Assessing system of systems information security risk with OASoSIS. Issue 117 (June 2022)

• Record Type: Journal Article
• Authors: Ki-Aries, Duncan; Faily, Shamal; Dogan, Huseyin; Williams, Christopher
• Is Part Of: Computers & security. Issue 117(2022)
• Publication Date: 2022-06
• Subjects: System of systems -- Information security -- Risk -- Human factors -- Requirements engineering -- CAIRIS; CAIRIS Computer Aided Integration of Requirements and Information Security -- Dstl Defence Science and Technology Laboratory -- EHR Electronic Health Record -- EMT Emergency Medical Technician -- FMC Field Medical Card -- FOB Forward Operating Base -- FST Forward Surgical Team -- HFSI Human Factors System Integration -- JOC Joint Operations Centre -- JMeWS Joint Medical Workstation -- MEDEVAC Medical Evacuation -- MMN MEDEVAC Mission Network -- NATO The North Atlantic Treaty Organisation -- OA OCTAVE Allegro -- OASoSIS OCTAVE Allegro for SoS Information Security with CAIRIS -- OCTAVE The Operationally Critical Threat, Asset, and Vulnerability Evaluation -- PECC Patient Evacuation Co-ordination Cell -- PMR Patient Movement Request -- PoI Point of Injury -- RBDM Risk-Based Decision Making -- SoS System of Systems -- SoSs Systems of Systems (Plural) -- SoSRE SoS Requirements Engineering -- TCN Troop Contributing Nation -- TDMS Theatre Medical Data Store; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102690
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: The term System of Systems (SoS) is used to describe the coming together of independent systems, collaborating to achieve a new or higher purpose. However, the SoS concept is often misunderstood within operational environments, providing challenges towards the secure design and operation of SoSs. Limitations in existing literature indicates a need for discovery towards identifying a combination of concepts, models, and techniques suitable for assessing SoS security risk and related human factor concerns for SoS Requirements Engineering. In this article, we present OASoSIS, representing an information security risk assessment and modelling process to assist risk-based decision making in SoS Requirements Engineering. A characterisation process is introduced to capture the SoS context, supporting a SoS security risk assessment process that extends OCTAVE Allegro towards a SoS context. Resulting risk data provides a focused means to assess and model the SoS information security risk and related human factors, integrating tool-support using CAIRIS. A medical evacuation SoS case study scenario was used to test, illustrate, and validate the alignment of concepts, models, and techniques for assessing SoS information security risks with OASoSIS, where findings provide a positive basis for future work.