Skip to main content
SpringerLink
Log in

Towards Integrated Quantitative Security and Safety Risk Assessment

  • Conference paper
  • First Online:
Computer Safety, Reliability, and Security (SAFECOMP 2019)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 11699))

Included in the following conference series:

Abstract

Although multiple approaches for the combination of safety and security analysis exist, there are still some major gaps to overcome before they can be used for combined risk management. This paper presents the existing gaps, based on an overview of available methods, which is followed by the proposal towards a solution to achieve coordinated risk management by applying a quantitative security risk assessment methodology. This methodology extends established safety and security risk analysis methods with an integrated model, denoting the relationship between adversary and victim, including the used capabilities and infrastructure. This model is used to estimate the resistance strength and threat capabilities, to determine attack probabilities and security risks.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 59.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 74.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Caltagirone, S., Pendergast, A., Betz, C.: The diamond model of intrusion analysis. Technical report, Center for Cyber Intelligence Analysis and Threat Research Hanover MD (2013)

    Google Scholar 

  2. Cox, A.L.: What’s wrong with risk matrices? Risk Anal. 28(2), 497–512 (2008). https://doi.org/10.1111/j.1539-6924.2008.01030.x

    Article  Google Scholar 

  3. Cox, L.A.: Some limitations of “risk = threat vulnerability consequence” for risk analysis of terrorist attacks. Risk Anal. 28(6), 1749–1761 (2008)

    Article  Google Scholar 

  4. Elmaghraby, A.S., Losavio, M.M.: Cyber security challenges in smart cities: safety, security and privacy. J. Adv. Res. 5(4), 491–497 (2014)

    Article  Google Scholar 

  5. European Commission: A European strategy on Cooperative Intelligent Transport Systems, a milestone towards cooperative, connected and automated mobility. Technical report, European Commission, November 2016

    Google Scholar 

  6. Freund, J.: Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann, Oxford (2015)

    Google Scholar 

  7. Hubbard, D., Evans, D.: Problems with scoring methods and ordinal scales in risk assessment. IBM J. Res. Dev. 54(3), 2 (2010)

    Article  Google Scholar 

  8. Hubbard, D.W., Seiersen, R.: How to Measure Anything in Cybersecurity Risk. Wiley, Hoboken (2016)

    Book  Google Scholar 

  9. IEC: IEC 60812: Analysis techniques for system reliability - Procedure for failure mode and effects analysis (FMEA) (2006)

    Google Scholar 

  10. ISO: ISO 31000 - risk management - guidelines

    Google Scholar 

  11. ISO: ISO 26262 Road vehicles - Functional safety (2011)

    Google Scholar 

  12. ISO/IEC: ISO/IEC directives, part 1

    Google Scholar 

  13. ISO/IEC: ISO/IEC 15408: Information Technology Security Evaluation (2005)

    Google Scholar 

  14. Johnson, C.W.: Why we cannot (yet) ensure the cybersecurity of safety-critical systems. In: Proceedings of 24th Safety-Critical Systems Symposium, pp. 171–182 (2016)

    Google Scholar 

  15. Joint Task Force Transformation Initiative: Guide for conducting risk assessments. https://doi.org/10.6028/NIST.SP.800-30r1

  16. Lisova, E., Sljivo, I., Causevic, A.: Safety and security co-analyses: a systematic literature review (2018)

    Google Scholar 

  17. Macher, G., et al.: Integration of security in the development lifecycle of dependable automotive CPS (2017)

    Google Scholar 

  18. Macher, G., Höller, A., Sporer, H., Armengaud, E., Kreiner, C.: A comprehensive safety, security, and serviceability assessment method. In: Koornneef, F., van Gulijk, C. (eds.) SAFECOMP 2015. LNCS, vol. 9337, pp. 410–424. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-24255-2_30

    Chapter  Google Scholar 

  19. Macher, G., Sporer, H., Berlach, R., Armengaud, E., Kreiner, C.: SAHARA: a security-aware hazard and risk analysis method. In: Design, Automation and Test in Europe Conference and Exhibition (2015)

    Google Scholar 

  20. Malcolm, D.G., Roseboom, J.H., Clark, C.E., Fazar, W.: Application for a technique for research and development program evaluation (1959)

    Google Scholar 

  21. Microsoft Corporation: The STRIDE Threat Model (2005). http://msdn.microsoft.com/en-us/library/ee823878%28v =cs.20%29.aspx

  22. Schmittner, C., Gruber, T., Puschner, P., Schoitsch, E.: Security application of failure mode and effect analysis (FMEA). In: Bondavalli, A., Di Giandomenico, F. (eds.) SAFECOMP 2014. LNCS, vol. 8666, pp. 310–325. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-10506-2_21

    Chapter  Google Scholar 

  23. Schneier, B.: Attack trees (1999). http://www.schneier.com/attacktrees.pdf

  24. International Organization for Standardization (ISO), I.E.C.I.: Information technology – Security techniques – Information security risk management (2008)

    Google Scholar 

  25. The Open Group: Risk Analysis (O-RA), October 2013

    Google Scholar 

  26. The Open Group: Risk Taxonomy (O-RT) 2.0, October 2013

    Google Scholar 

  27. Xu, L.D., Xu, E.L., Li, L.: Industry 4.0: state of the art and future trends. Int. J. Prod. Res. 56(8), 2941–2962 (2018)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Graz University of Technology, 8010, Graz, Austria

    Jürgen Dobaj, Michael Krisper & Georg Macher

  2. AIT Austrian Institute of Technology, 1020, Vienna, Austria

    Christoph Schmittner

Authors
  1. Jürgen Dobaj
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Christoph Schmittner
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Michael Krisper
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Georg Macher
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jürgen Dobaj .

Editor information

Editors and Affiliations

  1. Newcastle University, Newcastle-upon-Tyne, UK

    Alexander Romanovsky

  2. Åbo Akademi University, Turku, Finland

    Elena Troubitsyna

  3. City, University of London, London, UK

    Ilir Gashi

  4. AIT Austrian Institute of Technology, Vienna, Austria

    Erwin Schoitsch

  5. Thales Deutschland GmbH, Berlin, Germany

    Friedemann Bitsch

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Dobaj, J., Schmittner, C., Krisper, M., Macher, G. (2019). Towards Integrated Quantitative Security and Safety Risk Assessment. In: Romanovsky, A., Troubitsyna, E., Gashi, I., Schoitsch, E., Bitsch, F. (eds) Computer Safety, Reliability, and Security. SAFECOMP 2019. Lecture Notes in Computer Science(), vol 11699. Springer, Cham. https://doi.org/10.1007/978-3-030-26250-1_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-26250-1_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-26249-5

  • Online ISBN: 978-3-030-26250-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation