search menu icon-carat-right cmu-wordmark

Introduction to the Security Engineering Risk Analysis (SERA) Framework

Technical Note
This report introduces the SERA Framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2014-TN-025
DOI (Digital Object Identifier)
10.1184/R1/6574856.v1

Abstract

Software is a growing component of modern business- and mission-critical systems. As organizations become more dependent on software, security-related risks to their organizational missions are also increasing. Traditional security-engineering approaches rely on addressing security risks during the operation and maintenance of software-reliant systems. However, the costs required to control security risks increase significantly when organizations wait until systems are deployed to address those risks. It is more cost effective to address software security risks as early in the lifecycle as possible. As a result, researchers from the CERT Division of the Software Engineering Institute (SEI) have started investigating early lifecycle security risk analysis (i.e., during requirements, architecture, and design). This report introduces the Security Engineering Risk Analysis (SERA) Framework, a model-based approach for analyzing complex security risks in software-reliant systems and systems of systems early in the lifecycle. The framework integrates system and software engineering with operational security by requiring engineers to analyze operational security risks as software-reliant systems are acquired and developed. Initial research activities have focused on specifying security requirements for these systems. This report describes the SERA Framework and provides examples of pilot results.

Cite This Technical Note

Alberts, C., Woody, C., & Dorofee, A. (2014, December 4). Introduction to the Security Engineering Risk Analysis (SERA) Framework. (Technical Note CMU/SEI-2014-TN-025). Retrieved May 28, 2024, from https://doi.org/10.1184/R1/6574856.v1.

@techreport{alberts_2014,
author={Alberts, Christopher and Woody, Carol and Dorofee, Audrey},
title={Introduction to the Security Engineering Risk Analysis (SERA) Framework},
month={Dec},
year={2014},
number={CMU/SEI-2014-TN-025},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6574856.v1},
note={Accessed: 2024-May-28}
}

Alberts, Christopher, Carol Woody, and Audrey Dorofee. "Introduction to the Security Engineering Risk Analysis (SERA) Framework." (CMU/SEI-2014-TN-025). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, December 4, 2014. https://doi.org/10.1184/R1/6574856.v1.

C. Alberts, C. Woody, and A. Dorofee, "Introduction to the Security Engineering Risk Analysis (SERA) Framework," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2014-TN-025, 4-Dec-2014 [Online]. Available: https://doi.org/10.1184/R1/6574856.v1. [Accessed: 28-May-2024].

Alberts, Christopher, Carol Woody, and Audrey Dorofee. "Introduction to the Security Engineering Risk Analysis (SERA) Framework." (Technical Note CMU/SEI-2014-TN-025). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 4 Dec. 2014. https://doi.org/10.1184/R1/6574856.v1. Accessed 28 May. 2024.

Alberts, Christopher; Woody, Carol; & Dorofee, Audrey. Introduction to the Security Engineering Risk Analysis (SERA) Framework. CMU/SEI-2014-TN-025. Software Engineering Institute. 2014. https://doi.org/10.1184/R1/6574856.v1