Search

To help incorporate security into INCOSE's Systems Engineering Vision 2035, the INCOSE systems security engineering working group endorses a paradigmatic shift to reframe systems security as trustworthy, loss‐driven, and capabilities‐based. Similar research out of Sandia National Laboratories has explored cutting‐edge approaches to systems security for national security applications. Together, these efforts highlight the need for—‐and a path toward—‐a scientific foundation for security. Leveraging underlying tenets of systems theory, observed security heuristics, and the concepts emerging from INCOSE's SSE working helps triangulate a set of "first principles" as part of a scientific foundation for security as an emergent systems property that incorporates traditional physical security designs, cyber security architectures, and personnel security programs—‐as well as the (often ignored) interactions between them. These first principles, in turn, are the basis for a set of derived systems security performance axioms that support current INCOSE SSE working efforts. We have demonstrated this approach's logic and designability with a multilayer network model‐based approach for systems security. The structure of this scientific foundation for security offers additional, innovative opportunities to achieve desired levels of trustworthiness, creative mechanisms to meet needs, innovative loss‐driven approaches, and enhanced capabilities—‐all aimed at producing more efficient and effective systems security solutions against current and emerging threats, uncertainties, and complexities. [ABSTRACT FROM AUTHOR]

Providing adequate security to civilian nuclear materials and facilities exemplifies the long-standing, dynamic challenge of addressing the potential for facility damage under operational uncertainty. Estimating attack likelihood with enough precision to be useful and actionable for security risk management is philosophically, scientifically, and practically challenging. In response, this paper discusses the conceptual and analytical shortcomings of various approaches to calculating the likelihood of attack as a foundational element of security risk management. From these shortcomings emerge a set of characteristics that can guide the creation of alternative concepts that provide more robust and actionable security risk management approaches better aligned with the Ievolutionary growth in civilian nuclear facilities. Such broader conceptions would support movement from traditional interpretations of probability of attack toward more nuanced and complex depictions to enhance security risk management. [ABSTRACT FROM AUTHOR]

Advances on differentiating between malicious intent and natural "organizational evolution" to explain observed anomalies in operational workplace patterns suggest benefit from evaluating collective behaviors observed in the facilities to improve insider threat detection and mitigation (ITDM). Advances in artificial neural networks (ANN) provide more robust pathways for capturing, analyzing, and collating disparate data signals into quantitative descriptions of operationalworkplace patterns. In response, a joint study by Sandia National Laboratories and the University of Texas at Austin explored the effectiveness of commercial artificial neural network (ANN) software to improve ITDM. This research demonstrates the benefit of learning patterns of organizational behaviors, detecting off-normal (or anomalous) deviations from these patterns, and alerting when certain types, frequencies, or quantities of deviations emerge for improving ITDM. Evaluating nearly 33,000 access control data points and over 1,600 intrusion sensor data points collected over a nearly twelve-month period, this study's results demonstrated the ANN could recognize operational patterns at the Nuclear Engineering Teaching Laboratory (NETL) and detect off-normal behaviors--suggesting that ANNs can be used to support a data-analytic approach to ITDM. Several representative experiments were conducted to further evaluate these conclusions, with the resultant insights supporting collective behavior-based analytical approaches to quantitatively describe insider threat detection and mitigation. [ABSTRACT FROM AUTHOR]

Security assessments support decision-makers' ability to evaluate current capabilities of high consequence facilities (HCF) to respond to possible attacks. However, increasing complexity of today's operational environment requires a critical review of traditional approaches to ensure that implemented assessments are providing relevant and timely insights into security of HCFs. Using interviews and focus groups with diverse subject matter experts (SMEs), this study evaluated the current state of security assessments and identified opportunities to achieve a more "ideal" state. The SME-based data underscored the value of a systems approach for understanding the impacts of changing operational designs and contexts (as well as cultural influences) on security to address methodological shortcomings of traditional assessment processes. These findings can be used to inform the development of new approaches to HCF security assessments that are able to more accurately reflect changing operational environments and effectively mitigate concerns arising from new adversary capabilities. [ABSTRACT FROM AUTHOR]

The Gulf Nuclear Energy Infrastructure Institute (GNEII) at Khalifa University of Science and Technology was created as a regional institute offering education, research, and technical services that support nuclear energy safety, security, and safeguards (3S) objectives. A mixed methods approach--using the (1) Course Evaluation, (2) GNEII Alumni Survey, (3) Capstone Project, and (4) GNEII-Related Literature data sets--was used to evaluate the effect of implementing this multidisciplinary '3S' educational program and the broader impact of the associated '3S' multidisciplinary institute on nuclear energy human resource development. Data sets (1), (2), and (3) illustrate how well GNEII implemented this novel 3S curriculum and resulted in successful knowledge transfer. Data sets (2), (3), and (4) illustrate how well GNEII's impact has positively influenced professional workplace behaviors and the institute's broader reputation to support responsible nuclear energy program education. GNEII demonstrates one option for successfully providing a multidisciplinary, 3S curriculum to support broader nuclear infrastructure and human resource development aims. [ABSTRACT FROM AUTHOR]