What is a secure system?

A “secure system” is a system that ensures that only the authorized intended behaviors and outcomes occur, thereby providing freedom from those conditions, both intentionally/with malice and unintentionally/without malice, that can cause a loss of information assets with unacceptable consequences. The focus is on defining "adequate security" based on the organization's specific scenario (e.g., threats, risks, limitations, resources, etc.)

This definition expresses an ideal that captures three essential aspects of what it means to achieve security:

• Enable the delivery of the required system capability despite intentional and unintentional forces;
• Maintain the protection capabilities exhibited by the security solution; and
• Maximize security performance to the extent that any additional increase in security performance results in a degradation of some other aspect of system performance or requires an unacceptable operational commitment.

Absolute Security Is Impossible

No technology can provide absolute security due to the limits of human certainty, the uncertainty that exists in the life cycle of every system, and the constraints of cost, schedule, performance, feasibility, and practicality. Trade-offs are expected to be routinely made across contradictory, competing, and conflicting needs and constraints. These trade-offs must be optimized to achieve "adequate security" - a risk-based decision made by stakeholders.

Stakeholder vs. System Requirements

Requirements can be categorized as stakeholder requirements (design-independent) and system requirements (design-dependent). Both practitioners and architects need to understand the distinction.

An organization publishes policies to eliminate potential gaps in that desired governed behavior in an attempt to achieve “adequate security” for the organization based on what a reasonable individual would be expected to do in a similar situation. The rules associated with this “governed behavior” must be accurate, consistent, compatible, and complete with respect to the executive leadership's objectives to successfully accomplish the organization's mission and overall strategy. An organization's policies ultimately define the behavior of Individual Contributors (IC) (e.g., developers, architects) in performing their roles and associated responsibilities, as well as for the development of processes and procedures. This eventually leads to the configuration of technology assets (e.g., systems, applications, services and processes), where a discrete set of restrictions and properties must exist to specify how that asset enforces or contributes to the enforcement of the organizational security policies.

Stakeholder Security Requirements

Security-relevant stakeholder requirements specify:

• The protection needed for the mission or business, data, information, processes, functions, humans, and system assets;
• The roles, responsibilities, and security-relevant actions of individuals who perform and support the mission or business processes;
• The interactions between the security-relevant solution elements; and
• The assurance that is to be obtained in the security solution.

System Security Requirements

System requirements specify the technical view of a system or solution that meets the specified stakeholder needs. They are a transformation of the validated stakeholder requirements. System security requirements specify:

• The protection capabilities provided by the security solution;
• The performance and behavioral characteristics exhibited by the security solution;
• What the system or solution must do to satisfy the stakeholder requirements.

‍