Security Engineering
2 Who is the Opponent?
2.2 The Spooks
2.3 Crooks
2.4 Geeks
2.5 The Swamp
3 Psychology and Usability
3.2 Insights from psychology research
3.3 Deception in practice
3.4 Passwords
3.5 CAPTCHAs
5 Cryptography
5.2 Historical Background
5.3 Security Models
5.4 Symmetric crypto algorithms
5.5 Modes of Operation
5.6 Hash Functions
5.7 Asymmetric crypto primitives
6 Access Control
6.2 Operating system access controls
6.3 Hardware Protection
6.4 What Goes Wrong
8 Economics
8.6 The economics of security and dependability
9 Multilevel security
9.2 What is a Security Policy Model?
9.3 Multilevel Security Policy
9.4 Historical Examples of MLS Systems
9.5 MAC: from MLS to IFC and integrity
9.6 What Goes Wrong
25 Taking Stock
25.3 AI / ML
26 Surveillance or Privacy?
26.2 Surveillance
26.3 Terrorism
26.4 Censorship
26.5 Forensics and Rules of Evidence
26.6 Privacy and Data Protection
26.7 Freedom of Information
27 Secure Systems Development
27.2 Risk Management
27.3 Lessons from safety-critical systems
Critical computer systems are those in which a certain class of failure is to be avoided if at all possible. Depending on the class of failure, they may be safety-critical, business-critical, security-critical, or critical to the environment.
A common top-down way of identifying the things that can go wrong is threat tree analysis where a tree is constructed whose root is the undesired behavior and whose successive nodes are its possible causes.
Failure modes and effects analysis (FMEA) is a bottom-up method and involves tracing the consequences of a failure of each of the systemβs components all the way up to the effect on the mission.