[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
research-article

A goal‐driven approach for the joint deployment of safety and security standards for operators of essential services

Published: 12 September 2021 Publication History

Summary

Designing safety‐critical software in domains ensuring essential services like transportation, energy, or health requires high assurance techniques and compliance with domain specific standards. As a result of the global interconnectivity and the evolution toward cyber‐physical systems, the increasing exposure to cyber threats calls for the adoption of cyber security standards and frameworks. Although safety and security have different cultures, both fields share similar concepts and tools and are worth being investigated together. This paper provides the background to understand emerging co‐engineering approaches. It advocates for the use of a model‐based approach to provide a sound risk‐oriented process and to capture rationales interconnecting top‐level standards/directives to concrete safety/security measures. We show the benefits of adopting goal‐oriented analysis that can be transposed later to domain‐specific frameworks. Both qualitative and quantitative reasoning aspects are analyzed and discussed, especially to support trade‐off analysis. Our work is driven by a representative case study in drinking water utility in the scope of the NIS regulation for operator of essential services.

References

[1]
International Organization for Standardization . Iso 31000, risk management ‐ guidelines, provides principles, framework. https://www.iso.org/iso-31000-risk-management.html; 2018.
[2]
Avizienis A, Laprie JC, Randell B, Landwehr C. Basic concepts and taxonomy of dependable and secure computing. IEEE Trans Dependable Secure Comput. 2004;1(1):11‐33.
[3]
Rajkumar R, Lee I, Sha L, Stankovic J. Cyber‐physical systems: the next computing revolution. In: Proc. of the 47th Design Automation Conference (DAC) ACM/IEEE; 2010:731‐736.
[4]
Biro M, Mashkoor A, Sametinger J, Seker R. Software safety and security risk mitigation in cyber‐physical systems. IEEE Softw. 2018;35(1):24‐29.
[5]
Greenberg A. Hackers Remotely Kill a Jeep on the Highway. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway; 2015.
[6]
Kumar M. Hacker Demonstrates How Easy In‐flight Entertainment System Can Be Hacked. https://thehackernews.com/2016/12/hacking-in-flight-system.html; 2016.
[7]
Wolf M, Serpanos D. Safety and security of cyber‐physical and internet of things systems [point of view]. Proc of the IEEE. 2017;105(6):983‐984.
[8]
Kamal SZ, Al Mubarak SM, Scodova BD, Naik P, Flichy P, Coffin G, et al. IT and OT convergence‐opportunities and challenges. In: SPE Intelligent Energy International Conference and Exhibition. Society of Petroleum Engineers; 2016.
[9]
Paul S, Rioux L. Over 20 years of research in cybersecurity and safety engineering: a short bibliography. In: 6th International Conference on Safety and Security Engineering (SAFE); 2015.
[10]
Macher G, Höller A, Sporer H, Armengaud E, Kreiner C. A combined safety‐hazards and security‐threat analysis method for automotive systems. In: Proc. SAFECOMP. Springer International Publishing; 2015.
[11]
Schmittner C, Ma Z. Towards a framework for alignment between automotive safety and security standards. Proc. of safecomp workshop on computer safety, reliability, and security: Springer; 2015:133‐143.
[12]
Schoitsch E, Schmittner C, Ma Z, Gruber T. The need for safety and cyber‐security co‐engineering and standardization for highly automated automotive vehicles. Advanced Microsystems for Automotive Applications: Springer; 2016.
[13]
Chen YR, Chen SJ, Hsiung PA, Chou IH. Unified security and safety risk assessment—a case study on nuclear power plant. In: Proc. Int. Conf. on Trustworthy Systems and their Applications; 2014.
[14]
Park J, Suh Y, Park C. Implementation of cyber security for safety systems of nuclear facilities. Prog Nucl Energy. 2016;88:88‐94.
