A security risk mitigation framework for cyber physical systems. Issue 2 (29th August 2019)

• Record Type: Journal Article
• Authors: Zahid, Maryam; Inayat, Irum; Daneva, Maya; Mehmood, Zahid
• Other Names: Mashkoor Atif guestEditor.; Sametinger Johannes guestEditor.; Biro Miklós guestEditor.; Egyed Alexander guestEditor.
• Is Part Of: Journal of software. Volume 32:Issue 2(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-08-29
• Subjects: case study -- cryptosystem -- cyber physical systems (CPS) -- cyber security -- risk assessment -- risk identification -- risk management -- risk mitigation -- security; Software engineering -- Periodicals; Computer software -- Development -- Periodicals; Software maintenance -- Periodicals; 005.1
• DOI: 10.1002/smr.2219
• Languages: English
• ISSNs: 2047-7473

Abstract

Abstract: Cyber physical systems (CPSs) are safety‐critical, be it weapon systems, smart medical devices, or grid stations. This makes ensuring security of all the components constituting a CPS unavoidable. The rise in the demand of interconnectedness has made such systems vulnerable to attacks, ie, cyberattacks. Over 170 cases of cyber‐security breaches in CPS were reported over the past two decades. An increase in the number of cyberattack incidents on CPS makes them more exposed and less trustworthy. However, identifying the security requirements of the CPS to pinpoint the relevant risks may help to counteract the potential attacks. Literature reveals that the most targeted security requirements of CPS are authentication, integrity, and availability. However, little attention has been paid on certain crucial security attributes such as data freshness and nonrepudiation. One major reason of security breaches in CPS is the lack of custom or generalized countermeasures. Therefore, we propose a security risk mitigation framework for a CPS focused on constraints, ie, authentication, data integrity, data freshness, nonrepudiation, and confidentiality. Furthermore, we evaluate the proposed work using a case study of a safety critical system. The results show a decrease in the severity of the identified security risks, ie, man‐in‐the‐middle attack, spoofing, and data tempering.