Modelling Security of Critical Infrastructures: A Survivability Assessment

Abstract

Critical infrastructures, usually designed to handle disruptions caused by human errors or random acts of nature, define assets whose normal operation must be guaranteed to maintain its essential services for human daily living. Malicious intended attacks to these targets need to be considered during system design. To face with these situations, defense plans must be developed in advance. In this paper, we present a UML profile, named SecAM, that enables the modelling and security specification for critical infrastructures during the early phases (requirements, design) of systems development life-cycle. SecAM endows security assessment, through survivability analysis, of different security solutions before system deployment. As a case study, we evaluate the survivability of the Saudi Arabia crude-oil pipeline network under two different attack scenarios. The stochastic analysis, carried out with Generalized Stochastic Petri nets, quantitatively estimates the minimisation of attack damages into the crude-oil network.

Profiling the publish/subscribe paradigm for automated analysis using colored Petri nets

“…A specialization of MARTE, the non-standard dependability analysis and modeling (DAM) UML profile [21], enables to express dependability issues in UML models. Similarly, the non-standard security analysis and modeling (SecAM) profile [22] allows to express security characteristics into UML models. Figure 3 depicts the UML domain model for the publish/subscribe paradigm.…”

On synergies of cyber and physical security modelling in vulnerability assessment of railway systems

“…SecAM [20,3] is an UML profile designed for the security analysis and mod-elling of software systems. It allows attack/resilience, cryptography, security mechanisms, and access control issues to be expressed within UML models.…”

“…SecAM is built in the top of MARTE [12] and DAM [13] profile, which makes it a 135 powerful framework where performance, dependability, and security properties can be expressed. A more detailed description of SecAM subpackages can be found in [3]. A GSPN distinguishes two kind of transitions: immediate, which fire at zero time (i.e., its firing does not consume any time) and are represented by thin black bars; and timed, which can follow different firing distributions and are represented by white boxes.…”

“…25 Nowadays, holistic modelling of complex systems is still a challenging research issue, being largely accepted that the more promising and scalable ap-proaches focus on modularity and composability (both in modelling and solving). Another promising research effort aims at using as much as possible de facto standards in systems modelling, as the Unified Modelling Language (UML) In this paper, we take advantage of two novel UML profiles, namely Security Analysis and Modelling (SecAM) [3] and Critical Infrastructure Protection -Vulnerability Analysis and Modeling (CIP_VAM) [4], to address the modelling of digital and physical security in combination. The approach moves from 40 separate usage of the two profiles, through a loosely coupled one, pointing towards a fully and strictly integrated profile including the modelling potential of both SecAM and CIP_VAM.…”

“…However, it does not consider cyber-security issues. Another 100 recent UML profile, SecAM [20,3], overcomes this issue since it allows specifying cyber-security aspects while enabling its assessment.…”