Towards mathematical modelling in security risk management in system engineering

Hird, John; Koelle, Rainer; Kolev, Denis

doi:10.1109/icnsurv.2013.6548565

Cited by 6 publications

(4 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The results show that out of all 1,260 authors that published the 312 papers, only 2 authors (i.e., Nian Liu 109,124,128,134 and Manimaran Govindarasu 79,93,135,136 ) published 4 articles, 7 authors (i.e., Tansu Alpcan, 24,85,137 Aditya Ashok, 79,93,136 Quanyan Zhu, 24,66,138 Yingmeng Xiang, 109,124,128 Mohammad Shahidehpour, 126,139,140 John Hird, 91,141,142 and Lingfeng Wang 109,124,128 ) published 3 articles, and 70 authors published 2 articles. However, the rest of the authors are there with single entries.…”

Section: Findings Of Our Reviewmentioning

confidence: 99%

Security risks in cyber physical systems—A systematic mapping study

Zahid

Inayat

Daneva

et al. 2021

J Software Evolu Process

View full text Add to dashboard Cite

The increased need for constant connectivity and complete automation of existing systems fuels the popularity of Cyber Physical Systems (CPS) worldwide. Increasingly more, these systems are subjected to cyber attacks. In recent years, many major cyber‐attack incidents on CPS have been recorded and, in turn, have been raising concerns in their users' minds. Unlike in traditional IT systems, the complex architecture of CPS consisting of embedded systems integrated with the Internet of Things (IoT) requires rather extensive planning, implementation, and monitoring of security requirements. One crucial step to planning, implementing, and monitoring of these requirements in CPS is the integration of the risk management process in the CPS development life cycle. Existing studies do not clearly portray the extent of damage that the unattended security issues in CPS can cause or have caused, in the incidents recorded. An overview of the possible risk management techniques that could be integrated into the development and maintenance of CPS contributing to improving its security level in its actual environment is missing. In this paper, we are set out to highlight the security requirements and issues specific to CPS that are discussed in scientific literature and to identify the state‐of‐the‐art risk management processes adopted to identify, monitor, and control those security issues in CPS. For that, we conducted a systematic mapping study on the data collected from 312 papers published between 2000 and 2020, focused on the security requirements, challenges, and the risk management processes of CPS. Our work aims to form an overview of the security requirements and risks in CPS today and of those published contributions that have been made until now, towards improving the reliability of CPS. The results of this mapping study reveal (i) integrity authentication and confidentiality as the most targeted security attributes in CPS, (ii) model‐based techniques as the most used risk identification and assessment and management techniques in CPS, (iii) cyber‐security as the most common security risk in CPS, (iv) the notion of “mitigation measures” based on the type of system and the underline internationally recognized standard being the most used risk mitigation technique in CPS, (v) smart grids being the most targeted systems by cyber‐attacks and thus being the most explored domain in CPS literature, and (vi) one of the major limitations, according to the selected literature, concerns the use of the fault trees for fault representation, where there is a possibility of runtime system faults not being accounted for. Finally, the mapping study draws implications for practitioners and researchers based on the findings.

show abstract

Section: Findings Of Our Reviewmentioning

confidence: 99%

Security risks in cyber physical systems—A systematic mapping study

Zahid

Inayat

Daneva

et al. 2021

J Software Evolu Process

View full text Add to dashboard Cite

show abstract

“…John et al [99] Air Transportation GT Development of method using game theory and GT concepts and graph theory for security risk mitigation.…”

Section: Study Application Sector Technique Descriptionmentioning

confidence: 99%

“…John et al [99] Feasibility and compatibility for protecting air transportation. The results are only preliminary.…”

Section: Stefan Et Al [97]mentioning

confidence: 99%

Towards Integration of Security and Safety Measures for Critical Infrastructures Based on Bayesian Networks and Graph Theory: A Systematic Literature Review

