starts with mission or business owners “valuing” their assets and then uses security design principles and systems engineering processes to develop appropriate security requirements, architecture and design. The objective is to implement a security capability that can adequately protect these assets and reduce a system’s susceptibility to adverse consequences from threats and other hazards—all in the context of an organization’s tolerance for risk.

“The systems security engineering considerations in NIST SP 800-160 give organizations the capability to strengthen their systems against cyberattacks, limit the damage from those attacks if they occur and make their systems survivable,” Ross says.

The considerations outlined in the NIST publication apply to both modern versions of pre-existing systems, such as manufacturing, and completely new systems, such as environmental monitoring devices and sensors embedded in the physical world and connected to physical networks as part of the Internet of Things.

“The key to reducing the risk to our critical infrastructure is to build ‘trustable‘ systems on a foundation of systematic and accepted engineering principles,” says Robert Bigman, a cybersecurity consultant at 2BSecure and former Central Intelligence Agency chief information security officer. “NIST SP 800-160 will become the de facto standard for integrating ‘trustability’ into the design, development, deployment and operation of systems used both within government and commercial critical infrastructure industries."

Public comments on the draft are due no later than July 1, 2016.