About This Report  iii

Summary  v

Figures and Tables  ix

CHAPTER 1

Introduction  1

Security Objective  1

Scope  2

Limitations  3

Organization of This Report  3

CHAPTER 2

Approach  5

System-Theoretic Process Analysis for Security  5

Time and Cost Estimates  6

CHAPTER 3

Security Strategy  9

Threat Model and Security Objective  9

System Design  10

Security Guarantees  10

Operational Limitations  14

CHAPTER 4

Concept to Circuit  17

Example: Cross-Realm Solution  17

Assurance Path for the CRS  18

Trustworthiness and Formal Methods  19

Concept-to-Circuit Methodology  20

Next Steps  22

CHAPTER 5

Conclusions and Recommendations  23

Effective Security Requires Purpose-Built, Security-First Facilities  23

Such Security Is Appropriate for Only Targeted Use Cases  23

Recommended Next Steps  24

Conclusion  24

APPENDIXES

A. STPA-Sec Outputs  25

B. Time and Cost to Implement an SIDC  27

C. Concept-to-Circuit Tools and Methods  33

Abbreviations  37

References  39

About the Authors  41