The importance of (physical) security is increasingly acknowledged by society and the scientific community. In light of increasing terrorist threat levels, numerous security assessments of critical infrastructures are conducted in practice and researchers propose new approaches continuously. While practical security risk assessments (SRA) use mostly qualitative methods, most of the lately proposed approaches are based on quantitative metrics. Due to little evidence of actual attacks, both qualitative and quantitative approaches suffer from the fundamental problem of inherent uncertainties regarding threats and capabilities of security measures as a result from vague data or the usage of expert knowledge. In quantitative analysis, such uncertainties may be represented by, e.g., probability distributions to reflect the knowledge on security measure performance available. This paper focuses on the impact of these uncertainties in security assessment and their consideration in system design. We show this influence by comparing the results of a scalar evaluation that does not take into account uncertainties and another evaluation based on distributed input values. In addition, we show that the influence is concentrated on certain barriers of the security system. Specifically, we discuss the robustness of the system by conducting quantitative vulnerability assessment as part of the SRA process of an airport structure example. Based on these results, we propose the concept of a security margin. This concept accounts for the uncertain knowledge of the input parameters in the design of the security system and minimizes the influence of these uncertainties on the actual system performance. We show how this approach can be used for vulnerability assessment by applying it to the initially assessed configuration of the airport structure. The results of this case study support our assumptions that the security margin can help in targeted uncertainty consideration leading to reduced system vulnerability.

Abstract. Global smart spaces are intended to provide their inhabitants with context-aware access to pervasive services and information relevant to large geographical areas. Transportation is one obvious domain for such global smart spaces since applications can be built to exploit the variety of sensor-rich systems that have been deployed to support urban traffic control and highway management as well as within individual vehicles. This paper presents a spatial programming model designed to provide a standardised way to build contextaware global smart space applications using information that is distributed across independent (legacy, sensor-enabled, and embedded) systems by exploiting the overlapping spatial and temporal attributes of the information maintained by these systems. The spatial programming model is based on a topographical approach to modelling space that enables systems to independently define and use potentially overlapping spatial context in a consistent manner and in contrast to topological approaches, in which geographical relationships between objects are described explicitly. Moreover, this approach facilitates the incremental construction of global smart spaces since the underlying systems to be incorporated are largely decoupled. The programming model has been evaluated by building a context-aware service for multi-modal urban journey planning, as part of the development of an overall architecture for intelligent transportation systems in Dublin.

No abstract

Protection against car theft, involving organized crime, is a growing threat for car owners as well as fleet management providers. This brings the use of security technologies into automotive industry. The evaluation of security and the justified use of measures to reduce vulnerability of car security systems is perceived as a special challenge for vendors and users of mobile access systems (MAS), as usually only limited resources for design and analysis are available. A lack of adequate reference works and specifications in the form of concrete recommendations for action, guidelines or standards often leads to proprietary security assessments heavily relying on compliance checks. These assessments often lack sufficiency regarding application-specificity and target-orientation in terms of a good cost benefit ratio. This is true for MAS in particular, as they are relatively new products with specific use cases and boundary conditions. The open-available Performance Risk-based Integrated Security Methodology (PRISM) allows a performance-based physical security assessment of critical infrastructures (CRITIS) and initiated a paradigm shift towards performance-based methods within this area. However, PRISM comprises semi-quantitative approaches only and thus does not allow for the consideration of uncertainty impact. Moreover, the approach has not been applied to mobile access systems (MAS) yet. This paper aims at applying the concept of PRISM to the use case of MAS by extending and optimizing it to enable a holistic risk assessment considering uncertainties.

No abstract