[15]
Chen B, Schmittner C, Ma Z, Temple WG, Dong X, Jones DL, Sanders WH. Security analysis of urban railway systems: the need for a cyber‐physical perspective. In: Proc. SAFECOM. Springer International Publishing; 2015.
[16]
Hessami A. A systems view of railway safety and security. In: Zboinski K, ed. Railway research. Rijeka: InTech; 2015.
[17]
Howe N. Cybersecurity in railway signalling systems. Institution of Railways Signal Engineers News; 2017.
[18]
[19]
Ponsard C, Dallons G, Massonet P. Goal‐oriented co‐engineering of security and safety requirements in cyber‐physical systems. In: Proc. SASSUR workshop of Computer Safety, Reliability, and Security, Trondheim SAFECOMP; 2016.
[20]
Mashkoor A, Biró M, Messnarz R, Palacios RC. Selected functional safety and cybersecurity concerns in system, software, and service process improvement and innovation. J Softw Evol Process. 2018;30(5):e1955.
[21]
Schneider D, Braband J, Schoitsch E, Uhrig S, Katzenbeisser S. Safety and security coengineering in embedded systems. Secur Commun Netw. 2019;2019:1‐2. https://www.hindawi.com/journals/scn/2019/5381856/
[22]
Kavallieratos G, Katsikas S, Gkioulos V. Cybersecurity and safety co‐engineering of cyberphysical systems—a comprehensive survey. Future Internet. 2020;12:65.
[23]
Mashkoor A, Sametinger J, Biró M, Egyed A. Security‐ and safety‐critical cyber‐physical systems. J Softw Evol Process. 2020;32(2).
[24]
International Electrotechnical Commission . Iec 62443 security for industrial automation and control systems ‐ part 4‐1: Secure product development lifecycle requirements. https://webstore.iec.ch/publication/33615; 2018.
[25]
International Electrotechnical Commission . Iec 61508 ‐ functional safety of electrical/electronic/programmable electronic safety‐related systems. http://www.iec.ch/functionalsafety; 2010.
[26]
RTCA . DO‐178C ‐ Software Considerations in Airborne Systems and Equipment Certification. https://www.rtca.org/products; 2012.
[27]
EU . Directive (EU) 2016/1148 of the European Parliament and of the council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. http://data.europa.eu/eli/dir/2016/1148/oj; 2016.
[28]
Ponsard C, Grandclaudon J, Massonet P, Touzani M. Assessment of emerging standards for safety and security co‐design on a railway case study. In: Proc. of the IWCFS Workshop of New Trends in Model and Data Engineering, Marrakesh, Morocco, Oct. 24‐26. Springer MEDI; 2018:130‐145.
[29]
van Lamsweerde A, Letier E. Handling obstacles in goal‐oriented requirements engineering. IEEE Trans Software Eng. 2000;26(10):978‐1005.
[30]
Yu E, Mylopoulos J. Enterprise modelling for business redesign: the i* framework. SIGGROUP Bull. 1997;18(1):59‐63.
[31]
Elahi G, Yu E, Zannone N. A vulnerability‐centric requirements engineering framework: analyzing security attacks, countermeasures, and requirements based on vulnerabilities. Requir Eng. 2010;15(1):41‐62.
[32]
Ponsard C, Darimont R. Towards multi‐objective optimisation of quantitative goal models using constraint programming. In: Proc. of the 9th Int. Conf. on Operations Research and Enterprise Systems (ICORES), Valletta, Malta, February. SciTePress; 2020:286‐292.
[33]
Ponsard C, Darimont R. Towards quantitative trade‐off analysis in goal models with multiple obstacles using constraint programming. In: Proc. of the 15th Int. Conf. on Soft. Tech. (ICSOFT), online, July. SciTePress; 2020.
[34]
Fovino IN, Masera M, De Cian A. Integrating cyber attacks within fault trees. Reliab Eng Syst Saf. 2009;94(9):1394‐1402.
[35]
CENELEC . EN 50128 ‐ Railway applications ‐ Communications, signalling and processing systems ‐ Software for railway control and protection systems. https://standards.globalspec.com/std/1678027/cenelec-en-50128; 2011.
[36]
Zeller M, Höfig K, Rothfelder M. Towards a cross‐domain software safety assurance process for embedded systems. In: Proc. of SAFECOMP Workshop on Computer Safety, Reliability, and Security Bondavalli A, Ceccarelli A, Ortmeier F, eds. Springer International Publishing; 2014:396‐400.
