Security Engineering

Shopping on line can be easy, simple and save you lots of money. It can also take a lot of your time, frustrate you, and result in unwanted purchases. Now the same can be said for regular high street shopping, but with the vast opportunity presented by the Internet it will pay you to spend a few minutes reading this and understanding how to better optimize your Security Engineering shopping experience:

1. Compare - without doubt the biggest advantage that the Security Engineering offers shoppers today is the ability to compare thousands of Security Engineering at a time. This is a great thing, but not necessarily all the time! Too much can be daunting at times so take advantage of the great comparison sites and where possible let them do the hard work for you.

2. Research - if it has been said it will be on the internet. Ignorance is no longer a justifiable reason for buying the wrong thing. Take the time to research in detail everything that you could possible want to know about

3. Testimonials - don't know anybody that has bought a Security Engineering? Wrong! If the Security Engineering is good the internet will let you know. Use the Internet as a friend and get testimonials before you buy.

4. Questions - Got a question about Security Engineering then search the Forums, FAQ's, Blogs etc. Don't be afraid to ask .....

5. Reputation - Never heard of the company selling Security Engineering? Don't worry, no reason why you should know every company in the world, but you know someone that does! Use the internet to find out what people are saying about Security Engineering and build up a picture of their reputation for sales, returns, customer service, delivery etc.

6. Returns - still worried that even after all of the above your Security Engineering wont be what you want? Check out the returns policy. There is so much competition now that someone, somewhere is bound to offer the terms that you are comfortable with.

7. Feedback - happy with your Security Engineering then let people know, after all you are depending on others people input in your buying decision, so why not give a little back.

8. Security - check for the yellow padlock on the Security Engineering site before you buy, and the s after http:/ /i.e. https:// = a secure site

9. Contact - got a question about Security Engineering, or want to leave a comment then check out the sites contact page. Reputable companies have them and respond.

10. Payment - ready to pay for your Security Engineering, then use your credit card or PayPal! Be aware of companies that don't accept them, there may be genuine reasons but given the huge amount of choice you have when buying online there is no reason at all not to buy via credit card or PayPal.

Security engineering is the field of engineering dealing in developing detailed engineering designs for security systems and for security of spaces. It is similar to systems engineering in that its motivation is to make a system meet requirements, but with the added dimension of enforcing a security policy. It has existed as an informal field for centuries, in the fields of locksmithing and security printing.

For this reason it involves aspects of social science, psychology and economics, as well as physics, chemistry, mathematics and Landscaping.Some of the techniques used, such as fault tree analysis, are derived from safety engineering.

Other techniques such as cryptography were previously restricted to military applications. One of the pioneers of security engineering as a formal field of study is Ross Anderson.

Qualifications Typical qualifications for a security engineer are:

Chartered Professional Engineer
Certified Protection Professional
Physical Security Professional
BICSI RCDD
CISSP

However, multiple qualifications, or several qualified persons working together, may provide a more complete solution.

Security Stance Possible default positions on security matters:

Default deny - "Everything not explicitly permitted is forbidden"

-- Improves security at a cost in functionality. This is a good approach if you have lots of security threats. See secure computing for a discussion of computer security using this approach.

Default permit - "Everything not explicitly forbidden is permitted"

-- Allows greater functionality by sacrificing security. This is only a good approach in an environment where security threats are non-existent or negligible. See computer insecurity for an example of the failure of this approach in the real world.

Sub-fields

Physical security - measures that prevent or deter attackers from accessing a facility, resource, or information stored on physical media.
Information security - protecting data from unauthorized access, use, disclosure, destruction, modification, or disruption to access. (See esp. Computer security)
Economics of security - addressing the economic aspects of economics of privacy and computer security.

Methodologies Technological advances, principally in the field of computers, have now allowed the creation of far more complex systems, with new and complex security problems. Because modern systems cut across many areas of human endeavor, security engineers not only need consider the mathematical and physical properties of systems; they also need to consider attacks on the people who use and form parts of those systems using social engineering (computer security) attacks. Secure systems have to resist not only technical attacks, but also coercion, fraud, and deception by confidence tricksters.

Computer - Patterns & Practices According to the Microsoft Developer Network the patterns & practices of Security Engineering consists of the following activities:

Security Objectives
Security Design Guidelines
Security Modeling
Security Architecture and Design Review
Security Code Review
Security Testing
Security Tuning
Security Deployment Review

These activities are designed to help meet security objectives in the software life cycle.

Physical - Patterns & Practices

Understanding of a typical threat and the usual risks to people and property.
Understanding risk and threat analysis methodology and the benefits of an empirical study of the physical security of a facility.
Understanding how to apply the methodology to buildings, critical infrastructure, ports, public transport and other facilities/compounds.
Overview of common physical and technological methods of protection and understanding their roles in deterrence, detection and mitigation.
Determining and prioritizing security needs and aligning them with the perceived threats and the available budget.

Target Hardening Whatever the target, there are multiple ways of preventing penetration by unwanted or unauthorised persons. Methods include placing Jersey barriers, stairs or other sturdy obstacles outside tall or politically sensitive buildings to prevent car and truck bombings. Improving the method of Visitor management and some new electronic locks take advantage of technologies such as fingerprint scanning, iris or retinal scanning, and voiceprint identification to authenticate users.

Companies and Governments Employing Security Engineers

US Department of State, Bureau of Diplomatic Security (ABET certified institution degree in engineering or physics required)

Criticisms Gallery Image:VTBS-luggage screening.JPG|Airport Pre-screening Station: allowing the maximum accesss of foottraffic while still providing basic security to the facilityImage:Canadian_Embassy_DC_2007_002.jpg|Canadian Embassy in Washington, D.C. Notice the planters being used as vehicle barriers, and barriers and gates allong the vehicle entrance.

See also Computer Related

Authentication
Cryptography
Cryptanalysis
Computer insecurity
Data remanence
Defensive programming
Electronic underground community
hack (technology slang)
Password policy
Software cracking
Software Security Assurance
Secure computing
Systems engineering
Trusted system

Physical

Access control
Authorization
Critical Infrastructure Protection
Environmental design (esp. Crime prevention through environmental design)
Locksmithing
Physical Security
Secrecy
Security
Secure cryptoprocessor
Security through obscurity
Technical Surveillance Counter-Measures

Misc. Topics