Metodologias de análise integrada de segurança crítica e segurança cibernética em sistemas ciber físicos

Abstract

Due to strategic matters, information technology assets have been gradually incorporated into critical domain applications. In the maritime industry, aviation and railway systems, for example, it is possible to find cyber-physical systems, where digital components are integrated into mechanical devices. As consequences, the operations of vessels, aircrafts and trains become susceptible to cyber-attacks, which may result in intentional accidents. In critical projects, standards are generally followed where safety analysis is mandatory, which aims to protect a system against unintentional failures, and the standards also require cybersecurity analysis, also mentioned as security, which aims to protect a system against malicious agents. However, both analyses are usually performed separately, by applying different tools and different teams with modest or any interaction between them. These disjoint analyses difficult to detect conflicts between the safety and security disciplines. Whereas, it is possible that a change to mitigate a vulnerability could increase the probability of an accidental failure and, conversely, a change deployed to reduce the probability of a failure could bring a new vulnerability. Therefore, integrated analyses emerge as solutions to this problem. This study aims to evaluate and compare the efficiency of integrated safety and security analysis methodologies and to propose a strategy of performing an integrated analysis. The results achieved indicate that some methodologies were useful in identifying conflicts and influences that would probably go unnoticed in separated analyses. As an opportunity for future work, we point to the development of methods to estimate probabilities of cyber-attacks and simulation tools.