Can they work together? 3 strategies for cybersecurity and agile systems engineering

With more and more networked systems, cybersecurity is becoming increasingly important. At the same time, companies are increasingly relying on agile methods in systems engineering in order to better deal with changes and thus remain competitive. However, cybersecurity usually relies on stable processes, while agility requires a flexible approach. Can these different paradigms be reconciled?

In this article, I present strategies and tactics that make this possible in order to do justice to both aspects.

Challenges in integrating cybersecurity into agile systems engineering

The networking of systems is the main reason why cybersecurity has become so important in systems engineering. Without networking, physical access to the system is usually required in order to ensure the Attack security (cybersecurity is part of attack security). The importance of networking has also drastically increased the number of legitimate connections to many systems.

The free tool masscan can scan the entire Internet from a simple PC in 5 minutes

How To Scan the Internet in 5 Minutes

Traditional systems engineering has a decades-long tradition to Secure systems to develop. This has always involved both functional security and attack security. Agile system development lacks this history and it is often unclear how attack security can be taken into account.

When selecting agile methods, stakeholders often do not pay attention to whether and how security is integrated into the framework. This can lead to security aspects not being taken into account in sprints and backlogs. In addition, security is unfortunately all too often neglected due to time pressure and a shortage of resources.

The role of hardware and software

Cybersecurity is fundamentally a software problem. Therefore, the strategies that follow are primarily about software. However, hardware obviously plays a role in the overall security of a system.

Hardware components can have security vulnerabilities that can be exploited by attackers - for example through manipulable firmware or insecure interfaces. A holistic approach is therefore essential. In particular, components must not assume that they are working in a secure context (see "Zero Trust Architecture" in the next chapter).

3 strategies for the successful integration of cybersecurity

Regardless of the (agile) development method chosen, there are various strategies that can often be combined with each other. Here are the most important ones:

Shift left actually just means taking something into account as early as possible, even if it is not needed until later. In addition to security Testing and Traceability Candidates for "Shift left".

However, shift left is even more important when it comes to attack security than functional security. This is because attacks usually exploit vulnerabilities. And vulnerabilities are particularly likely to arise during reworking.

Since DevOps has proven itself enormously in software development, other "ops" are sprouting up everywhere, such as MLOps for machine learning. But there is a good reason for this, as it enables effective continuous delivery/integration (CI/CD), which increases competitiveness.

The task of DevSecOps is to ensure that the product is secure from the outset and that newly discovered vulnerabilities are closed quickly. To this end, security checks are integrated into the development process and executed via CI/CD.

As already indicated above, it is important for (sub)systems and components not to process all inputs without checking them, even if the system is actually supposed to be operated in a secure context. For example, vehicles have their own data bus (e.g. automotive Ethernet), which should actually be secure. Nevertheless, ECUs should transmit the data in encrypted form (or at least signed) and check it before processing.

For really critical equipment, it can even make sense to secure the communication between components within the device.

Conclusion

In addition to these strategies, there are of course a number of best practices that should be used in every development. These include integrating experts into the teams, regular training and the early identification of (in this case cybersecurity) requirements.

Cybersecurity and agile systems engineering are orthogonal, not contradictory. They can therefore be easily combined. The important thing is simply that we do it.

Photo by Kenny Eliason on Unsplash