Securing the 

Ecosystem 

The Need for Multidimensional Protection in the 21st Century 

Ron Ross 
 

Complexity 

Millions, Billions, and Trillions 

of Everything 

2 
 

The Ecosystem 

Ubiquitous Connectivity Produces Shared Risk 

3 
 

 

 

 

 

 

ENVIRONMENT OF OPERATION

Enabling 

System 

Enabling 

System 

System 

Element 

System 

Element 

System 

Element 

SYSTEM-OF-INTEREST

Enabling 

System 

Enabling 

System 

The 

Ecosystem 

Systems Engineering View 

Other 

System 

Other 

System 

Other 

System 

Critical interdependencies and relationships 

among internal system elements, systems 

within enterprise environments, and systems 

in external environments that affect security 

solutions. Courtesy: NIST Special Publication 800-160, Volume 1 

4 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

PROBLEM SOLUTION TRUSTWORTHINESS Systems Security 

Engineering 

Characteristics 

• Disciplined and structured development process 

• Integrates security into the system life cycle 

• Applied to all elements in the system stack 

• Can be tailored and implemented in agile 

development processes 

• Provides needed traceability of requirements and 

transparency into development processes leading 

to greater trust in systems and system elements 

Demonstrate 

Assurance Case 

Is Satisfied 

Develop

Assurance Case 

for Acceptable

Security 

Define the 

Security Aspects

of the Solution 

Realize the 

Security

Aspects of

the Solution 

Produce 

Evidence for 

Security Aspects

of the Solution 

Define 

Security

Requirements 

Define 

Security

Objectives 

Define Life 

Cycle Security

Concepts 

Define 

Success 

Measures 

Produce 

Evidence for 

Security Aspects

of the Problem 

SYSTEM SECURITY ANALYSES

CONCEPTS, PRINCIPLES, MEANS, METHODS, PROCESSES, PRACTICES, TOOLS, TECHNIQUES

Closed Loop Feedback, Variances, Change, and Continuous Improvement 

Courtesy: NIST Special Publication 800-160, Volume 1 

5 
 

 

Systems Security 

Engineering 

Key Concerns 

• Architecture 

• Assurance 

• Behavior 

• Cost 

• Criticality 

• Design 

• Effectiveness 

• Emergence 

• Ergonomics 

• Exposure 

• Fit-for-purpose 

• Human performance 

• Life cycle concepts 

• Penetration resistance 

• Performance 

• Privacy 

• Protection needs 

• Requirements 

• Risk 

• Security objectives 

• Strength of function 

• Security performance 

• Threat 

• Trades 

• Training 

• Uncertainty 

• Vulnerability 

• Verification 

• Validation 

6 
 

 

 

Multidimensional 

Protection Strategy 

• Penetration-resistant architecture 

• Damage-limiting operations 

• Designs to achieve cyber resiliency 

and survivability 

Stop the incursion... 

Limit the damage after the incursion has occurred... 

Continue to operate even in a degraded or debilitated state. 

7 
 

 

 

The Vision 

Framework for Securing the Ecosystem 

Mission/Business - Processes - Technology - Communications - Production 

Systems Security Engineering 

BizOps DevSecOps Supply Chain Security 

Transparency - Traceability - Trust - Assurance - Integrity - System Resilience 

8 
 

 

 

 

 

 

 

 

 

Framework for Securing 

the Ecosystem 

Part 1 of 2 

Objectives 

• Apply system security engineering concepts to 

agile, DevOps, and DevSecOps processes to 

create a “lean SSE” process 

• Expand DevSecOps approaches from software 

components to ”systems” 

• Incorporate “security” into product and system 

development, implementation, operation, 

sustainment, and compliance 

9 
 

 

 

 

 

 

 

 

 

Framework for Securing 

the Ecosystem 

Part 2 of 2 

Objectives 

• Develop a “holistic” risk management 

approach for systems and organizations 

• Use BizOps to drive technology and security

solutions 

• Implement a multidimensional protection

strategy to create cyber resilient systems 

• Increase system and component assurance by

maximizing life cycle testing and evaluation 

• Focus on supply chain security 

10 
What are you 

building? 

11 
 

 

 

 

Ron Ross 

Email: ron.ross@nist.gov 

Mobile: (301) 651-5083 

Web: http://csrc.nist.gov 

Twitter: https://twitter.com/ronrossecure 

LinkedIn: https://www.linkedin.com/in/ronrossecure 

12