Security engineering

Security engineering is a specialized branch of engineering focused on safety. It involves incorporating security controls directly into an information system. These controls must become an integral part of the system's operational capabilities. While standard systems engineering focuses on meeting user requirements, security engineering adds a new dimension. It specifically works to prevent misuse and malicious behavior. Engineers often define these restrictions through a formal security policy. This ensures the system remains reliable even when faced with intentional interference.

Modern security engineering follows a specific cycle to protect software. According to the Microsoft Developer Network, this process involves several distinct activities. It begins with establishing clear security objectives and design guidelines. Engineers then move into security modeling and architecture reviews. They perform security code reviews to find weaknesses in the programming. After that, they conduct security testing to see how the system reacts to stress. Finally, they perform a security deployment review to ensure a safe launch. This structured approach helps meet objectives throughout the entire software life cycle.

The field is incredibly diverse and draws from many different disciplines. It utilizes physics, chemistry, and mathematics to design technical solutions. Engineers also study social science and psychology to understand human behavior. For instance, they use psychology to design systems that "fail well." This means the system handles errors gracefully instead of failing completely. Other areas of study include economics, criminology, and even landscaping. Some techniques, like fault tree analysis, come from the field of safety engineering. Other tools, such as cryptography, were once restricted only to military use.

Security engineering has evolved from ancient practices into a modern science. For centuries, it existed as an informal field of study. Examples include the long-standing trades of locksmithing and security printing. The modern era of computer security began to solidify in 1967. Willis H. Ware authored a foundational paper titled "Security and Privacy in Computer Systems." He expanded this work in 1979 to provide core concepts. These concepts formed the basis of what we now call cybersecurity. Today, these principles protect everything from cloud systems to the Internet of Things (IoT).

The scale of this industry is massive and continues to grow. Following major events like 9/11, the field expanded very rapidly. A report from 2006 estimated the global security industry was worth US $150 billion. This growth is driven by the increasing complexity of technological systems. As computers become more advanced, they create new and complex security problems. Engineers must now protect against technical attacks and human-focused threats. This includes resisting coercion, fraud, and deception by confidence tricksters. They must also defend against social engineering attacks that target the people using the systems.

Engineers use various methods to protect specific targets, a process called target hardening. This involves making a target much harder for unauthorized persons to penetrate. Physical examples include using Jersey barriers or sturdy obstacles like stairs. These can prevent vehicle-based attacks against sensitive buildings. Some buildings even use large planters as vehicle barriers.

Electronic methods are also common for managing access. New locks use biometric technology to authenticate users. These include fingerprint scanning, iris or retinal scanning, and voiceprint identification. These tools ensure that only authorized individuals can access specific resources.

There are different types of security engineering based on the target. Product security engineering applies these principles to the items an organization sells. This includes hardware like cell phones, computers, and cameras. It also includes software like operating systems and firmware. This is different from corporate or enterprise security. Corporate security focuses on protecting the networks a company uses to do business. Both types of engineers must understand risks to people and property. They must also balance security needs with the available budget. This ensures that protection is both effective and economically feasible.