Getting the Foundations Right: Memory, Cryptography, and Concurrency in Secure Systems Engineering

Volume 3 of 10 in the Engineering-to-Research Monograph Series. The vulnerabilities that compromise real systems are rarely exotic; overwhelmingly they are ordinary mistakes in three foundational areas: how a program manages memory, how it uses cryptography, and how it coordinates concurrent work. This primer treats secure systems engineering as the discipline of getting those three foundations right, and argues each has a known, evidence-backed response: prefer memory-safe languages, because non-memory-safe code remains difficult to fully secure; treat cryptographic API misuse as the primary failure mode, because cryptographic failures are more often misuse of correct primitives than broken primitives; and reason about concurrency explicitly, because data races are correctness and security defects. It is grounded in hands-on work across both the unsafe and safer ends of the spectrum, systems programming in C and secure systems programming in Go, including from-scratch cryptographic validation (AES-GCM, SHA-256), certificate-signing and PKI tooling, OpenMP parallel computing in C++, and a Cross-Site Request Forgery exercise, and situated against the 2012 to 2026 literature including the 2025 CISA and NSA guidance on memory-safe languages. It contributes a comparative practitioner account across the language-safety spectrum, two design principles, and a competency model for secure systems engineering.
The paper and figures are licensed CC BY 4.0; companion code is released under the MIT License. This work contains no confidential or proprietary employer information.