Abstract
Information security for safety-related systems has become a real issue, in any case since attacks on industrial control systems have been reported. So, there is the task to consider information technology (IT) security issues for safety-related systems. For safety-related systems, there are many probabilistic approaches to computing a residual risk or tolerable risk. This is done for almost all areas of systems. The common concept of these standards is: there exists a certain probability that these systems will have a dangerous failure over a certain mission time (or a dangerous failure rate at a given point of time). Dangerous failures can be systematic or random. The probability for random failures can be computed and for systematic failures, there exist commonly agreed counter measures. When it comes to risk analysis, many concepts from safety and IT security seem very similar; only the wording seems different. What’s called a hazard in safety is called a threat in IT security, but the risk analysis processes really look alike. We show why the concept of probability cannot be applied to IT security. The key to solve the problem is to treat IT security in the same way as systematic failures in the safety domain. We have argued that there are similar problems in the application of probabilistic concepts and we could try to transfer the concept. This would mean to introduce levels for IT security similar to the Safety Integrity Levels (SIL).
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.