Security Engineering — Foundations
Stub. What security engineering is (as distinct from cryptography or a single mechanism): designing whole systems that remain dependable despite malice; the usability and psychology factors that determine whether people actually follow a security design; and protocols as the basic unit of analysis for how principals establish trust and exchange authenticated information.
Security engineering is bigger than any single mechanism in this topic area — it’s the discipline of building whole systems that stay dependable in the presence of an intelligent adversary, which means most failures trace back to a mismatch between a mechanism and the humans or organization around it rather than a broken cipher. Covers usability and psychology as a first-class design constraint (a secure mechanism users route around isn’t secure), and protocols as the basic analytical unit for almost everything downstream — a small message exchange meant to establish authentication or a shared secret, and the surprisingly rich taxonomy of subtle ways a seemingly-fine protocol can be attacked (replay, reflection, type confusion) even when every individual cryptographic primitive it uses is secure.
Outline (TODO — flesh out each)
- What is security engineering?
- Usability and psychology
- Protocols — the basic unit of security analysis
- Classic protocol failure modes — replay, reflection, type confusion