Security assurance cases—state of the art of an emerging approach

Abstract

Security Assurance Cases (SAC) are a form of structured argumentation used to reason about the security properties of a system. After the successful adoption of assurance cases for safety, SAC are getting significant traction in recent years, especially in safety-critical industries (e.g., automotive), where there is an increasing pressure to be compliant with several security standards and regulations. Accordingly, research in the field of SAC has flourished in the past decade, with different approaches being investigated. In an effort to systematize this active field of research, we conducted a systematic literature review (SLR) of the existing academic studies on SAC. Our review resulted in an in-depth analysis and comparison of 51 papers. Our results indicate that, while there are numerous papers discussing the importance of SAC and their usage scenarios, the literature is still immature with respect to concrete support for practitioners on how to build and maintain a SAC. More importantly, even though some methodologies are available, their validation and tool support is still lacking.

Cybersecurity Assurance Challenges for Future Connected and Automated Vehicles

“…An assurance case approach is recommended, and constructing these assurance arguments is expected to help identify the requirements for the types of evidence needed to complete the assurance claims. However, recent surveys indicate that the practical implementation of cybersecurity cases remains relatively immature (Mohamad et al, 2021).…”

“…The draft standard (ISO/SAE, 2021) that is currently being developed to accompany Regulation 155 suggests the use of a cybersecurity case, which is analogous to the safety case approach already used to document automotive functional safety (MISRA, 2019), to provide assurance that the cybersecurity risks of using the vehicle are acceptable. Although the concept for a cybersecurity assurance case is not new (Armstrong et al, 2011), the results of a recent survey (Mohamad et al, 2021) over a wide range of application domains demonstrate that the practical implementation of cybersecurity cases remains relatively immature.…”

Securing Software Development: A Holistic Exploration of Security Awareness in Software Development Teams

“…Early in the software development process, proper assurance measures with security assurance must be implemented to prevent future problems in critical systems domains (Kabir, 2021;Khan & Khan, 2018b;Mohamad et al, 2021). Research studies conducted on security assurance are (Marshall, et al, 2019;Mohamad et al, 2021;Maksimov et al, 2019;Jahan et al, 2020;Lin et al, 2020;Calinescu et al, 2017;Bloomfield et al, 2017). However, the benefit of adding the security assurance for security requirements will raise confidence and enhance the integrity of software.…”

“…(Jahan, Pasco, et al, 2019). The use of security requirement assurance is increasing in the development of secure critical systems, especially in industries such as transportation systems, medical devices, financial systems, military systems, healthcare, and automotive (Mohamad et al, 2021). Therefore, one of the primary reasons for the success of the threats and attacks is lack of attention to the elicitation and analysis of security requirements (Anderson, 2020), and cannot be neglected any longer (Rehman et al, 2018).…”