Panel: Issues in Requirements Definition for Survivable Systems
R.C. Linger, Publicity Chair · 2005
Major economic sectors, including energy, transportation, telecommunications, manufacturing, financial services, health care, and education, as well as government and defense, all depend on a vast array of complex network systems operating on local, national, and global scales. Pervasive societal dependency on these systems magnifies the consequences of failure and the importance of ensuring their survivability. Survivability is the capability of a system to complete its mission in a timely manner, even if significant portions are incapacitated by attack or accident. Survivability refers to the capability of a system to provide essential services in the presence of successful intrusion, and to recover compromised services after intrusion occurs. Effective definition of survivability requirements for such systems is an essential first step in their development. The panel will focus on the distinction between the requirements that we see in today’s secure systems and the requirements that will be needed for survivable systems. For example, it seems likely that new requirements will be needed for resistance, recognition, and recovery from intrusions, and that requirements notations will need to identify subsets of functional requirements that must survive attacks. Issues that the panel will address include: • What are the principal issues in defining survivability requirements? • How can business risks and vulnerabilities be translated into survivability requirements? • What is different about survivable system requirements? • How can survivability requirements be analyzed and evaluated in system architectures? • What experience exists in dealing with survivability requirements? • Is there a gap between research and industry practice, and if so, how can it be bridged? • How can survivability requirements be dealt with in a proactive rather than reactive manner? Panelist Position Statements