Security Engineering (SE) Workbench

Reference Documents

Foundational Documents

• Information-Driven Security Analysis: Tools and Techniques for the Study and Practice of Security Engineering. J. Whitmore. IEEE Computer. June 2023.
  https://ieeexplore.ieee.org/document/10132035.
• Cyber and Information Security: An Outline for Academic Study & Professional Practice. J Whitmore. January 2020.
  https://www.nist.gov/system/files/documents/2020/01/30/031_NICE Framework Request for Comments_508.pdf.
• Improving Attention to Security in Software Design with Analytics and Cognitive Techniques. J Whitmore, W Tobin. 2017 IEEE Cybersecurity Development, 16-21. https://ieeexplore.ieee.org/abstract/document/8077801/.
• Threat analysis in the software development lifecycle. J Whitmore, S Türpe, S Triller, A Poller, C Carlson. IBM Journal of Research and Development 58 (1), 6: 1-6: 13. https://ieeexplore.ieee.org/abstract/document/6717070/.
• A method for designing secure solutions. JJ Whitmore - IBM Systems Journal, 2001. Volume 40. Issue 3. Pages 747-768.
  https://ieeexplore.ieee.org/abstract/document/5386938. [PDF].

International Standards Documents

• ISO/IEC 15408-1:2022 Information security, cybersecurity and privacy protection Evaluation criteria for IT security. International Organization for Standardization. https://www.iso.org/standard/72891.html.
• ISO/IEC 27001:2013 Information technology - Security techniques - Information security management systems - Requirements. International Organization for Standardization. https://webstore.ansi.org/standards/iso/isoiec270012013.
• ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection Information security management systems Requirements. International Organization for Standardization. https://www.iso.org/standard/27001.
• ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection Information security controls. International Organization for Standardization. https://www.iso.org/standard/75652.html.

US Government Standards and Documents

• Security Glossary. National Institute of Standards and Technologies (NIST) Information Technology Laboratory, Computer Security Resource Center. https://csrc.nist.gov/glossary.
• NIST Special Publication 800-53R5. Security and Privacy Controls for Information Systems and Organizations.
  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.
• Special Publication 800-160 Version 1. Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/final.
• NIST Cyber Security Framework. Helping organizations to better understand and improve their management of cybersecurity risk. https://www.nist.gov/cyberframework.
• NIST SP800-30. Guide for Risk Assessment. https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final.
• NIST SP 1800-5. Asset Management. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-5.pdf
• CISA Security Capabilities Catalog. Cybersecurity & Infrastructure Security Agency of US Department of Homeland Security.
  https://www.cisa.gov/sites/default/files/publications/CISA%20TIC%203.0%20Security%20Capabilities%20Catalog%20v1.1.pdf.
• Cybersecurity workforce framework. The National Initiative for Cybersecurity Careers and Studies. A Cybersecurity & Infrastructure Security Agency program.
  https://niccs.cisa.gov/workforce-development/cyber-security-workforce-framework.

Other Standards Body Documents

• Common Criteria for Information Security Evaluation. https://www.commoncriteriaportal.org/
• Common Criteria Part 1: Introduction and General Model. 2022. https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART1R1.pdf.
• Common Criteria Part 2: Security functional requirements. 2022. https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART2R1.pdf.
• Common Criteria Part 3: Security assurance requirements. 2022. https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf.

Historical Documents

• Security Controls for Computer Systems. RAND Corporation, 1970.
  https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/ware70.pdf.
• IT Security Criteria - Criteria for the Evaluation of the Trustworthiness of Information Technology (IT) Systems - ITSEC Commission of the European Communities.
  https://m-chair.de/images/documents/publications/Rannenberg/InformationTechnologySecurityE.pdf.
• Department of Defense Trusted Computer System Evaluation Criteria - Orange Books (TCSEC) US Department of Defense, 1985.
  https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/dod85.pdf.

top of the page