Towards Interdependent Safety Security Assessments Using Bowties

Luca Arnaboldi; David Aspinall

doi:10.48550/arXiv.2208.03484

Towards Interdependent Safety Security Assessments Using Bowties

Luca Arnaboldi^*, David Aspinall

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract / Description of output

We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

Original language	English
Title of host publication	Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings
Editors	Mario Trapp, Erwin Schoitsch, Jérémie Guiochet, Friedemann Bitsch
Publisher	Springer
Pages	211-229
Number of pages	19
ISBN (Print)	9783031148613
DOIs	https://doi.org/10.48550/arXiv.2208.03484 https://doi.org/10.1007/978-3-031-14862-0_16
Publication status	Published - 9 Jun 2022
Event	Workshops on DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, held in conjunction with the 41st International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2022 - Munich, Germany Duration: 6 Sept 2022 → 9 Sept 2022

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	13415 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Workshops on DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, held in conjunction with the 41st International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2022
Country/Territory	Germany
City	Munich
Period	6/09/22 → 9/09/22

Keywords / Materials (for Non-textual outputs)

Bowtie diagrams
risk analysis
safety and security

Access to Document

10.48550/arXiv.2208.03484Licence: Creative Commons: Attribution (CC-BY)
10.1007/978-3-031-14862-0_16Licence: All Rights Reserved

Towards interdependent_ARNABOLDI_DOA13042022_AFV_CC-BYAccepted author manuscript, 604 KBLicence: Creative Commons: Attribution (CC-BY)

https://arxiv.org/abs/2208.03484Licence: Creative Commons: Attribution (CC-BY)
https://link.springer.com/chapter/10.1007/978-3-031-14862-0_16Licence: All Rights Reserved

Cite this

Arnaboldi, L., & Aspinall, D. (2022). Towards Interdependent Safety Security Assessments Using Bowties. In M. Trapp, E. Schoitsch, J. Guiochet, & F. Bitsch (Eds.), Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings (pp. 211-229). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13415 LNCS). Springer. https://doi.org/10.48550/arXiv.2208.03484, https://doi.org/10.1007/978-3-031-14862-0_16

Arnaboldi, Luca ; Aspinall, David. / Towards Interdependent Safety Security Assessments Using Bowties. Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings. editor / Mario Trapp ; Erwin Schoitsch ; Jérémie Guiochet ; Friedemann Bitsch. Springer, 2022. pp. 211-229 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{35f8825d465c4a9c97141e9c035abdf1,

title = "Towards Interdependent Safety Security Assessments Using Bowties",

abstract = "We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.",

keywords = "Bowtie diagrams, risk analysis, safety and security",

author = "Luca Arnaboldi and David Aspinall",

note = "Funding Information: Acknowledgements. We{\textquoteright}re grateful to Ewen Denney for suggesting to us to investigate bowtie diagrams for safety-security assessments, as well as comments on an early draft. This work was funded by the AISEC grant under EPSRC number EP/T027037/1.; Workshops on DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, held in conjunction with the 41st International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2022 ; Conference date: 06-09-2022 Through 09-09-2022",

year = "2022",

month = jun,

day = "9",

doi = "10.48550/arXiv.2208.03484",

language = "English",

isbn = "9783031148613",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "211--229",

editor = "Mario Trapp and Erwin Schoitsch and J{\'e}r{\'e}mie Guiochet and Friedemann Bitsch",

booktitle = "Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings",

}

Arnaboldi, L & Aspinall, D 2022, Towards Interdependent Safety Security Assessments Using Bowties. in M Trapp, E Schoitsch, J Guiochet & F Bitsch (eds), Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13415 LNCS, Springer, pp. 211-229, Workshops on DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, held in conjunction with the 41st International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2022, Munich, Germany, 6/09/22. https://doi.org/10.48550/arXiv.2208.03484, https://doi.org/10.1007/978-3-031-14862-0_16

Towards Interdependent Safety Security Assessments Using Bowties. / Arnaboldi, Luca ; Aspinall, David.
Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings. ed. / Mario Trapp; Erwin Schoitsch; Jérémie Guiochet; Friedemann Bitsch. Springer, 2022. p. 211-229 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13415 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Towards Interdependent Safety Security Assessments Using Bowties

AU - Arnaboldi, Luca

AU - Aspinall, David

N1 - Funding Information: Acknowledgements. We’re grateful to Ewen Denney for suggesting to us to investigate bowtie diagrams for safety-security assessments, as well as comments on an early draft. This work was funded by the AISEC grant under EPSRC number EP/T027037/1.

PY - 2022/6/9

Y1 - 2022/6/9

N2 - We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

AB - We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

KW - Bowtie diagrams

KW - risk analysis

KW - safety and security

UR - http://www.scopus.com/inward/record.url?scp=85139049230&partnerID=8YFLogxK

U2 - 10.48550/arXiv.2208.03484

DO - 10.48550/arXiv.2208.03484

M3 - Conference contribution

AN - SCOPUS:85139049230

SN - 9783031148613

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 211

EP - 229

BT - Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings

A2 - Trapp, Mario

A2 - Schoitsch, Erwin

A2 - Guiochet, Jérémie

A2 - Bitsch, Friedemann

PB - Springer

T2 - Workshops on DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, held in conjunction with the 41st International Conference on Computer Safety, Reliability, and Security, SAFECOMP 2022

Y2 - 6 September 2022 through 9 September 2022

ER -

Arnaboldi L , Aspinall D. Towards Interdependent Safety Security Assessments Using Bowties. In Trapp M, Schoitsch E, Guiochet J, Bitsch F, editors, Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops - DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE, Proceedings. Springer. 2022. p. 211-229. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.48550/arXiv.2208.03484, 10.1007/978-3-031-14862-0_16

Towards Interdependent Safety Security Assessments Using Bowties

Abstract / Description of output

Publication series

Conference

Keywords / Materials (for Non-textual outputs)

Access to Document

Other files and links

Fingerprint

AISEC: AI Secure and Explainable by Construction

Cite this

Towards Interdependent Safety Security Assessments Using Bowties

Abstract / Description of output

Publication series

Conference

Keywords / Materials (for Non-textual outputs)

Access to Document

Other files and links

Fingerprint

Projects

AISEC: AI Secure and Explainable by Construction

Cite this