This electronic flyer highlights our capabilities and activities in the area of Enterprise Security Technologies. Please sign our guestbook. For additional information, e-mail Steven H. Rodgers or Sean Mitchem, Southwest Research Institute.
Top: Aggregating data from multiple sources for analysis to obtain a complete system picture. Bottom: Protecting enterprise data with a security focus in the software development lifecycle.

Enterprise Security Technologies

The Information Systems Engineering Department (ISED) at Southwest Research Institute® (SwRI®) is committed to reliably producing the highest quality work through a proven systems engineering process. Engineers in the Enterprise Security Technologies Group (ESTG) specialize in enterprise security issues, working with other engineers to provide a multidisciplinary focus in all phases of the software development lifecycle. Integrating security in this manner serves as a protective shield for shared and aggregated data in an enterprise system.

Analysis and Requirements

To develop enterprise systems for various application requirements, SwRI engineers conduct a risk and threat analysis to determine:

  • What assets need to be protected?
  • Who are the potential attackers?
  • How could the system be attacked?
  • Is compliance with rules and regulations required?

In addition, use and abuse cases are built to describe the system’s behavior under attack. Analysis results in a set of security-related requirements that mitigate the risks and influence the system design.

Design

Important concepts in enterprise security design include:

  • Authentication
  • Authorization
  • Integrity
  • Confidentiality
  • Auditing
  • Encrypted transmission

Principles for software security such as controlling privileges, failing to a secure state, validating input data, and many others are considered in all elements of the software architecture design. Since the architecture is often distributed to various servers or locations, enterprise security includes the means and policies that protect the communication infrastructure of networked systems.

Design Considerations for Data Aggregation

Enterprise systems that aggregate data from multiple sources can yield valuable patterns and information that cannot be discovered through isolated data sources. SwRI addresses special architecture and design considerations when sharing data between agencies. For example:

  • Control of data distribution
  • Audit trails identifying users
  • Data maintenance in a distributed model
  • Application of security classifications
  • Safeguarding of personal information
  • Fast and secure distribution of data implementation

SwRI engineers develop software based on a design with built-in security considerations. Static code analysis tools are used to detect known coding vulnerabilities such as buffer overflows and integer overruns. To maintain a focus on secure software programming practices, code reviews include ESTG staff and multiple developers. The code reviews also serve as educational opportunities for continuing improvement in secure software development.

Testing

SwRI engineers conduct functional testing along with penetration and risk-based security testing to identify security vulnerabilities in the code.

Security testing encompasses two strategies:

  • Testing of security functionality with standard functional testing techniques
  • Risk-based security testing based on attack patterns, risk analysis results, knowledge of the system architecture, and abuse cases

Testing is conducted throughout project development and lessons learned are propagated back into the software development lifecycle.

The Information Systems Engineering Department (ISED) at SwRI is committed to reliably producing the highest quality work through a proven systems engineering process. Our commitment to excellence is evident through our appraised attainment of Level 5 within the Software Engineering Institute’s (SEI) Capability Maturity Model Integration (CMMI®). This distinction is held by a limited number of American companies and even fewer applied research and development institutions.

®CMMI is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.

For more information about Information Systems Engineering, visit www.ised.swri.org.

This flyer was published in August 2008. For more information about Enterprise Security Technologies, contact Steven H. Rodgers, Phone (210) 522-3772, Fax (210) 522-4227, or Sean Mitchem, Phone (210) 522-2698, Fax (210) 522-4232, Automation and Data Systems Division, Southwest Research Institute, P.O. Drawer 28510, San Antonio, Texas 78228-0510.

Automation and Data Systems Brochures
SwRI Brochures SwRI Publications
SwRI Technical Divisions SwRI Home