Abstract:By exploiting the increasing surface attack of systems, cyber-attacks can cause catastrophic events, such as, remotely disable safety mechanisms. This means that in order to avoid hazards, safety and security need to be integrated, exchanging information, such as, key hazards/threats, risk evaluations, mechanisms used. This white paper describes some steps towards this integration by using models. We start by identifying some key technical challenges. Then we demonstrate how models, such as Goal Structured Notation (GSN) for safety and Attack Defense Trees (ADT) for security, can address these challenges. In particular, (1) we demonstrate how to extract in an automated fashion security relevant information from safety assessments by translating GSN-Models into ADTs; (2) We show how security results can impact the confidence of safety assessments; (3) We propose a collaborative development process where safety and security assessments are built by incrementally taking into account safety and security analysis; (4) We describe how to carry out trade-off analysis in an automated fashion, such as identifying when safety and security arguments contradict each other and how to solve such contradictions. We conclude pointing out that these are the first steps towards a wide range of techniques to support Safety and Security Engineering. As a white paper, we avoid being too technical, preferring to illustrate features by using examples and thus being more accessible.

Software security concerns modeling method based on UML extension

Security Design Based on Social Modeling

A Threat Model Driven Approach for Security Testing

Analysing security requirements patterns based on problems decomposition and composition.

Towards A Structured Model for Software Vulnerabilities

Business Activity-Oriented Security Model of Information Systems

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Object-oriented Methodology Meets MDA Software Paradigm

Applying Robustness Analysis to MDA Software Paradigm

Formal security analysis for software architecture design: An expressive framework to emerging architectural styles

A 3-D Security Modeling Platform for Social IoT Environments

IoTsecM: A UML/SysML Extension for Internet of Things Security Modeling

Modeling and Integrating Aspects with UML Activity Diagrams

Multi-Tier Security Feature Modeling for Service-Oriented Application Integration

Analyzing security requirements as relationships among strategic actors

A Unified Use-Misuse Case Model for Capturing and Analysing Safety and Security Requirements

Model-Based Safety and Security Engineering

Safety Requirements Modeling Based on Rucm

A Relational Model for Formal Object-Oriented Requirement Analysis in UML