[37]
Blanquart JP, Astruc JM, Baufreton P, Boulanger JL, Delseny H, Gassino J, Qu P. Criticality categories across safety standards in different domains. In: ERTS‐2012; 2012; Toulouse.
[38]
Machrouh J, Blanquart J‐P, Baufreton P, Boulanger J‐L, Delseny H, Gassino J, Ladier G, Ledinot E, Leeman M, Astruc J‐M, Quéré P, Ricque B, Deleuze G. A cross‐domain comparison of software development assurance standards. Proc. of ERTS2; 2012.
[39]
Hulsebosch B, van Velzen A. Inventory and Classification of Cybersecurity Standards. Ministry of Security and Justice of the Netherlands; 2015.
[40]
Beckers I, Fenz S, Hatebur D, Heisel M. A structured comparison of security standards. Engineering secure future internet services and systems: Current research: Springer International Publishing; 2014.
[41]
Paul S, Brunel J, Rioux L, Valle F, Oliveira J, Gailliard G, Gilbert J‐L, Wiander T, El Bakkali M, Faucogney A, Chemouil D. Recommendations for security and safety co‐engineering (release nr.3) ‐ parts a & b. http://www.merge-project.eu; 2016.
[42]
Schmittner C, Ma Z, Smith P. Fmvea for safety and security analysis of intelligent and cooperative vehicles. In: Proc. of SAFECOMP Workshop on Computer Safety, Reliability, and Security. Springer International Publishing; 2014:282‐288.
[43]
Raspotnig C, Katta V, Karpati P, Opdahl AL. Enhancing chassis: a method for combining safety and security. In: Proc. of the International Conference on Availability, Reliability and Security. IFIP; 2013:766‐773.
[44]
Kanamaru H. Bridging functional safety and cyber security of SIS/SCS. In: Proc. of the 56th Annual Conf. of the Society of Instrument and Control Engineers of Japan. SICE; 2017.
[45]
van Lamsweerde A. Requirements Engineering—From System Goals to UML Models to Software Specifications: Wiley; 2009.
[46]
ITU . Recommendation Z.151 (10/12), User Requirements Notation ‐ Language Def. https://www.itu.int/rec/T-REC-Z.151; 2012.
[47]
ACWG . Goal Structuring Notation Community Standard, Version 2. The Assurance Case Working Group https://scsc.uk/r141B%3A1%3Ft%3D1; 2018.
[48]
van Lamsweerde A, Brohez S, De Landtsheer R, Janssens D. From system goals to intruder anti‐goals: attack generation and resolution for security requirements engineering. In: Proc. 2nd International Workshop on Requirements Engineering for High Assurance Systems RHAS'03; 2003:49‐56.
[49]
Ericson C. Fault Tree Analysis ‐ A History. 17th International System Safety Conference; 1999.
[50]
Schneier B. Attack trees. Dr. Dobb's journal; 1999.
[51]
Akhigbe O, Amyot D, Richards G. A systematic literature mapping of goal and non‐goal modelling methods for legal and regulatory compliance. Requirements Engineering; 2018.
[52]
Ingolfo S, Siena A, Mylopoulos J. Nomos 3: reasoning about regulatory compliance of requirements. In: Proc. 22nd Int. Requirements Engineering Conference (RE). IEEE; 2014:313‐314.
[53]
Darimont R, Lemoine M. Goal‐oriented analysis of regulations. In: Workshop on Regulations Modelling and their V&V (ReMo2V), Luxemburg, June 5‐9. CAISE; 2006.
[54]
Ghanavati S, Amyot D, Rifaut A. Legal goal‐oriented requirement language for modeling regulations. In: Proc. 6th Int. Workshop on Modeling in Software Engineering (MiSE). IEEE; 2014.
[55]
Dalpiaz F, Franch X, Horkoff J. Istar 2.0 language guide. CoRR abs/1605.07767, http://arxiv.org/abs/1605.07767; 2016.
[56]
Pimentel J. Pistar tool for i* 2.0. https://www.cin.ufpe.br/∼jhcp/pistar; 2018.
[57]
Respect‐IT . The Objectiver Goal‐Oriented Requirements Engineering Tool. http://www.objectiver.com; 2005.
[58]
Ottawa U. jUCMNav: Juice up your modelling. https://www.openhub.net/p/jucmnav; 2001.
[59]
Zhou J, Hnninen K, Lundqvist K, Provenzano L. An ontological approach to identify the causes of hazards for safety‐critical systems. In: Proc. of the 2nd International Conference on System Reliability and Safety (ICSRS). Springer International Publishing; 2017:405‐413.
