Chapter 16 — Systems engineering

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["16.1 Systems thinking"]
  N2["16.2 Requirements traceability"]
  N3["16.3 Lifecycle"]
  N4["16.4 Trade-offs"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["16.1 Systems thinking"]
  N2["16.2 Requirements traceability"]
  N3["16.3 Lifecycle"]
  N4["16.4 Trade-offs"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]

[Learning outcomes]
    |
    v
[16.1 Systems thinking]
    |
    v
[16.2 Requirements traceability]
    |
    v
[16.3 Lifecycle]
    |
    v
[16.4 Trade-offs]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) apply systems thinking to security; (2) manage requirements and interfaces; (3) plan security across the system lifecycle.

16.1 Systems thinking

A system's security depends on how its parts interact. Lindiwe studies Saltmarsh's dispatch system: a web application, a database, a message queue, driver phones and an external mapping service. A weakness in any interface could affect the whole. Prof. Hale asks her to list each interface with the data crossing it and the trust assumed. She finds that the mapping service receives full delivery addresses, which nobody had considered when the contract was signed. The procurement team reviews the contract and asks the supplier how long addresses are kept.

16.2 Requirements traceability

Lindiwe traces each security requirement to the component that implements it and the test that verifies it. For example, the requirement that confirmations cannot be altered after submission maps to a database constraint and a test that attempts an update. She finds two requirements with no test. Prof. Hale explains that traceability shows gaps early and gives auditors evidence, because a requirement without a test is only an intention that nobody has checked. The developers write the two missing tests before the next release, and Lindiwe updates her traceability table to show each requirement covered.

16.3 Lifecycle

Security needs change through a system's life: design, build, operation, change and retirement. Lindiwe notes that retirement is often forgotten. An old dispatch server, replaced last year, still runs with outdated software and holds copies of customer data. She recommends a retirement checklist covering data deletion, account removal and network disconnection. She learns that every lifecycle stage needs explicit security activities, not just design and build. The old server is wiped and disconnected within a month of her report. The infrastructure team adds the retirement checklist to its standard change process, so future decommissioning follows the same steps.

16.4 Trade-offs

Systems engineering balances competing needs. Stronger authentication for drivers adds a few seconds per delivery, which matters across thousands of deliveries daily. Lindiwe measures the time added by a synthetic multi-factor prompt and proposes remembering trusted devices for a shift. Prof. Hale notes that security choices that ignore operational cost tend to be bypassed, and that documenting trade-offs openly helps managers accept the remaining risk deliberately. The synthetic prompt adds about four seconds per login. With remembered devices, drivers authenticate once per shift instead of at every delivery, and the operations manager accepts this design.

Worked example

Lindiwe lists dispatch interfaces and finds addresses shared with a mapping service, traces requirements to tests, adds a retirement checklist and balances authentication delay against delivery time.

Synthetic case. Systems are synthetic.

Errors and limits

Forgotten retired servers often keep old data and old vulnerabilities.

Exercises

• EX046 — Mapping data. What data does the mapping service receive?
  Show marking criteria

  Rubric: 3 = full delivery addresses;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX047 — Untested requirements. How many requirements had no test?
  Show marking criteria

  Rubric: 3 = two;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX048 — Retirement checklist. What does the retirement checklist cover?
  Show marking criteria

  Rubric: 3 = data deletion, account removal, disconnection;; 2 = all;; 1 = some;; 0 = none.