Annals of Computer Science and Information Systems, Volume 11

DOI: http://dx.doi.org/10.15439/2017F112

Citation: Proceedings of the 2017 Federated Conference on Computer Science and Information Systems, M. Ganzha, L. Maciaszek, M. Paprzycki (eds). ACSIS, Vol. 11, pages 763–771 (2017)

Full text

Abstract. Since software plays an ever more important role in measuring instruments, risk assessments for such instruments required by European regulations will usually include also a risk assessment of the software. Although previously introduced methods still lack efficient means for the representation of attacker motivation and have no prescribed way of constructing attack scenarios, attack trees have been used for several years in similar application scenarios. These trees are here developed into attack probability trees, specifically tailored to meet the requirements for software risk assessment. A real-world example based on taximeters is given to illustrate the application of attack probability trees approach and their advantages.

References

1. “Directive 2014/32/EU of the European Parliament and of the Council of 26 February 2014 on the harmonisation of the laws of the Member States relating to the making available on the market of measuring instruments,” European Union, Council of the European Union ; European Parliament, Directive, February 2014.
2. “ISO/IEC 27005:2011(e) Information technology - Security techniques - Information security risk management,” International Organization for Standardization, Geneva, CH, Standard, June 2011.
3. “ISO/IEC 18045:2008 Common Methodology for Information Technology Security Evaluation,” International Organization for Standardization, Geneva, CH, Standard, September 2008, Version 3.1 Revision 4.
4. M. Esche and F. Thiel, “Software risk assessment for measuring instruments in legal metrology,” in Proceedings of the Federated Conference on Computer Science and Information Systems, Lodz, Poland, September 2015, pp. 1113–1123, http://dx.doi.org/10.15439/978-83-60810-66-8.
5. ——, “Incorporating a measure for attacker motivation into software risk assessment for measuring instruments in legal metrology,” in Proceedings of the 18th GMA/ITG-Fachtagung Sensoren und Messsysteme 2016, Nuremberg, Germany, May 2016, pp. 735 – 742, http://dx.doi.org/10.5162/sen-soren2016/P7.4.
6. S. Mauw and M. Oostdijk, “Foundations of attack trees,” in Proceedings of the 8th international conference on Information Security and Cryptology. Seoul, Korea: IEEE, December 2005, pp. 186–198, DOI: 10.1007/11734727_17.
7. B. Schneier, Secrets and lies: digital security in a networked world. Indianapolis, Indiana: Wiley Computer Publishing, 1963.
8. M. Sadiq, M. K. I. Rahmani, M. W. Ahmad, and S. Jung, “Software risk assessment and evaluation process (sraep) using model based approach,” in Proceedings of the IEEE International Conference on Networking and Information Technology. IEEE, June 2010, pp. 171–177, http://dx.doi.org/10.1109/ICNIT.2010.5508535.
9. W.-H. Lin, P.-T. Kuo, H.-T. Lin, and T. C. W. and, “Threat risk analysis for cloud security based on attack-defense trees,” in Proceedings of the International Conference on Computing Technology and Information Management. Seoul, Korea: IEEE, April 2012, pp. 106–111, ISBN: 978-89-88678-68-8.
10. R. Vigo, F. Nielson, and H. R. Nielson, “Automated generation of attack trees,” in Proceedings of the IEEE Computer Security Foundations Symposium. Seoul, Korea: IEEE, 2014, pp. 337–350, http://dx.doi.org/10.1109/CSF.2014.31.
11. “WELMEC 7.2 Software Guide,” European cooperation in legal metrology, WELMEC Secretariat, Delft, Standard, 2015.
12. “ETSI TS 102 165-1 Telecommunications and Internet converged Services and Protocols for Advanced Networking; Methods and protocols; Part 1: Method and proforma for Threat, Risk, Vulnerability Analysis,” European Telecommunications Standards Institute, Sophia Antipolis Cedex, FR, Standard, March 2011, v4.2.3.
13. “ISO 11898-1:2015 Road vehicles – Controller area network (CAN) – Part 1: Data link layer and physical signalling,” International Organization for Standardization, Geneva, CH, Standard, December 2015.