This paper focuses on the challenges relating to the overall safety instrumentation and control (I&C) architectural design and more specifically the modelling and assessment of nuclear safety I&C systems at architectural level. We focus on the properties relating to Defence-in-Depth principle, mainly on the unwanted interactions between systems of different safety classification. This paper describes the design process of early conceptual overall safety I&C architecture from the modelling point of view and defines the requirements for a model-based approach to support the design and analysis of the design solution. The modelling language selected for the study was Architecture Analysis and Design Language (AADL), an architecture description language, which considers analysis as a goal. In this paper, we review the capabilities of the language for modelling overall safety I&C architectures and as a case study, we model a simplified example architecture of an APR-1400 nuclear power plant using standard AADL components and provide an overview of the analysis capabilities of the OSATE tool for checking Defence-in-Depth related requirements.

Model driven security has become an active area of research during the past decade. While many research works have contributed significantly to this objective by extending popular modeling notations to model security aspects, there has been little modeling support for state-based views of security issues. This paper undertakes a scientific approach to propose a new notational set that extends the UML (Unified Modeling Language) statecharts notation. An online industrial survey was conducted to measure the perceptions of the new notation with respect to its semantic transparency as well as its coverage of modeling state based security aspects. The survey results indicate that the new notation encompasses the set of semantics required in a state based security modeling language and was largely intuitive to use and understand provided very little training. A subject-based empirical evaluation using software engineering professionals was also conducted to evaluate the cognitive effectiveness of the proposed notation. The main finding was that the new notation is cognitively more effective than the original notational set of UML statecharts as it allowed the subjects to read models created using the new notation much quicker.

Combined Harm Assessment of Safety and Security for Information Systems (CHASSIS) method defines a unified process for safety and security assessments to address both the safety and security aspects during system development process. CHASSIS applies techniques from safety and security fields-e.g. misuse case and HAZOP-to identify and model hazards, threats and mitigations to a system. These mitigations, which are generally specified as safety and security requirements, are interrelated. Defining and maintaining the interdependencies between these requirements are vital to, among other things, estimate how a requirement impacts other requirements and artefacts. In this paper, we present our approach for providing trace ability to CHASSIS in order to capture the interdependencies between the safety and security requirements and to demonstrate the history and rational behind their elicitation. The approach, called Satrap, constitutes a process model defining what type of artefacts are generated during development and assessment activities, what type of relations between the artefacts should be captured, and how to extract traces. The trace ability approach together with its supporting prototype tool was applied on an Air Traffic Management remote tower example which was assessed for safety and security risks using CHASSIS.

Safety and security assessments aim to keep harm away from systems. Although they consider different causes of harm, the mitigations suggested by the assessments are often interrelated and affect each other, either by strengthening or weakening the other. Considering the relations and effects, a combined process for safety and security could save resources. It also improves the reliability of the system development when compared to having two independent processes whose results might contradict. This paper extends our previous research on a combined method for security and safety assessment, named CHASSIS, by detailing the process in a broader context of system development with the help of feedback from a safety expert. The enhanced CHASSIS method is discussed based on a case from the Air Traffic Management domain.

Security requirements elicitation and modelling are integral for the successful development of secure systems. However, there are a lot of similar yet not identical approaches that currently exist for security requirements modelling, which is confusing for researchers and practitioners hence some characterisation will be useful to give a better overview and understanding of advantages and disadvantages of various approaches. This paper provides a comparative review of i*-based and use case - based security modelling initiatives, using a characterisation framework with several dimensions. Our findings show that both categories of initiatives have significant conceptual similarities in the aspect of modelling language and method process, and coverage of security requirements modelling notions. They have conceptual differences in the aspect of: representation perspective, kind of security requirements engineering activities that are supported, the quality of specification that is generated and the specification techniques used, and the degree of support for software evolution.

The idea of security aware system development from the start of the engineering process is generally accepted nowadays and is becoming applied in practice. Many recent initiatives support this idea with special focus on security requirements elicitation. However, there are so far no techniques that provide integrated overviews of security threats and system architecture. One way to achieve this is by combining misuse cases with use case maps into misuse case maps (MUCM). This paper presents an experimental evaluation of MUCM diagrams focusing on identification of vulnerabilities and mitigations. The controlled experiment with 33 IT students included a complex hacker intrusion from the literature, illustrated either with MUCM or with alternative diagrams. The results suggest that participants using MUCM found significantly more mitigations than participants using regular misuse cases combined with system architecture diagrams.

With the continuously developing technology and growing complexity of software and systems, new demands and challenges appear for security, calling for new techniques and methods in addition to the already existing ones. The variety of initiatives and the variations in the characterizations makes it hard for users to select the most appropriate one for their needs. We propose a set of uniform characterizing dimensions with sub-categories for security requirements initiatives. The set is derived by analyzing classifications and comparison frameworks from review papers on modelling techniques for security requirements engineering. The dimensions can be used to guide context-dependent choices of initiatives and further research of their combination and integration.