A Model Based Approach For SCADA Safety And Security Joint Modelling: S-Cube

Kriaa, Siwar; Bouissou, Marc; Laarouchi, Youssef

doi:10.1049/cp.2015.0293

“…The analysis proposed by [18] is based on FMEA that considers only single causes of an effect, which excludes multi-stage attacks consideration. The method presented by Popov (2015) [28] may require a more complex [24], [32], [40], [45], [46] [11], [33] Unified [6], [13], [15], [17], [23], [25], [34], [36], [39], [41], [42], [43], [35], [49] [10], [12], [18], [21], [26], [28], [29], [31], [37], [38], [44], [47] failure model to address failure dependencies and trade-offs between safety and security. The approach proposed by Wei et al (2015) [31] has a limitation in terms of failures connections.…”

Section: B Resultsmentioning

confidence: 99%

“…A conflict resolutionis done based on weighting of resolutions values for conflicted requirements. 12) Kriaa et al (2015) [25] present an approach for joint risk assessment that can be applied for both design and operational phases of the system development. The S-cube (SCADA Safety and Security modelling) approach takes as input the system architecture and provides attacks and failures scenarios that may lead to given hazards.…”

Section: ) Raspotning Et Al (2012) [10] Present Combined Harmmentioning

confidence: 99%

Safety and Security Co-Analyses: A Systematic Literature Review

Lisova

¹

,

Šljivo

²

,

Čaušević

³

2019

IEEE Systems Journal

View full text Add to dashboard Cite

Latest technological trends lead towards systems connected to public networks even in critical domains. Bringing together safety and security work is becoming imperative, as a connected safety-critical system is not safe if it is not secure. The main objective of this study is to investigate the current status of safety and security co-analysis in system engineering by conducting a Systematic Literature Review. The steps of the review are the following: the research questions identification; agreement upon a search string; applying the search string to chosen databases; a selection criterion formulation for the relevant publications filtering; selected papers categorization and analysis. We focused on the early system development stages and identified 33 relevant publications categorized as: combined safety and security approaches that consider the mutual influence of safety and security; safety informed security approaches that consider influence of safety on security; security informed safety approaches that consider influence of security on safety. The results showed that a number of identified approaches are driven by needs in fast developing application areas, e.g., automotive, while works focusing on combined analysis are mostly application area independent. Overall, the study shows that safety and security co-analysis is still a developing domain.

show abstract

“…The analysis proposed by [18] is based on FMEA that considers only single causes of an effect, which excludes multi-stage attacks consideration. The method presented by Popov (2015) [28] may require a more complex [24], [32], [40], [45], [46] [11], [33] Unified [6], [13], [15], [17], [23], [25], [34], [36], [39], [41], [42], [43], [35], [49] [10], [12], [18], [21], [26], [28], [29], [31], [37], [38], [44], [47] failure model to address failure dependencies and trade-offs between safety and security. The approach proposed by Wei et al (2015) [31] has a limitation in terms of failures connections.…”

Section: B Resultsmentioning

confidence: 99%

Safety and Security Co-Analyses: A Systematic Literature Review

Lisova

¹

,

Šljivo

²

,

Čaušević

³

2019

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

View full text Add to dashboard Cite

Latest technological trends lead towards systems connected to public networks even in critical domains. Bringing together safety and security work is becoming imperative, as a connected safety-critical system is not safe if it is not secure. The main objective of this study is to investigate the current status of safety and security co-analysis in system engineering by conducting a Systematic Literature Review. The steps of the review are the following: the research questions identification; agreement upon a search string; applying the search string to chosen databases; a selection criterion formulation for the relevant publications filtering; selected papers categorization and analysis. We focused on the early system development stages and identified 33 relevant publications categorized as: combined safety and security approaches that consider the mutual influence of safety and security; safety informed security approaches that consider influence of safety on security; security informed safety approaches that consider influence of security on safety. The results showed that a number of identified approaches are driven by needs in fast developing application areas, e.g., automotive, while works focusing on combined analysis are mostly application area independent. Overall, the study shows that safety and security co-analysis is still a developing domain.

show abstract

“…These approaches have however the advantage to quantify the likelihood and severity of resulting attacks. In [12], Kriaa et al define four criteria to classify approaches combining security and safety:…”

Section: Comparing To State-of-the-artmentioning

confidence: 99%

“…They implement this approach with the KB3 [11] tool and apply it to the Stuxnet attack. In 2015, they publish S-CUBE [12], an implementation of the former approach in the Figaro language. This approach takes into account the applicative logic of the process.…”

Section: Introductionmentioning

confidence: 99%

Generation of Applicative Attacks Scenarios Against Industrial Systems

Puys

¹

,

Potet

²

,

Khaled

³

2018

Foundations and Practice of Security

View full text Add to dashboard Cite

In the context of security, risk analyzes are widely recognized as essential. However, such analyzes need to be replayed frequently to take into account new vulnerabilities, new protections, etc.. As exploits can now easily be found on internet, allowing a wide range of possible intruders with various capacities, motivations and resources. In particular in the case of industrial control systems (also called SCADA) that interact with the physical world, any breach can lead to disasters for humans and the environment. Alongside of classical security properties such as secrecy or authentication, SCADA must ensure safety properties relative to the industrial process they control. In this paper, we propose an approach to assess the security of industrial systems. This approach aims to find applicative attacks taking into account various parameters such as the behavior of the process, the safety properties that must be ensured. We also model the possible positions and capacities of attackers allowing a precise control of these attackers. We instrument our approach using the well known model-checker UPPAAL, we apply it on a case study and show how variations of properties, network topologies, and attacker models can drastically change the obtained results. This work has been partially funded by the SACADE (ANR-16-ASTR-0023) project.

show abstract

A Model Based Approach For SCADA Safety And Security Joint Modelling: S-Cube

Cited by 25 publications

References 7 publications

Safety and Security Co-Analyses: A Systematic Literature Review

Safety and Security Co-Analyses: A Systematic Literature Review

Safety and Security Co-Analyses: A Systematic Literature Review

Generation of Applicative Attacks Scenarios Against Industrial Systems

Contact Info

Product

Resources

About