[60]
Kumar R, Stoelinga M. Quantitative security and safety analysis with attack‐fault trees. In: Proc. of the 18th International Symposium on High Assurance Systems Engineering (HASE). ACM; 2017:25‐32.
[61]
Hassanzadeh A, Rasekh A, Galelli S, Aghashahi M, Taormina R, Ostfeld A, Banks MK. A review of cybersecurity incidents in the water sector. J Environ Eng. 2020;146(5):03120003.
[62]
ENISA . Mapping of OES Security Requirements to Specific Sectors. https://www.enisa.europa.eu; 2017.
[64]
Thomas S. 4 OT/IT network segmentation techniques. http://bit.do/it-ot-segmentation; 2019.
[65]
Shaw ED, Ruby KG, Post JM. The insider threat to information systems. Secur Aware Bull. 1998;2(98):1‐10.
[67]
Rashid A, Naqvi SAA, Ramdhany R, Edwards M, Chitchyan R, Babar MA. Discovering “unknown known” security requirements. In: Proc. of the 38th International Conference on Software Engineering (ICSE). IEEE/ACM; 2016:866‐876.
[68]
Jarman A. Nc public water supply rules and regulations update. Public Water Supply Section NCDENR; 2015.
[69]
Weiss J. Industrial control system (ICS) cyber security for water and wastewater systems. Securing Water and Wastewater Systems. Cham: Springer; 2014:87‐105.
[70]
Harman M. The current state and future of search based software engineering. In: Proc. of Future of Software Engineering (FOSE '07). IEEE/ACM ICSE Conference; 2007:342‐357.
[71]
van Harmelen F, Lifschitz V, Porter B. Handbook of Knowledge Representation: Elsevier Science; 2008. https://books.google.be/books%3Fid%3DxwBDylHhJhYC
[72]
Vincoli JW. Fault tree analysis. Basic guide to system safety. New York: John Wiley & Sons, Ltd; 2005:139‐151.
[73]
Brooke PJ, Paige RF. Fault trees for security system design and analysis. Comput Secur. 2003;22(3):256‐264.
[74]
Khand PA. System level security modeling using attack trees. In: Proc. of the 2nd Int. Conf. on Computer, Control and Communication. IEEE; 2009:1‐6.
[75]
Wang J, Whitley J, Phan R, Parish D. Unified parametrizable attack tree. Int J Inf Secur Res. 2011;1:20‐26.
[76]
Ketel M. It security risk management. In: Proc. of the 46th Annual Southeast Regional Conference on XX. ACM; 2008.
[77]
OscaR Team . OscaR: Operational Research in Scala. Available under the LGPL licence from, https://bitbucket.org/oscarlib/oscar; 2012.
[78]
Kriaa S, Bouissou M, Colin F, Halgand Y, Pietre‐Cambacedes L. Safety and security interactions modeling using the bdmp formalism: Case study of a pipeline. In: Proc. of SAFECOMP Workshop on Computer Safety, Reliability, and Security. Springer International Publishing; 2014:326‐341.
[79]
Brunner M, Huber M, Sauerwein C, Breu R. Towards an integrated model for safety and security requirements of cyber‐physical systems. In: Proc. Int. Conf. on Software Quality, Reliability and Security Companion (QRS‐C). IEEE; 2017:334‐340.
[80]
Monteiro R, Araujo J, Amaral V, Goulao M, Patricio P. Model‐driven development for requirements engineering: The case of goal‐oriented approaches. In: Proc. of the 8th Int. Conf. on the Quality of Information and Communications Technology. IEEE Computer Society; 2012:75‐84.
[81]
Bezzateev S, Voloshina N, Sankin P. Joint safety and security analysis for complex systems. In: Proc. of the 13th Conference of Open Innovations Association FRUCT. FRUCT Oy; 2013:3‐13.
[82]
Kornecki A, Liu M. Fault tree analysis for safety/security verification in aviation software. Electronics. 2013;2:41‐56.
[83]
Bakirtzis G, Sherburne T, Adams S, Horowitz BM, Beling PA, Fleming CH. An ontological metamodel for cyber‐physical system safety, security, and resilience coengineering. https://arxiv.org/abs/2006.05304; 2020.
[84]
André E, Lime D, Ramparison M, Stoelinga M. Parametric analyses of attack‐fault trees. In: Proc. of the 19th Int. Conference on Application of Concurrency to System Design (ACSD). IEEE; 2019:33‐42.
[85]
