STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems

Ivo Friedberg; Kieran McLaughlin; Paul Smith; David Laverty; Sakir Sezer

doi:10.1016/j.jisa.2016.05.008

STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems

Ivo Friedberg, Kieran McLaughlin, Paul Smith, David Laverty, Sakir Sezer

Research output: Contribution to journal › Special issue › peer-review

178 Citations (Scopus)

997 Downloads (Pure)

Abstract

Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today’s critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.

Original language	English
Number of pages	16
Journal	Journal of Information Security and Applications
Early online date	30 Jun 2016
DOIs	https://doi.org/10.1016/j.jisa.2016.05.008
Publication status	Early online date - 30 Jun 2016

Access to Document

10.1016/j.jisa.2016.05.008Licence: CC BY

STPA-SafeSec: Safety and security analysis for cyber-physical systems
© 2016 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution and reproduction in any medium, provided the author and source are cited.
Final published version, 1.91 MBLicence: CC BY

2 Finished

R1452ECI: Converged Approach towards Resilient Industrial control systems and Cyber Assurance
Sezer, S. (PI), Laverty, D. (CoI), McLaughlin, K. (CoI), McLoone, S. (CoI) & Morrow, D. J. (CoI)
01/08/2014 → 31/12/2017
Project: Research
R6440ECI: Smart Grid Protection Against Cyber Attacks
Sezer, S. (PI) & McLaughlin, K. (CoI)
15/04/2014 → 30/06/2017
Project: Research

Kieran McLaughlin
- kieran.mclaughlinqub.acuk
Person: Academic

178 Citations
2 Conference contribution
1 Chapter (peer-reviewed)

Towards a Resilience Metric Framework for Cyber-Physical Systems
Friedberg, I., McLaughlin, K., Smith, P. & Wurzenberger, M., 25 Aug 2016, 4th International Symposium for ICS & SCADA Cyber Security Research 2016 (ICS-CSR 2016). BCS Learning & Development Ltd, p. 19-22 4 p.
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Open Access
File
5334 Downloads (Pure)
A Cyber-Physical Security Analysis of Synchronous-Islanded Microgrid Operation
Friedberg, I., Laverty, D., McLaughlin, K. & Smith, P., 17 Sept 2015, Proceedings of the 3rd International Symposium for ICS & SCADA Cyber Security Research 2015. BCS Learning & Development Ltd, p. 52-62 11 p.
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Open Access
File
745 Downloads (Pure)
Towards a Cyber-physical Resilience Framework for Smart Grids
Friedberg, I., McLaughlin, K. & Smith, P., Jun 2015, Intelligent Mechanisms for Network Configuration and Security: 9th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2015, Ghent, Belgium, June 22-25, 2015. Proceedings. Latre, S., Charalambrides, M., Francois, J., Schmitt, C. & Stiller, B. (eds.). Springer, p. 140-144 5 p. (Lecture Notes in Computer Science; vol. 9122).
Research output: Chapter in Book/Report/Conference proceeding › Chapter (peer-reviewed) › peer-review

Open Access
File
3 Citations (Scopus)

498 Downloads (Pure)

Cite this

@article{b0ac2c05f2094351a1ab0e00a05172c1,

title = "STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems",

abstract = "Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today{\textquoteright}s critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.",

author = "Ivo Friedberg and Kieran McLaughlin and Paul Smith and David Laverty and Sakir Sezer",

year = "2016",

month = jun,

day = "30",

doi = "10.1016/j.jisa.2016.05.008",

language = "English",

journal = "Journal of Information Security and Applications",

issn = "2214-2126",

publisher = "Elsevier Ltd",

}

TY - JOUR

T1 - STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems

AU - Friedberg, Ivo

AU - McLaughlin, Kieran

AU - Smith, Paul

AU - Laverty, David

AU - Sezer, Sakir

PY - 2016/6/30

Y1 - 2016/6/30

N2 - Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today’s critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.

AB - Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today’s critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.

U2 - 10.1016/j.jisa.2016.05.008

DO - 10.1016/j.jisa.2016.05.008

M3 - Special issue

SN - 2214-2126

JO - Journal of Information Security and Applications

JF - Journal of Information Security and Applications

ER -

STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems

Abstract

Access to Document

Fingerprint

Projects

R1452ECI: Converged Approach towards Resilient Industrial control systems and Cyber Assurance

R6440ECI: Smart Grid Protection Against Cyber Attacks

Profiles

Kieran McLaughlin

Research output

Towards a Resilience Metric Framework for Cyber-Physical Systems

A Cyber-Physical Security Analysis of Synchronous-Islanded Microgrid Operation

Towards a Cyber-physical Resilience Framework for Smart Grids

Cite this