Towards Integrated Quantitative Security and Safety Risk Assessment

Jürgen Dobaj; Christoph Schmittner; Michael Krisper; Georg Macher

doi:10.1007/978-3-030-26250-1_8

Towards Integrated Quantitative Security and Safety Risk Assessment

Jürgen Dobaj^*, Christoph Schmittner, Michael Krisper, Georg Macher

^*Korrespondierende/r Autor/-in für diese Arbeit

Institut für Technische Informatik (4480)

Publikation: Beitrag in Buch/Bericht/Konferenzband › Beitrag in einem Konferenzband › Begutachtung

Abstract

Although multiple approaches for the combination of safety and security analysis exist, there are still some major gaps to overcome before they can be used for combined risk management. This paper presents the existing gaps, based on an overview of available methods, which is followed by the proposal towards a solution to achieve coordinated risk management by applying a quantitative security risk assessment methodology. This methodology extends established safety and security risk analysis methods with an integrated model, denoting the relationship between adversary and victim, including the used capabilities and infrastructure. This model is used to estimate the resistance strength and threat capabilities, to determine attack probabilities and security risks.

Originalsprache	englisch
Titel	Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings
Redakteure/-innen	Alexander Romanovsky, Elena Troubitsyna, Ilir Gashi, Erwin Schoitsch, Friedemann Bitsch
Herausgeber (Verlag)	Springer Verlag
Seiten	102-116
Seitenumfang	15
ISBN (Print)	9783030262495
DOIs	https://doi.org/10.1007/978-3-030-26250-1_8
Publikationsstatus	Veröffentlicht - 9 Aug. 2019
Veranstaltung	38th International Conference on Computer Safety, Reliability and Security: SAFECOMP 2019 - Turku, Finnland Dauer: 10 Sept. 2019 → 13 Sept. 2019

Publikationsreihe

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Band	11699 LNCS
ISSN (Print)	0302-9743
ISSN (elektronisch)	1611-3349

Konferenz

Konferenz	38th International Conference on Computer Safety, Reliability and Security
Land/Gebiet	Finnland
Ort	Turku
Zeitraum	10/09/19 → 13/09/19

ASJC Scopus subject areas

Theoretische Informatik
Allgemeine Computerwissenschaft

Zugriff auf Dokument

10.1007/978-3-030-26250-1_8

Andere Dateien und Links

http://www.scopus.com/inward/record.url?scp=85072899460&partnerID=8YFLogxK

1 Laufend
2 Abgeschlossen

Industrial Informatics
Macher, G., Dobaj, J., Krug, T., Blažević, R. & Veledar, O.
1/09/12 → 31/12/24
Projekt: Arbeitsgebiet
AH-DHYAMONT - Steuerungsplattform für Stromerzeugung aus Wasserkraft
Macher, G., Krisper, M., Dobaj, J. & Krug, T.
1/01/19 → 31/01/21
Projekt: Forschungsprojekt
AH-HyUnify-Erweiterung - Steuerungsplattform für Stromerzeugung aus Wasserkraft
Macher, G., Krisper, M. & Dobaj, J.
1/10/18 → 31/12/18
Projekt: Forschungsprojekt

14th Workshop on Dependable Smart Embedded and Cyber-Physical Systems and Systems-of-Systems, DECSoS 2019
Jürgen Dobaj (Redner/in)
10 Sept. 2019
Aktivität: Vortrag oder Präsentation › Vortrag bei Workshop, Seminar oder Kurs › Science to science

Dieses zitieren

Dobaj, J., Schmittner, C., Krisper, M., & Macher, G. (2019). Towards Integrated Quantitative Security and Safety Risk Assessment. in A. Romanovsky, E. Troubitsyna, I. Gashi, E. Schoitsch, & F. Bitsch (Hrsg.), Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings (S. 102-116). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Band 11699 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-030-26250-1_8

Towards Integrated Quantitative Security and Safety Risk Assessment. / Dobaj, Jürgen; Schmittner, Christoph; Krisper, Michael et al.
Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings. Hrsg. / Alexander Romanovsky; Elena Troubitsyna; Ilir Gashi; Erwin Schoitsch; Friedemann Bitsch. Springer Verlag, 2019. S. 102-116 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Band 11699 LNCS).

