Visible to the public On the Role of Latent Design Conditions in Cyber-physical Systems Security

TitleOn the Role of Latent Design Conditions in Cyber-physical Systems Security
Publication TypeConference Paper
Year of Publication2016
AuthorsFrey, Sylvain, Rashid, Awais, Zanutto, Alberto, Busby, Jerry, Follis, Karolina
Conference NameProceedings of the 2Nd International Workshop on Software Engineering for Smart Cyber-Physical Systems
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-4171-4
Keywordscomposability, Cyber-physical systems, Design, i-o systems security, i/o systems security, industrial control systems, io systems security, Metrics, perception, Physical layer, physical layer security, physical-layer security, pubcrawl, Resiliency, risk, Scalability

As cyber-physical systems (CPS) become prevalent in everyday life, it is critical to understand the factors that may impact the security of such systems. In this paper, we present insights from an initial study of historical security incidents to analyse such factors for a particular class of CPS: industrial control systems (ICS). Our study challenges the usual tendency to blame human fallibility or resort to simple explanations for what are often complex issues that lead to a security incident. We highlight that (i) perception errors are key in such incidents (ii) latent design conditions - e.g., improper specifications of a system's borders and capabilities - play a fundamental role in shaping perceptions, leading to security issues. Such design-time considerations are particularly critical for ICS, the life-cycle of which is usually measured in decades. Based on this analysis, we discuss how key characteristics of future smart CPS in such industrial settings can pose further challenges with regards to tackling latent design flaws.

Citation Keyfrey_role_2016