A systems approach for eliciting mission-centric security requirements

Abstract

The security of cyber-physical systems is first and foremost a safety problem, yet it is typically handled as a traditional security problem, which means that solutions are based on defending against threats and are often implemented too late. This approach neglects to take into consideration the context in which the system is intended to operate, thus system safety may be compromised. This paper presents a systems-theoretic analysis approach that combines stakeholder perspectives with a modified version of Systems-Theoretic Accident Model and Process (STAMP) that allows decision-makers to strategically enhance the safety, resilience, and security of a cyber-physical system against potential threats. This methodology allows the capture of vital mission-specific information in a model, which then allows analysts to identify and mitigate vulnerabilities in the locations most critical to mission success. We present an overview of the general approach followed by a real example using an unmanned aerial vehicle conducting a reconnaissance mission.

Data-flow-based adaption of the System-Theoretic Process Analysis for Security (STPA-Sec)

“…Mailloux et al (2019) used the STPA-Sec to elicit systems security requirements for a notional autonomous space system. Carter et al (2018) used STPA-Sec with a previous information elicitation process to analyze a small reconnaissance unmanned aerial vehicles. A further modeling technique has also been proposed by the same researchers to support a more efficient and traceable analysis (Carter et al, 2019).…”

An ontological metamodel for cyber-physical system safety, security, and resilience coengineering

“…The proposed metamodel is an integration of multiple technology areas into a unified ontology. This integration leverages advances in MBSE [48], safety through STAMP [49], and mission aware cybersecurity [7,17]. Mission aware is a systems engineering methodology that attempts to bridge system design with safety, security, and resilience.…”

“…For example, in the field of safety, Leveson has developed systems-theoretic accident model and process (STAMP) [49], which examines safety incidents in terms of hierarchical control and unacceptable losses. In the intersection of security and resilience, there is System Aware [42,43] and its evolution Mission Aware [16,17], which see mitigation in terms of resilient modes in addition to traditional security defenses. Finally, the general field of model-based systems engineering (MBSE) has produced both methods and tools in assessing the safety and security posture of system designs and is the paradigm in which the majority of system models must conform to.…”

Systems‐theoretic security requirements modeling for cyber‐physical systems

“…In our previous work, we describe how to generate the mission context information and how the model can be applied to vulnerability analysis . This paper instead focuses on applying the modeling methodology to use a case, assuming that all the information in the model is known ahead of time.…”

“…While this is a necessary characteristic of any good model, evaluating a vulnerability in the mission context, however, requires that specific, low‐level vulnerabilities within components can be traced to potentially compromised mission requirements. Therefore, we need a systematic process for modeling the mission context, the system architecture, and linking those two together …”