Towards the Definition of a Security Incident Response Modelling Language

Abstract

This paper presents a cyber-physical systems modelling language for capturing and describing health-based critical infrastructures. Following this practice incident response plan developers are able to model and reason about security and recovery issues in medical cyberphysical systems from a security requirements engineering perspective. Our work builds upon concepts from the Secure Tropos methodology, where in this paper we introduce novel cyber-physical concepts, relationships and properties in order to carry out analysis of incident response plans based on security requirements. We illustrate our concepts through a case study of a radiological department's medical cyber-physical systems that have been infected with the WannaCry ransomware. Finally, we discuss how our modelling language enriches security models with incident response concepts, guiding plan developers of health-based critical infrastructures in understanding cyber-physical systems vulnerabilities and support decision making at a tactical and a strategic level, through semi-automated secure recovery analysis.

Modelling language for cyber security incident handling for critical infrastructures

“…The approach integrates active incident handling with a reactive approach in order to provide a real-time insight into attacks and alerts related to cyber events using multiple subcomponents. Athinaiou et al (2018) developed a security incident response modelling language by integrating a cyber-physical system with incident response considered for health-based critical infrastructures . Incidents are specifically modelled by means of reflexive associations that cascade the influence from one incident to another incident.…”

“…Other research is oriented towards the construction of a modelling language for security incident response ( Athinaiou et al, 2018 ). The creation of a system that can support security managers in incident management in CIIs is also dealt with ( Papastergiou et al, 2019 ), as is incident handling, targeting critical sectors such as energy and transport ( Papastergiou et al, 2021 ).…”

A Conceptual Redesign of a Modelling Language for Cyber Resiliency of Healthcare Systems

“…The Secure Tropos metamodel inspired the first design attempt of a cyber resiliency modelling language for healthcare [34]. The initial design of the metamodel can be found in [6]. The decision of a redesign stemmed from interviews with experts from the Brighton and Sussex University Hospitals and MedStar Health as well as the application of small case studies.…”

Cyber Security Resilience in Business Informatics: An Exploratory Paper

“…Such language should enable identification and modelling of cyber security resilience at different organizational and technical levels and based on concepts that are easily understood across those levels, such as "organization", "goal", "process", "security incident", "security threat" and "security control". One such language from the cyber resilience literature is the Security Incident Response Modelling Language (SIRML) [25], which has been developed to capture incident response (IR) concepts. The language builds upon the Secure Tropos [17] modelling language and extends concepts, attributes and relationships to allow the cyber-physical aspect to be represented along with the view of IR as integral part of security.…”