Probability and security – pitfalls and chances

Abstract

Information security for safety-related systems has become a real issue, in any case since attacks on industrial control systems have been reported. So, there is the task to consider information technology (IT) security issues for safety-related systems. For safety-related systems, there are many probabilistic approaches to computing a residual risk or tolerable risk. This is done for almost all areas of systems. The common concept of these standards is: there exists a certain probability that these systems will have a dangerous failure over a certain mission time (or a dangerous failure rate at a given point of time). Dangerous failures can be systematic or random. The probability for random failures can be computed and for systematic failures, there exist commonly agreed counter measures. When it comes to risk analysis, many concepts from safety and IT security seem very similar; only the wording seems different. What’s called a hazard in safety is called a threat in IT security, but the risk analysis processes really look alike. We show why the concept of probability cannot be applied to IT security. The key to solve the problem is to treat IT security in the same way as systematic failures in the safety domain. We have argued that there are similar problems in the application of probabilistic concepts and we could try to transfer the concept. This would mean to introduce levels for IT security similar to the Safety Integrity Levels (SIL).