| 1. |
- Bergler, Matthias, et al.
(författare)
-
Integrating Security and Safety with Systems Engineering : a Model-Based Approach
- 2022
-
Konferensbidrag (övrigt vetenskapligt/konstnärligt)abstract
- Development of reliable systems requires that safety and security concerns are acknowledged during system development. Adding them afterwards is risky as many concerns are missed if not elicited together with the system requirements. Unfortunately, languages for systems engineering, like SysML, typically ignore security and safety forcing development teams to split the work into different formats, languages and tools without easy collaboration, with limited traceability, separate versioning and restricted use of automation that tools can provide. We present a model-based approach targeting automotive that integrates safety and security aspects with other system development practices. This is achieved via a comprehensive domain-specific modeling language that is extendable by language users. We demonstrate this approach with practical examples on how security and safety concerns are recognized along with traditional system design and analysis phases.
|
|
| 2. |
- Bergler, Matthias, et al.
(författare)
-
Social Engineering Exploits in Automotive Software Security: Modeling Human-targeted Attacks with SAM
- 2021
-
Ingår i: Proceedings of the 31th European Safety and Reliability Conference. - Singapore : Research Publishing Services.
-
Konferensbidrag (refereegranskat)abstract
- Security cannot be implemented into a system retrospectively without considerable effort, so security must be takeninto consideration already at the beginning of the system development. The engineering of automotive softwareis by no means an exception to this rule. For addressing automotive security, the AUTOSAR and EAST-ADLstandards for domain-specific system and component modeling provide the central foundation as a start. The EASTADLextension SAM enables fully integrated security modeling for traditional feature-targeted attacks. Due to theCOVID-19 pandemic, the number of cyber-attacks has increased tremendously and of these, about 98 percent arebased on social engineering attacks. These social engineering attacks exploit vulnerabilities in human behaviors,rather than vulnerabilities in a system, to inflict damage. And these social engineering attacks also play a relevantbut nonetheless regularly neglected role for automotive software. The contribution of this paper is a novel modelingconcept for social engineering attacks and their criticality assessment integrated into a general automotive softwaresecurity modeling approach. This makes it possible to relate social engineering exploits with feature-related attacks.To elevate the practical usage, we implemented an integration of this concept into the established, domain-specificmodeling tool MetaEdit+. The tool support enables collaboration between stakeholders, calculates vulnerabilityscores, and enables the specification of security objectives and measures to eliminate vulnerabilities.
|
|
| 3. |
|
|