Darimont R, van Lamsweerde A. Formal refinement patterns for goal‐driven requirements elaboration. In: Proc. of the Fourth ACM Symposium on Foundations of Software Engineering, October 16‐18. ACM; 1996; San Francisco, California, USA:179‐190.
[86]
Ponsard C, Massonet P, Dallons G. Cross‐domain fertilisation in the evolution towards autonomous vehicles. ERCIM News. 2017;109:37‐38. https://ercim-news.ercim.eu/en109/special/cross-domain-fertilisation-in-the-evolution-towards-autonomous-vehicles
[87]
Ponsard C, Darimont R. Improving requirements engineering through goal‐oriented models and tools: Feedback from a large industrial deployment. In: Proc. of the 12th Int. Conference on Software Technologies, ICSOFT, July 24‐26. SciTePress; 2017; Madrid, Spain:372‐381.
[88]
Ameur‐Boulifa R, Lugou F, Apvrille L. Sysml model transformation for safety and security analysis. In: Security and Safety Interplay of Intelligent Software Systems, LNCS 11552 Hamid B, Gallina B, Shabtai A, Elovici Y, Garcia‐Alfaro J, eds. Springer International Publishing; 2019:35‐49.
[90]
Roques P. Systems architecture modeling with the arcadia method ‐ a practical guide to capella: ISTE Press, Elsevier; 2017.
[91]
[93]
Mauw S, Oostdijk M. Foundations of attack trees. In: Information Security and Cryptology (ICISC) Won DH, Kim S, eds. Springer Berlin Heidelberg; 2006:186‐198.
[94]
Kumar R, Ruijters E, Stoelinga M. Quantitative attack tree analysis via priced timed automata. In: Formal Modeling and Analysis of Timed Systems (FORMAT). Springer; 2015.
[95]
Mantel H, Probst CW. On the meaning and purpose of attack trees. In: Proc. of the 32nd Computer Security Foundations Symposium (CSF). IEEE; 2019.
[96]
Heaven W, Letier E. Simulating and optimising design decisions in quantitative goal models. In: Proc. of the 19th Int. Requirements Engineering Conference, Aug. 29 ‐ Sept. 2. IEEE; 2011; Trento, Italy:79‐88.
[97]
Kumar R, Schürr A. Effective analysis of attack trees: a model‐driven approach. In: Fundamental Approaches to Software Engineering. Springer International Publishing; 2018:56‐73.
[98]
Telecom Paris‐Tech . TTool/AVATAR ‐ Automated Verification of reAl Time softwARe. https://ttool.telecom-paris.fr/avatar.html; 2011.
[99]
Mashkoor A, Egyed A, Wille R. Model‐driven engineering of safety and security systems: A systematic mapping study. https://arxiv.org/abs/2004.08471; 2020.
[100]
Bennett P. Roadmap Secure Control Systems in the Water Sector. American Water Works Association; 2008.
[101]
Germano JH. Cybersecurity Risk & Responsibility in the Water Sector. American Water Works Association; 2019.
[102]
Macher G, Sporer H, Berlach R, Armengaud E, Kreiner C. Sahara: a security‐aware hazard and risk analysis method. In: Proc of Design, Automation Test in Europe Conference Exhibition (DATE); 2015:621‐624.
[103]
Roudier Y, Apvrille L. Sysml‐sec—a model driven approach for designing safe and secure systems. In: Proc. of the 3rd International Conference on Model‐Driven Engineering and Software Development. SciTePress; 2015:655‐664.
[104]
Apvrille L, Roudier Y. Model‐driven engineering and software development. Switzerland: Springer International Publishing; 2016;293‐308.
[105]
Kelly T, Weaver R. The goal structuring notation—a safety argument notation. In: Proc. of Dependable Systems and Networks Workshop on Assurance Cases. IEEE; 2004.
[106]
Jürjens J. Umlsec: Extending UML for secure systems development. In: Proc. UML 2002 ‐ The Unified Modeling Language Jézéquel J‐M, Hussmann H, Cook S, eds. Springer; 2002:412‐425.
[107]
Madni A, Purohit S. Economic analysis of model‐based systems engineering. Systems. 2019;7:12.
[108]
Kriaa S, Pietre‐Cambacedes L, Bouissou M, Halgand Y. A survey of approaches combining safety and security for industrial control systems. Reliab Eng Syst Saf. 2015;139:156‐178.
[109]
van Lamsweerde A. Goal‐oriented requirements engineering: A guided tour. In: Proc of the 5th Int. Symposium on Requirements Engineering, 27‐31 Aug.; 2001; Toronto, Canada.

