@article {715, title = {A Research Agenda for Security Engineering}, journal = {Technology Innovation Management Review}, volume = {3}, year = {2013}, month = {08/2013}, pages = {41-50}, publisher = {Talent First Network}, address = {Ottawa}, abstract = {Despite nearly 30 years of research and application, the practice of information system security engineering has not yet begun to exhibit the traits of a rigorous scientific discipline. As cyberadversaries have become more mature, sophisticated, and disciplined in their tradecraft, the science of security engineering has not kept pace. The evidence of the erosion of our digital security {\textendash} upon which society is increasingly dependent {\textendash} appears in the news almost daily. In this article, we outline a research agenda designed to begin addressing this deficit and to move information system security engineering toward a mature engineering discipline. Our experience suggests that there are two key areas in which this movement should begin. First, a threat model that is actionable from the perspectives of risk management and security engineering should be developed. Second, a practical and relevant security-measurement framework should be developed to adequately inform security-engineering and risk-management processes. Advances in these areas will particularly benefit business/government risk assessors as well as security engineers performing security design work, leading to more accurate, meaningful, and quantitative risk analyses and more consistent and coherent security design decisions. Threat modelling and security measurement are challenging activities to get right {\textendash} especially when they need to be applied in a general context. However, these are decisive starting points because they constitute the foundation of a scientific security-engineering practice. Addressing these challenges will require stronger and more coherent integration between the sub-disciplines of risk assessment and security engineering, including new tools to facilitate that integration. More generally, changes will be required in the way security engineering is both taught and practiced to take into account the holistic approach necessary from a mature, scientific discipline.}, keywords = {cybersecurity, information system security engineering, research, risk management, security engineering, security measurement, threat modelling}, issn = {1927-0321}, doi = {http://doi.org/10.22215/timreview/715}, url = {http://timreview.ca/article/715}, author = {Rich Goyette and Yan Robichaud and Fran{\c c}ois Marinier} }