Realizing the benefits of safety-security co-analysis through effective tool support

Introduction

Effective tool support for the joint analysis of safety and security risks is long overdue.

Importance of Risk Management

Risk management is an important activity to ensure the reliable functioning of technology, such as power plants and self-driving cars. Risks include both safety (accidental failures) and security aspects (malicious attacks). Historically, safety and security risks have been analyzed in isolation, despite often conflicting with each other.

Need for Combined Analysis

Effective decision-making requires considering safety and security risks in combination, as measures that increase safety may decrease security and vice versa.

Framework Development

My Consolidator Grant CAESAR has laid out the groundwork for a safety-security co-analysis framework:

1. A graphical risk model, mapping how vulnerabilities and failures propagate and cause system-level disruptions.
2. Efficient algorithms to compute risk metrics, indicating how well a system performs in terms of safety-security.
3. Algorithms that quantify the uncertainty of the analysis algorithms.

Project Goals

In RUBICON, I will develop a PoC software tool that supports methods from CAESAR, advancing from TRL1 to TRL3. Key challenges to be tackled include:

• Scaling Up Analysis Methods: Handle industry-size problems by tailoring algorithms to work with specific subclasses that appear in practice.
• Improving Interpretability: Develop diagnostic feedback methods based on counterexample analysis and importance factors.
• Multi-objective Optimization Techniques: When dealing with multiple, interdependent parameters, conflicting requirements often arise due to resource constraints and varying priorities. RUBICON will develop optimal strategies to effectively balance such conflicts, exploiting and advancing Pareto-analysis.

Testing and Validation

The proof-of-concept tool will be tested and validated via lab and pilot studies across different industrial domains.

Market Analysis

A serious market analysis will lay out an actionable strategy to commercialize the PoC tool post-project.