How the definition of security risk can be made compatible with safety definitions

Abstract

In safety settings, understood as situations involving the potential occurrence of unintentional events, it is common to define risk as a combination of consequences and associated probabilities or associated uncertainties. On the other hand, in security settings, understood as situations involving the potential occurrence of intentional malicious events, risk is commonly defined as the triplet asset/value, threat and vulnerability. One motivation often mentioned for the latter is that probability is considered inappropriate for intentional acts. In this article, we argue that it is unsuitable and unnecessary to define risk differently in these two settings. We show that risk, defined as the combination of future consequences and associated uncertainties, can be seen as compatible with the triplet definition of security risk. It also excludes probability from the definition of risk but explicitly includes uncertainty, which is more fundamental and present regardless of the type of events involved. The value dimension is integrated with the consequences as these are with respect to something that humans value. The purpose of the article is to contribute to a consolidation of the safety and security risk management fields at the fundamental level.

Risk assessment without the risk? A controversy about security and risk in Norway

“…The controversy investigated takes place within a Nordic societal security context (Larsson and Rhinard 2020), but similar debates on probability's role in security risk assessment has taken place in other countries (Klima, Dorn, and Vander Beken 2011;Mueller and Stewart 2014) and in research on risk and security (Manunta 2002;Ezell et al 2010;Aven and Guikema 2015;Amundrud et al 2017 ).…”

“…In 2014, Standard Norway issued a standard for security risk assessment pertaining to when the risk stems from harmful, malicious acts (Standards Norway 2014). 1 During and primarily after the standardization, a controversy arose between risk-and security experts and civil servants on the usefulness of the approach (Maal, Busmundrud, and Endregard 2016;Amundrud et al 2017;Jore 2020). 2 The security risk approach presented in the standard represents a critique of an existing standard (Standards Norway 2008).…”

The Conceptual and Scientific Demarcation of Security in Contrast to Safety

“…Although there are several international and national standards, guidelines and recommendations in textbooks and the scientific literature on how to conduct security risk assessment a literature review concluded that there does not exist a consensus on what is the best practice of conduction security risk analysis and different security risk concepts and management tools vary across countries and sectors (Maal et al 2017). Furthermore, in safety science there are currently ongoing debates in both academia and in the practical community about whether there is a need for a specific risk concept for security that can capture the special features of security risk, or whether perspectives dominating the safety field are adaptable to the security field (Amundrud et al 2017;Jore and Egeli 2015). There are several academics and practitioners who claim that security and safety are distinct issues and should not be merged.…”

“…Several recent articles address risk analysis from a crossfertilization perspective, looking at similarities, differences, and interdependencies between the risk concept and the risk analysis methodology employed in security and safety risk management. This means that despite the differences between security and safety, some authors claim that the perspectives developed in each field can be applicable to the other (Amundrud et al 2017;Kriaa et al 2015;Piè-Cambacédès and Bouissou 2013).…”

Adversarial Risk Analysis to Allocate Optimal Defense Resources for Protecting Cyber–Physical Systems from Cyber Attacks

“…Risk assessment of CPS must address both safety and security issues (Amundrud, Aven, & Flage, ; Aven, ; Aven & Krohn, ; Kriaa, Pietre‐Cambacedes, Bouissou, & Halgand, ; Piètre‐Cambacédès & Bouissou, ; Wang, Di Maio, & Zio, ; Zalewski et al., ; Zio, , ). Safety concerns stochastic component failures that can result in accidental scenarios leading the system toward unacceptable consequences.…”