Reply to Message

Nice to hear something positive about the need for Security Engineering professionals. I'm on a Security Engineering team and it takes a bit of effort to get activities accomplished because there are so few of us. Most security professionals are focused on the Security Operations side of things and there is a distinct difference between the two areas. Unfortunately, Security Operations gets more focus because they are "on the front lines" defending the perimeters of the organizations they are assigned to protect. Too bad that management doesn't realize that if you build security in (where Security Engineering comes into play), you just might be able to alleviate some of the stress in Security Operations.

There are published resources out there for Security Engineering. These include the following:
1. SSE-CMM: Systems Security Engineering - Capability Maturity Model. Located at http://www.sse-cmm.org/index.html . The website hasn't been updated in a while, which leads to the next resource.
2. ISO/IEC 21827:2008, Information technology - Security techniques - Systems Security Engineering - Capability Maturity Model (SSE-CMM). This standard officially standardized the SSE-CMM. Information available at http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=44716
3. International Council on Systems Engineering (INCOSE), Systems Security Engineering Working Group. Information on this working group is available at http://www.incose.org/practice/techactivities/wg/details.aspx?id=securitywg
4. Software Engineering Institute, Carnegie Mellon, CERT, Cyber Security Engineering. http://www.cert.org/sse/
5. NIST SP 800-27 Rev A, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), Revision A. Available at http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf
6. SABSA (Sherwood Applied Business Security Architecture). Enterprise Security Architecture seems to be a missing topic when discussing anything related to information security or cybersecurity. See http://www.sabsa.org/the-sabsa-method.aspx