Using Structured Assurance Case Approach to Analyse Security and Reliability of Critical Infrastructures

Abstract

This is the accepted version of the paper.This version of the publication may differ from the final published version. Abstract. The evaluation of the security, reliability and resilience of critical infrastructures (CI) faces a wide range of challenges ranging from the scale and tempo of attacks to the need to address complex and interdependent systems of systems. Model-based approaches and probabilistic design are fundamental to the evaluation of CI and we need to know whether we can trust these models. This paper presents an approach we are developing to justify the models used to assure CI using structured assurance cases based on Claims, Arguments and Evidence (CAE). The modelling and quantitative evaluation of the properties are supported by the Preliminary Interdependency Analysis (PIA) method and platform applied to a case study -a reference power transmission network enhanced with an industrial distributed system of monitoring, protection and control. We discuss the usefulness of the modelling and assurance case structuring approaches, some findings from the case study, and outline the directions of further work. Permanent repository link

Security assurance cases—state of the art of an emerging approach

“…We also looked into the authors of the selected papers to find the portion of the papers with at least one author from industry. We found that less than 25% (12 papers) (Cockram and Lautieri 2007;Goodger et al 2012;Netkachova et al 2015;Netkachova and Bloomfield 2016;Xu et al 2017;Gacek et al 2014;Rodes et al 2014;Bloomfield et al 2017;Netkachova et al 2014;Gallo and Dahab 2015;Cheah et al 2018;Ionita et al 2017) included at least one author from industry.…”

“…We also looked into the authors of the selected papers to find the portion of the papers with at least one author from industry. We found that less than 25% (12 papers) [16,28,51,50,79,24,57,11,49,26,14,38] included at least one author from industry.…”

“…Another popular notation is the Claim Argument Evidence (CAE) (Adelard 1998) notation which is suggested by nine studies. Other notations are: text (6 studies), concept maps (Coffey et al 2014) (1), and Claim-Argument-Evidence Criteria (CAEC) (Netkachova and Bloomfield 2016;Netkachova et al 2014Netkachova et al , 2015 notation which is extension of the CAE notation (3 studies of the same authors).…”

“…The data sources vary among the validations, as can be seen in Table 14. We categorize these sources into three main categories: -Research, open source, and in-house projects (20) (Ankrum and Kromholz 2005;Chindamaikul et al 2014;Cockram and Lautieri 2007;Coffey et al 2014;Gacek et al 2014;Haley et al 2005;Hawkins et al 2015;Mohammadi et al 2018;Netkachova et al 2015;Patu and Yamamoto 2013a;Poreddy and Corns 2011;Ray and Cleaveland 2015;Rodes et al 2014;Shortt and Weber 2015;Sklyar and Kharchenko 2019;Sljivo and Gallina 2016;Strielkina et al 2018;Tippenhauer et al 2014;Vivas et al 2011;Gallo and Dahab 2015) -Commercial products / systems (9) (Ben Othmane and Ali 2016;Ben Othmane et al 2014;Calinescu et al 2017;Cheah et al 2018;Goodger et al 2012;Górski et al 2012;Masumoto et al 2013;Xu et al 2017;Netkachova et al 2014) -Standards, regulation, and technical reports (7) (Bloomfield et al 2017;Cyra and Gorski 2007;Finnegan and McCaffery 2014b;Fung et al 2018;Graydon and Kelly 2013;He and Johnson 2012;Sklyar and Kharchenko 2017b) SACs were presented in 31 out of the 36 validations. Representing a complete SAC is mostly not possible even in small illustrative cases due to the amount of information required ...…”

“…While SACs are usually used to establish evidence-based security assurance for a given system, researchers have reported cases where SAC could be used to achieve dif- External forces Comply with security requirements of safety-critical systems Cyra et al [18] External forces Comply with standards and regulation Finnegan et al [20] External forces Comply with regulation and maintain confidence in the product in question Finnegan et al ( 2) [21] External forces Comply with regulation He et al [35] External forces Reason about cybersecurity policies and procedures Mohammadi et al [47] External forces Learn from the safety domain where it is a proven approach Ray et al [56] External forces Comply with regulation and internal needs from cyber-physical systems' manufacturers Sklyar et al ( 2) [63,65,64] External forces Comply with standards Sljivo et al [66] External forces Comply with standards and regulation Strielkina et al [69] External forces Comply with security regulation Goodger et al [28] Knowledge transfer Learn from the safety domain to integrate oversight for safety and security Ionita et al [38] Knowledge transfer Learn from the safety domain where it is a proven approach Netkachova et al ( 2) [49] Knowledge transfer Learn from the safety domain where it is a proven approach Poreddy et al [55] Knowledge transfer Learn from the safety domain, where it is a proven approach Sklyar et al [62] Knowledge transfer Learn from the safety domain, where it is a proven in-use approach Ben Othmane et al [7] Process improvement Trace security requirements and assure security during iterative development. Ben Othmane et al [8] Process improvement Assure security during iterative development Cheah et al [14] Process improvement Cope with the increasing connectivity of systems Cockram et al [16] Process improvement Reduces both technical and program risks through process improvement Gallo et al [26] Process improvement Factor analytical and implementation work per component, requisite, technology, or life-cycle Lipson et al [42] Process improvement Help analyzing complex systems Netkachova et al [50] Process improvement Tackle security issues which have intensified challenges of engineering safety-critical sys...…”