A goal‐driven approach for the joint deployment of safety and security standards for operators of essential services

Abstract

Summary Designing safety‐critical software in domains ensuring essential services like transportation, energy, or health requires high assurance techniques and compliance with domain specific standards. As a result of the global interconnectivity and the evolution toward cyber‐physical systems, the increasing exposure to cyber threats calls for the adoption of cyber security standards and frameworks. Although safety and security have different cultures, both fields share similar concepts and tools and are worth being investigated together. This paper provides the background to understand emerging co‐engineering approaches. It advocates for the use of a model‐based approach to provide a sound risk‐oriented process and to capture rationales interconnecting top‐level standards/directives to concrete safety/security measures. We show the benefits of adopting goal‐oriented analysis that can be transposed later to domain‐specific frameworks. Both qualitative and quantitative reasoning aspects are analyzed and discussed, especially to support trade‐off analysis. Our work is driven by a representative case study in drinking water utility in the scope of the NIS regulation for operator of essential services.

Context modeling for cyber‐physical systems

“…Alternatively, we can implicitly document context information as constraints in logic formulae. However, to leverage the inherent ability of model-based development to overcome challenges due to the inherent complexity of CPS, 29,81,82 we propose a documentation format employing graphical models in the following. For each context perspective, we propose an example list of model elements motivated by our explanations from Section 3 along with a brief description and visual notational element.…”

“…We suggest that explicitly documenting facts and assumption about the system's context (which, in the following, we call “context information”) allows engineers to anticipate what happens when changes occur in the context at runtime. When explicitly documenting this context information alongside the regular engineering artifacts, permissible context configurations can be captured, which are known to retain adequate, safe, and secure functionality 24,29 . This can, for example, aid safety analysis and runtime adaptation, 30 as we will show in Section 6.…”

“…When explicitly documenting this context information alongside the regular engineering artifacts, permissible context configurations can be captured, which are known to retain adequate, safe, and secure functionality. 24,29 This can, for example, aid safety analysis and runtime adaptation, 30 as we will show in Section 6.…”

Model‐driven engineering of safety and security software systems: A systematic mapping study and future research directions

“…The authors identify cross‐fertilization between the two areas and how the method from one area can be utilized in the other. A very narrow view of this cross‐fertilization is discussed within the industrial control applications in the work of Kriaa et al 144 Another work on cross‐fertilization, focusing on common standards and approaches to deeper entangle safety and security, is from Ponsard et al 175 In contrast to these works, our study focuses on the MDE of safety and security systems, what are the proposed methods and tools for each development stage, and what are various types of contributions in this regard.…”