Think in functions, not in systems!

10 reasons why functions facilitate security (short version)

Sarah Fluchs
2 min readJun 13, 2020


If you want to change only one thing about your approach to security in 2020, pick this one: Stop thinking in single systems, in little blocks. Think in functions instead.

And do that consistently. Consistently does not mean writing down the most critical functions once at the beginning of a risk analysis and let them gather dust, preserved in files you won’t ever touch again.

Consistently means thinking in functions in everyday business whenever you make a security-relevant decision. Having your most important functions so firmly ingrained in your thinking that you could easily list and sketch them if woken up at three in the night.

Consistently means talking less about server X and PLC Z, but about the function that both (most likely in combination with a few other system components) fulfill. Consistently means not protecting systems, but functions.

Because for me thinking in functions is such an enormously powerful concept and I keep repeating the arguments how it facilitates your security, below is the collection of my best arguments pro-functions, white on blue.

(You can find a longer version here.)

To round things up:

Because I don’t want you to gather the impression you’d be a lone pioneer when thinking in functions, here are three examples for security methods which use the function concept as central element:

A system can be viewed […] as a collection of functions capable of interacting with its surrounding environment.

— ISO/IEC 15288:2015



Sarah Fluchs

Friction generates heat — true for writing and engineering. Fluchsfriction generates writings on security engineering. Heated debates welcome! CTO@admeritia