Cited By

View all
  • (2024)Which Attacks Lead to Hazards? Combining Safety and Security Analysis for Cyber-Physical SystemsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2023.330977821:4(2526-2540)Online publication date: 1-Jul-2024
  • (2023)Context modeling for cyber‐physical systemsJournal of Software: Evolution and Process10.1002/smr.245135:7Online publication date: 2-Jul-2023
  • (2022)Survey of automation practices in model-driven development and operationsProceedings of the Fourth International Workshop on Bots in Software Engineering10.1145/3528228.3528405(14-17)Online publication date: 9-May-2022

Index Terms

  1. A goal‐driven approach for the joint deployment of safety and security standards for operators of essential services
          Index terms have been assigned to the content through auto-classification.

          Recommendations

          Comments

          Please enable JavaScript to view thecomments powered by Disqus.

          Information & Contributors

          Information

          Published In

          cover image Journal of Software: Evolution and Process
          Journal of Software: Evolution and Process  Volume 33, Issue 9
          September 2021
          140 pages
          ISSN:2047-7473
          EISSN:2047-7481
          DOI:10.1002/smr.v33.9
          Issue’s Table of Contents

          Publisher

          John Wiley & Sons, Inc.

          United States

          Publication History

          Published: 12 September 2021

          Author Tags

          1. co‐engineering
          2. cyber security
          3. NIS directive
          4. risk management
          5. safety analysis
          6. standards

          Qualifiers

          • Research-article

          Contributors

          Other Metrics

          Bibliometrics & Citations

          Bibliometrics

          Article Metrics

          • Downloads (Last 12 months)0
          • Downloads (Last 6 weeks)0
          Reflects downloads up to 25 Dec 2024

          Other Metrics

          Citations

          Cited By

          View all
          • (2024)Which Attacks Lead to Hazards? Combining Safety and Security Analysis for Cyber-Physical SystemsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2023.330977821:4(2526-2540)Online publication date: 1-Jul-2024
          • (2023)Context modeling for cyber‐physical systemsJournal of Software: Evolution and Process10.1002/smr.245135:7Online publication date: 2-Jul-2023
          • (2022)Survey of automation practices in model-driven development and operationsProceedings of the Fourth International Workshop on Bots in Software Engineering10.1145/3528228.3528405(14-17)Online publication date: 9-May-2022

          View Options

          View options

          Media

          Figures

          Other

          Tables

          Share

          Share

          Share this Publication link

          Share on social media