Representation of Attacker Motivation in Software Risk Assessment Using Attack Probability Trees

Esche, Marko; Toro, Federico Grasso; Thiel, Florian

doi:10.15439/2017f112

Cited by 10 publications

(22 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Once these have been implemented, the phases of risk estimation and risk evaluation (including amendments, where necessary) are repeated until the risk score is reduced to 3 or lower. Since attack vectors for real-world measuring instruments might become very complex, they can be decomposed by means of Attack Probability Trees (AtPT), see [6]. These AtPTs can be used by an assessor to subdivide any given attack vector, evaluate the sub-goals and to find the attack probability score for the original complex attack vector.…”

Section: Risk Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

Formalization of Software Risk Assessment Results in Legal Metrology Based on ISO/IEC 18045 Vulnerability Analysis

Esche

Salwiczek

Toro

2019

Proceedings of the 2019 Federated Conference on Computer Science and Information Systems

Self Cite

View full text Add to dashboard Cite

The Measuring Instruments Directive sets down essential requirements for measuring instruments subject to legal control in the EU. It dictates that a risk assessment must be performed before such instruments are put on the market. Because of the increasing importance of software in measuring instruments, a specifically tailored software risk assessment method has been previously developed and published. Related research has been done on graphical representation of threats by attack probability trees. The final stage is to formalize the method to prove its reproducibility and resilience against the complexity of future instruments. To this end, an inter-institutional comparison of the method is currently being conducted across national metrology institutes, while the weighing equipment manufacturers' association CECIP has provided a new measuring instrument concept, as a significant example of complex instruments. Based on the results of the comparison, a template to formalize the software risk assessment method is proposed here.

show abstract

Section: Risk Evaluationmentioning

confidence: 99%

“…To start the comparison, assessors from these NBs took part in a training exercise. The training covered both the basic procedure [2] as well as AtPTs [6]. Afterwards, see Subsection III-A, two generic measuring instruments were selected for all partners to assess.…”

Section: Inter-institutional Comparison and Identification Of Chmentioning

confidence: 99%

Formalization of Software Risk Assessment Results in Legal Metrology Based on ISO/IEC 18045 Vulnerability Analysis

Esche

Salwiczek

Toro

2019

Proceedings of the 2019 Federated Conference on Computer Science and Information Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…An adequate analysis and assessment of the risk shall be performed following the proposed method in Esche and Thiel . This risk assessment method has been formalized and developed into a graphical representation in Esche et al that will be used in further work. Carrying out a risk assessment for contemporary threats will satisfy the remaining requirement presented in the overview in Figure .…”

Section: Future Workmentioning

confidence: 99%

“…Thus, there is a need for in‐depth evaluation to determine if Cloud Computing is mature enough to meet the demands, requirements, and challenges of Legal Metrology. According to estimations about four to six percent of the gross national income is declared by Legal Metrology in European countries (see Section 1.1).…”

Section: Introductionmentioning

confidence: 99%

Secure Cloud Computing: Reference Architecture for Measuring Instrument under Legal Control

Oppermann

Toro

Thiel

et al. 2018

Security and Privacy

Self Cite

View full text Add to dashboard Cite

In Europe, measuring instruments under legal control are responsible for an annual turnover of 500 billion Euros and contribute a significant part to the economy including establishing trust between all stakeholders. In this article, a secure cloud reference architecture for measuring instruments is presented, addressing both requirements and roles in the Legal Metrology framework. With the introduction of Cloud Computing in Legal Metrology, a new role of a Cloud Service Provider has to be established. The general approach of the reference architecture shall be evaluated to determine if Cloud Computing can be integrated into the legal framework. In a bottom‐up approach, each layer of the cloud is addressed and carefully tested against the essential requirements for Legal Metrology. Splitting a well‐contained measuring instrument into a distributed measuring system creates new challenges guaranteeing security and integrity of the measurements. Addressing these problems, technologies such as fully homomorphic encryption are evaluated, improved, and implemented to enable calculations on encrypted measurements. In addition, a secure communication protocol for encrypted data is presented to address the demand of integrity of encrypted measurements throughout their lifecycle. Lastly, a continuous monitoring approach is presented to detect anomalies and to classify the system behavior depending on their severity and impact into three categories: green, yellow, and red.

show abstract

“…By objectifying the derived probability score for identified threats while following at the same time the guidelines of ISO/IEC 27005, ISO/IEC 15408 and ISO/IEC 18045, this risk assessment method enables comparability and standardizes the otherwise highly subjective assessment process. Furthermore, potential countermeasures are identified and quantified using Attack Probability Trees (AtPT) [6] for derived assets to be suitable protected.…”

Section: Introductionmentioning

confidence: 99%

Secure Cloud Computing: Risk Analysis for Secure Cloud Reference Architecture in Legal Metrology

Oppermann

Esche

Thiel

et al. 2018

Annals of Computer Science and Information Systems

Self Cite

View full text Add to dashboard Cite

In the field of Legal Metrology, a risk assessment is demanded by European directives for certain measuring instruments. In this paper, a previously published reference cloud architecture will be subjected to such an assessment to demonstrate its suitability for providing adequate software protection. A specially tailored and standardized method is used to identify essential threats and common attack vectors for the reference architecture. With the help of calculated probability score and risk factors, the fulfillment of the essential requirements of the applicable European directives are shown. Furthermore, Attack Probability Trees are applied to more complex scenarios to identify suitable countermeasures to increase the resilience level where necessary.

show abstract

Representation of Attacker Motivation in Software Risk Assessment Using Attack Probability Trees

Cited by 10 publications

References 9 publications

Formalization of Software Risk Assessment Results in Legal Metrology Based on ISO/IEC 18045 Vulnerability Analysis

Formalization of Software Risk Assessment Results in Legal Metrology Based on ISO/IEC 18045 Vulnerability Analysis

Secure Cloud Computing: Reference Architecture for Measuring Instrument under Legal Control

Secure Cloud Computing: Risk Analysis for Secure Cloud Reference Architecture in Legal Metrology

Contact Info

Product

Resources

About