An Evaluation Ontology Applied to Connected Vehicle Security Assurance

Abstract

Connected vehicles have great potential to benefit society, yet create huge challenges. Vehicles, infrastructure and enterprise activities combine to form massively complex systems of systems (SoSs) that are vulnerable to cyber‐attacks. Security is ill‐defined, making it difficult to achieve a consistent, common understanding of security capabilities across the diverse industries that collaborate to develop connected vehicles. Rigorous evaluation is essential for developing strong security assurance cases. This paper contributes a model‐based systems engineering (MBSE) ontology that enables integrated evaluation processes in enterprise SoSs. The Evaluation Ontology allows diverse types of evaluation to be captured in a single integrated model. A connected vehicle security story is presented to demonstrate the value of the approach. Benefits include enhanced business intelligence that can provide a quantifiable, reportable level of confidence in security‐related processes and technologies. Further work will extend the ontology to develop a customisable suite of enabling patterns for security.

Exploring the role of assurance context in system security assurance evaluation: a conceptual model

“…This involves identifying potential gaps or weaknesses in the security controls, practices and architecture. Such findings are crucial in enabling stakeholders to make informed decisions regarding the system's security and to allocate resources effectively for risk mitigation (Peltier, 2005). The ultimate objective of SAE is to drive improvements in the system's security posture (Ouedraogo et al, 2012).…”

“…Based on the evaluation findings and recommendations, stakeholders can prioritize remediation efforts, implement necessary security enhancements and allocate resources efficiently to address identified weaknesses. This iterative process ensures that the system's security posture evolves and improves over time, keeping up with the evolving threat landscape and maintaining a strong defense against potential cyber threats (Peltier, 2005;Sattarova Feruza and Kim, 2007).…”

“…With logical queries to the ontology, one can determine whether or not the security requirements can handle risks in a vehicle. In addition, Powley et al (2019) proposed an evaluation ontology (EO) that facilitate the modeling of evaluation processes and outcome in automobile industries, specifically for connected vehicles. For dealing with the complex systems of systems that are vulnerable to cyberattacks, it aims to integrate different types of evaluation into a single model for all activities at all levels of all organizations in an enterprise.…”