Pirbhulal

Gkioulos

Katsikas

2021

Signals

View full text Add to dashboard Cite

In recent times, security and safety are, at least, conducted in safety-sensitive or critical sectors. Nevertheless, both processes do not commonly analyze the impact of security risks on safety. Several scholars are focused on integrating safety and security risk assessments, using different methodologies and tools in critical infrastructures (CIs). Bayesian networks (BN) and graph theory (GT) have received much attention from academia and industries to incorporate security and safety features for different CI applications. Hence, this study aims to conduct a systematic literature review (SLR) for co-engineering safety and security using BN or GT. In this SLR, the preferred reporting items for systematic reviews and meta-analyses recommendations (PRISMA) are followed. Initially, 2295 records (acquired between 2011 and 2020) were identified for screening purposes. Later on, 240 articles were processed to check eligibility criteria. Overall, this study includes 64 papers, after examining the pre-defined criteria and guidelines. Further, the included studies were compared, regarding the number of required nodes for system development, applied data sources, research outcomes, threat actors, performance verification mechanisms, implementation scenarios, applicability and functionality, application sectors, advantages, and disadvantages for combining safety, and security measures, based on GT and BN. The findings of this SLR suggest that BN and GT are used widely for risk and failure management in several domains. The highly focused sectors include studies of the maritime industry (14%), vehicle transportation (13%), railway (13%), nuclear (6%), chemical industry (6%), gas and pipelines (5%), smart grid (5%), network security (5%), air transportation (3%), public sector (3%), and cyber-physical systems (3%). It is also observed that 80% of the included studies use BN models to incorporate safety and security concerns, whereas 15% and 5% for GT approaches and joint GT and BN methodologies, respectively. Additionally, 31% of identified studies verified that the developed approaches used real-time implementation, whereas simulation or preliminary analysis were presented for the remaining methods. Finally, the main research limitations, concluding remarks and future research directions, are presented

show abstract

“…However, there are no publicly available numbers of incidents in the Air Traffic Network (ATN) per operational hour, thus we required another method. Regarding qualitative measurement methods, there are many examples in literature [28,29] on how to do it .We decided to mix approaches, develop a new and more fine-grained rating system and apply that onto our threat catalogue. For that purpose we defined seven factors all connected to either motivation or technical difficulty and rate them from zero to five (Table 3), average the score and receive a likelihood rating for a certain attack.…”

Section: Likelihoodmentioning

confidence: 99%

Paving the way for an IT security architecture for LDACS: A datalink security threat- and risk analysis

Mäurer¹

2018

2018 Integrated Communications, Navigation, Surveillance Conference (ICNS)

View full text Add to dashboard Cite

With air transportation growing and current civil aeronautical communication systems reaching their capacity limit in high density areas, the need for new aeronautical communication technologies becomes apparent. This implies the transition from analogue voice to digital data communication. A promising candidate for terrestrial air-ground communication is the L-band Digital Aeronautical Communications System (LDACS). LDACS is currently in the process of being standardized in ICAO. Being integrated in the aeronautical telecommunication network and providing a digital communication link for safety critical applications, each and every installation of LDACS requires protection against cyber-attacks. A rigorous threat and risk analysis is the fundamental basis to derive an IT security architecture for LDACS. The objective of this paper is to identify safety relevant air traffic management services, perform a threat and risk analysis, and define attacker types. Having created a threat catalog, we introduce a threat rating system allowing us to set our findings in a qualitative context and pave the way for a future LDACS IT security architecture.

show abstract

Towards mathematical modelling in security risk management in system engineering

Cited by 6 publications

References 6 publications

Security risks in cyber physical systems—A systematic mapping study

Security risks in cyber physical systems—A systematic mapping study

Towards Integration of Security and Safety Measures for Critical Infrastructures Based on Bayesian Networks and Graph Theory: A Systematic Literature Review

Paving the way for an IT security architecture for LDACS: A datalink security threat- and risk analysis

Contact Info

Product

Resources

About