Publikation: Beitrag in Buch/Bericht/Konferenzband › Beitrag in einem Konferenzband › Begutachtung

Dobaj, J, Schmittner, C, Krisper, M & Macher, G 2019, Towards Integrated Quantitative Security and Safety Risk Assessment. in A Romanovsky, E Troubitsyna, I Gashi, E Schoitsch & F Bitsch (Hrsg.), Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Bd. 11699 LNCS, Springer Verlag, S. 102-116, 38th International Conference on Computer Safety, Reliability and Security, Turku, Finnland, 10/09/19. https://doi.org/10.1007/978-3-030-26250-1_8

Dobaj J, Schmittner C, Krisper M , Macher G. Towards Integrated Quantitative Security and Safety Risk Assessment. in Romanovsky A, Troubitsyna E, Gashi I, Schoitsch E, Bitsch F, Hrsg., Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings. Springer Verlag. 2019. S. 102-116. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-26250-1_8

Dobaj, Jürgen ; Schmittner, Christoph ; Krisper, Michael et al. / Towards Integrated Quantitative Security and Safety Risk Assessment. Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings. Hrsg. / Alexander Romanovsky ; Elena Troubitsyna ; Ilir Gashi ; Erwin Schoitsch ; Friedemann Bitsch. Springer Verlag, 2019. S. 102-116 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{7adcd5cb4481440cb9b6145f7dbe4799,

title = "Towards Integrated Quantitative Security and Safety Risk Assessment",

abstract = "Although multiple approaches for the combination of safety and security analysis exist, there are still some major gaps to overcome before they can be used for combined risk management. This paper presents the existing gaps, based on an overview of available methods, which is followed by the proposal towards a solution to achieve coordinated risk management by applying a quantitative security risk assessment methodology. This methodology extends established safety and security risk analysis methods with an integrated model, denoting the relationship between adversary and victim, including the used capabilities and infrastructure. This model is used to estimate the resistance strength and threat capabilities, to determine attack probabilities and security risks.",

keywords = "Diamond, FAIR, FMVEA, Risk assessment, Safety analysis, SAHARA, Security analysis, Threat analysis, Threat modeling",

author = "J{\"u}rgen Dobaj and Christoph Schmittner and Michael Krisper and Georg Macher",

year = "2019",

month = aug,

day = "9",

doi = "10.1007/978-3-030-26250-1_8",

language = "English",

isbn = "9783030262495",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "102--116",

editor = "Alexander Romanovsky and Elena Troubitsyna and Ilir Gashi and Erwin Schoitsch and Friedemann Bitsch",

booktitle = "Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings",

address = "Germany",

note = "38th International Conference on Computer Safety, Reliability and Security : SAFECOMP 2019 ; Conference date: 10-09-2019 Through 13-09-2019",

}

TY - GEN

T1 - Towards Integrated Quantitative Security and Safety Risk Assessment

AU - Dobaj, Jürgen

AU - Schmittner, Christoph

AU - Krisper, Michael

AU - Macher, Georg

PY - 2019/8/9

Y1 - 2019/8/9

N2 - Although multiple approaches for the combination of safety and security analysis exist, there are still some major gaps to overcome before they can be used for combined risk management. This paper presents the existing gaps, based on an overview of available methods, which is followed by the proposal towards a solution to achieve coordinated risk management by applying a quantitative security risk assessment methodology. This methodology extends established safety and security risk analysis methods with an integrated model, denoting the relationship between adversary and victim, including the used capabilities and infrastructure. This model is used to estimate the resistance strength and threat capabilities, to determine attack probabilities and security risks.

AB - Although multiple approaches for the combination of safety and security analysis exist, there are still some major gaps to overcome before they can be used for combined risk management. This paper presents the existing gaps, based on an overview of available methods, which is followed by the proposal towards a solution to achieve coordinated risk management by applying a quantitative security risk assessment methodology. This methodology extends established safety and security risk analysis methods with an integrated model, denoting the relationship between adversary and victim, including the used capabilities and infrastructure. This model is used to estimate the resistance strength and threat capabilities, to determine attack probabilities and security risks.

KW - Diamond

KW - FAIR

KW - FMVEA

KW - Risk assessment

KW - Safety analysis

KW - SAHARA

KW - Security analysis

KW - Threat analysis

KW - Threat modeling

UR - http://www.scopus.com/inward/record.url?scp=85072899460&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-26250-1_8

DO - 10.1007/978-3-030-26250-1_8

M3 - Conference paper

AN - SCOPUS:85072899460

SN - 9783030262495

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 102

EP - 116

BT - Computer Safety, Reliability, and Security - SAFECOMP 2019 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Proceedings

A2 - Romanovsky, Alexander

A2 - Troubitsyna, Elena

A2 - Gashi, Ilir

A2 - Schoitsch, Erwin

A2 - Bitsch, Friedemann

PB - Springer Verlag

T2 - 38th International Conference on Computer Safety, Reliability and Security

Y2 - 10 September 2019 through 13 September 2019

ER -

Towards Integrated Quantitative Security and Safety Risk Assessment

Abstract

Publikationsreihe

Konferenz

ASJC Scopus subject areas

Zugriff auf Dokument

Andere Dateien und Links

Fingerprint

Projekte

Industrial Informatics

AH-DHYAMONT - Steuerungsplattform für Stromerzeugung aus Wasserkraft

AH-HyUnify-Erweiterung - Steuerungsplattform für Stromerzeugung aus Wasserkraft

Aktivitäten

14th Workshop on Dependable Smart Embedded and Cyber-Physical Systems and Systems-of-Systems, DECSoS 2019

Dieses zitieren