A goal‐driven approach for the joint deployment of safety and security standards for operators of essential services. Issue 9 (31st March 2021)

• Record Type: Journal Article
• Authors: Ponsard, Christophe; Grandclaudon, Jeremy; Massonet, Philippe
• Other Names: Biró Miklós guestEditor.; Mashkoor Atif guestEditor.; Sametinger Johannes guestEditor.
• Is Part Of: Journal of software. Volume 33:Issue 9(2021)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2021-03-31
• Subjects: co‐engineering -- cyber security -- NIS directive -- risk management -- safety analysis -- standards; Software engineering -- Periodicals; Computer software -- Development -- Periodicals; Software maintenance -- Periodicals; 005.1
• DOI: 10.1002/smr.2338
• Languages: English
• ISSNs: 2047-7473

Abstract

Summary: Designing safety‐critical software in domains ensuring essential services like transportation, energy, or health requires high assurance techniques and compliance with domain specific standards. As a result of the global interconnectivity and the evolution toward cyber‐physical systems, the increasing exposure to cyber threats calls for the adoption of cyber security standards and frameworks. Although safety and security have different cultures, both fields share similar concepts and tools and are worth being investigated together. This paper provides the background to understand emerging co‐engineering approaches. It advocates for the use of a model‐based approach to provide a sound risk‐oriented process and to capture rationales interconnecting top‐level standards/directives to concrete safety/security measures. We show the benefits of adopting goal‐oriented analysis that can be transposed later to domain‐specific frameworks. Both qualitative and quantitative reasoning aspects are analyzed and discussed, especially to support trade‐off analysis. Our work is driven by a representative case study in drinking water utility in the scope of the NIS regulation for operator of essential services.