Programming Engineering Summary

Security engineering. Security dimensions ( CIA triangle ). Terminology. Threat types. Security assurance. Misuse/Abuse cases. Design compromises. Layered software protection architecture. Design guidelines for security engineering. System security management. Security and dependability. Security risk assessment. Application/infrastructure security. Security levels. Distributed software protection. Software testing. What is testing. Sources of errors. Testing maturity level. Test levels. TL – objectives of testing. Dependable and resilient systems. Principal dependability properties. Causes of failure. Dependability costs (tradeoffs). Sociotechnical system stack. Redundancy and diversity. Attributes of dependable processes (ADDRS). Resilient systems. Resilience activities (RRRR). Resilience engineering assumptions. Cybersecurity. Cybersecurity threats ( CIA ). Resilient systems design. Real-time software engineering. Embedded software. Real-time system. Reactive systems. A general model of an embedded real-time system. Design process activities. Real-time system modeling. Observe and react architectural pattern. Enviromental control architectural pattern. Components of a real-time operating system.

Compartmentalize your assets – make assets available on a need-to-know basis

Asset identification – identify the key system assets that have to be protected

Application security – concerned with the security of individual application systems.

Each platform can be using different infrastructures so they do not share vulnerabilities.

Selected – risk analysis techniques and software engineering expertise are applied.

Support systems – poor programming languages, faulty compilers, misleading development tools.

Stress testing – tests the system under maximum design loads and beyond to determine limits and defense.

Resilience – how well a system can maintain the continuity of its critical services in presence of disruption.

Hardware failure – fails because of design or manufacturing errors or because components are old.

The process should have defined process model that defines activities in the process and that documentation is produced during those activities.

Cybersecurity is concerned with all of an organizations IT assets from networks to application systems.