A methodology for assuring the safety and security of critical infrastructure based on STPA and Event-B. (19th March 2019)

• Record Type: Journal Article
• Authors: Howard, Giles; Butler, Michael; Colley, John; Sassone, Vladimiro
• Is Part Of: International journal of critical computer-based systems. Volume 9:Number 1/2(2019)
• Page Start: 56
• Page End: 75
• Publication Date: 2019-03-19
• Subjects: systems theoretic process analysis -- STPA -- hazard analysis -- Event-B -- safety analysis -- security analysis -- critical infrastructure -- cyber-physical systems -- adversarial modelling -- critical systems; Computer systems -- Periodicals; Computer architecture -- Periodicals; 004
• Languages: English
• ISSNs: 1757-8779

Abstract

Cyber-physical systems represent a challenge to conventional security and safety analysis techniques due to their complexity and the need to consider both safety and security equally. It is also important that the requirements generated to mitigate against safety and security risks are clear and adequately address the underlying issue. A methodology is presented in this paper to allow for integrated safety and security analysis of cyber-physical systems, particularly in a critical infrastructure context. This methodology uses a modified form of STPA, which has been coupled with our concept of adversarial modelling, to analyse for security and safety hazards which are then mitigated against by the creation of critical requirements. These critical requirements are then validated through their application to an Event-B formal model, allowing for their completeness to be verified. The output of the methodology is a set of critical requirements that guide iteration of and improvements to the system design to ensure its safety and security are maintained.