Modeling constructs for describing a complex system-of-systems

To gather and organize the information needed to perform a risk analysis of a complex system-of-systems, a risk analyst needs a well-defined set of modeling constructs. This paper describes the system/network modeling constructs being incorporated into Version 2.0 of the ANSSR (Analysis of Networked Systems Security Risks) prototype. These allow an analyst to describe a complex system-of-systems at varying levels of abstraction, to represent a variety of networking situations, including the capability for multiple systems to share a common backbone network and the use of COMSEC (communications security) safeguards, and to describe system architectures. These modeling constructs are thus of interest not only to risk analysts but also to security architects and engineers