Risk-Based Systems Security Engineering - Essay Example

Article Summary Security and functionality are competing goals in design of most of the contemporary information systems. System designers feel the need to make trade-off decisions related to security. They need to develop secure systems against the attacks of the real world. Morda methodology is a methodology of systems security engineering can help the designers in making informed decisions. It offers a framework to analyze the complex postures of IS risk by deriving an unbiased metric of risk from the combination of mission impact concepts and threat attack.

Morda methodology is useful in discovering deficiencies in the system and developing the design strategies for the development of stronger systems. The subjectivity of Morda necessitates sensitivity analysis to study the change of attack scores with respect to one another with the change of values of the subjective variables. With Morda assessment, a risk posture can be produced for a proposed architecture, that not only drives the engineering process of the system security but also influences the development of countermeasures.

Costs of the countermeasure include but are not limited to expenses of purchase and maintenance, and backward compatibility whereas the benefit is effective mitigation of the risk. Morda offers an unbiased metric to the decision makers by assessing risk formally and systematically. Thus, decision makers can make informed decisions to identify proper strategy of defense. The Morda process identifies the single attacks that are most lucrative, but it does not consider the attack portfolios that are made over time so that ongoing adversary objectives can be achieved.