Safety and Security Co-Analyses: A Systematic Literature Review

Abstract

Latest technological trends lead towards systems connected to public networks even in critical domains. Bringing together safety and security work is becoming imperative, as a connected safety-critical system is not safe if it is not secure. The main objective of this study is to investigate the current status of safety and security co-analysis in system engineering by conducting a Systematic Literature Review. The steps of the review are the following: the research questions identification; agreement upon a search string; applying the search string to chosen databases; a selection criterion formulation for the relevant publications filtering; selected papers categorization and analysis. We focused on the early system development stages and identified 33 relevant publications categorized as: combined safety and security approaches that consider the mutual influence of safety and security; safety informed security approaches that consider influence of safety on security; security informed safety approaches that consider influence of security on safety. The results showed that a number of identified approaches are driven by needs in fast developing application areas, e.g., automotive, while works focusing on combined analysis are mostly application area independent. Overall, the study shows that safety and security co-analysis is still a developing domain.

Face Recognition for Automatic Border Control: A Systematic Literature Review

“…Establishing research questions at the outset is crucial for conducting a systematic review [9]. This is because research questions guide data search, collection, extraction, and analysis [10], [11].…”

Model-Based Approach for Co-optimization of Safety and Security Objectives in Design of Critical Architectures

“…In literature, various academic and industrial research works have addressed the problem of both safety and security for CPS [12] such as EU MERGE 10 project or the EU AQUAS 11 project. Paul [14] categorized such works into four main groups, that are: (1) independent analysis of safety and security, i.e., works analyzing either safety or security concerns during the SDLC without considering the other, (2) augmenting safety engineering with security techniques, i.e., works where various processes, methods and tools in the safety engineering domain are updated with concepts and features from the security domain, (3)augmenting security engineering with safety techniques, and (4) addressing safety and security co-engineering together, i.e., approaches considering a unification of processes, methods and tools to perform both the safety and security analysis in parallel.…”

“…Even with the recent increase in the use of Artificial Intelligence (AI) and other automation technology for CPS development, designing these systems still involves a lot of human experts/engineers. Thus, it is important to provide the engineers with methods and automated frameworks that ease the integration of non-functional aspects like, for instance, co-optimization of both safety and security objectives, especially during the development of the system hardware architecture [12,14]. For the same reason, the design phase is crucial within the SDLC, since errors or lacks introduced during the design time can propagate to other phases resulting in wastage of effort, time and resources [20].…”