mdh.sePublications
Change search
Link to record
Permanent link

Direct link
BETA
Alternative names
Publications (10 of 30) Show all publications
Leander, B., Causevic, A. & Hansson, H. (2019). Applicability of the IEC 62443 standard in Industry 4.0 / IIoT. In: ACM International Conference Proceeding Series: . Paper presented at 14th International Conference on Availability, Reliability and Security, ARES 2019; University of KentCanterbury; United Kingdom; 26 August 2019 through 29 August 2019. Association for Computing Machinery
Open this publication in new window or tab >>Applicability of the IEC 62443 standard in Industry 4.0 / IIoT
2019 (English)In: ACM International Conference Proceeding Series, Association for Computing Machinery , 2019Conference paper, Published paper (Refereed)
Abstract [en]

Today’s industrial automation systems are undergoing a digital transformation that implies a shift towards the Internet of Things (IoT), leading to the Industrial Internet of Things (IIoT) paradigm. Existing Industrial Automated Control Systems (IACS), enriched with a potentially large number of IoT devices are expected to make systems more efficient, flexible, provide intelligence, and ultimately enable autonomous control. In general, the majority of such systems come with high level of criticality that calls for well-established methods and approaches when achieving cybersecurity, preferably prescribed by a standard. IEC 62443 is an industrial standard that provides procedures to manage risks related to cybersecurity threats in IACS. Given the new IIoT paradigm, it is likely that existing standards are not sufficiently aligned with the challenges related to developing and maintaining cybersecurity in such systems. In this paper we review the applicability of the IEC 62443 standard in IIoT contexts and discuss potential challenges the process owners might encounter. Our analysis underlines that some areas within the standard could prove difficult to reach compliance with. In particular, handling of cross zone communication and software updates require additional guidance. 

Place, publisher, year, edition, pages
Association for Computing Machinery, 2019
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Identifiers
urn:nbn:se:mdh:diva-45365 (URN)10.1145/3339252.3341481 (DOI)2-s2.0-85071722239 (Scopus ID)9781450371643 (ISBN)
Conference
14th International Conference on Availability, Reliability and Security, ARES 2019; University of KentCanterbury; United Kingdom; 26 August 2019 through 29 August 2019
Available from: 2019-10-03 Created: 2019-10-03 Last updated: 2019-10-11Bibliographically approved
Lisova, E., El Hachem, J. & Causevic, A. (2019). Investigating Attack Propagation in a SoS via a Service Decomposition. In: IEEE SERVICES Workshop on Cyber Security and Resilience in the Internet of Things CSR 2019: . Paper presented at IEEE SERVICES Workshop on Cyber Security and Resilience in the Internet of Things CSR 2019, 08 Jul 2019, Milan, Italy.
Open this publication in new window or tab >>Investigating Attack Propagation in a SoS via a Service Decomposition
2019 (English)In: IEEE SERVICES Workshop on Cyber Security and Resilience in the Internet of Things CSR 2019, 2019Conference paper, Published paper (Refereed)
Abstract [en]

A term systems of systems (SoS) refers to a setup in which a number of independent systems collaborate to create a value that each of them is unable to achieve independently. Complexity of a SoS structure is higher compared to its constitute systems that brings challenges in analyzing its critical properties such as security. An SoS can be seen as a set of connected systems or services that needs to be adequately protected. Communication between such systems or services can be considered as a service itself, and it is the paramount for establishment of a SoS as it enables connections, dependencies, and a cooperation. Given that reliable and predictable communication contributes directly to a correct functioning of an SoS, communication as a service is one of the main assets to consider. Protecting it from malicious adversaries should be one of the highest priorities within SoS design and operation. This study aims to investigate the attack propagation problem in terms of service-guarantees through the decomposition into sub-services enriched with preconditions and postconditions at the service levels. Such analysis is required as a prerequisite for an efficient SoS risk assessment at the design stage of the SoS development life cycle to protect it from possibly high impact attacks capable of affecting safety of systems and humans using the system.

National Category
Engineering and Technology Computer Systems
Identifiers
urn:nbn:se:mdh:diva-43942 (URN)
Conference
IEEE SERVICES Workshop on Cyber Security and Resilience in the Internet of Things CSR 2019, 08 Jul 2019, Milan, Italy
Projects
SAFSEC-CPS -- Securing the safety of autonomous cyber-physical systemsSerendipity - Secure and dependable platforms for autonomy
Available from: 2019-06-20 Created: 2019-06-20 Last updated: 2019-06-20Bibliographically approved
Causevic, A., Lisova, E., Ashjaei, S. M. & Ashgar, S. U. (2019). On incorporating security parameters in service level agreements. In: CLOSER 2019 - Proceedings of the 9th International Conference on Cloud Computing and Services Science: . Paper presented at 9th International Conference on Cloud Computing and Services Science, CLOSER 2019, 2 May 2019 through 4 May 2019 (pp. 48-57). SciTePress
Open this publication in new window or tab >>On incorporating security parameters in service level agreements
2019 (English)In: CLOSER 2019 - Proceedings of the 9th International Conference on Cloud Computing and Services Science, SciTePress , 2019, p. 48-57Conference paper, Published paper (Refereed)
Abstract [en]

With development of cloud computing new ways for easy, on-demand, Internet-based access to computing resources have emerged. In such context a Service Level Agreement (SLA) enables contractual agreements between service providers and users. Given an SLA, service users are able to establish trust in that the service outcome corresponds to what they have demanded during the service negotiation process. However, an SLA provides a limited support outside of basic Quality of Service (QoS) parameters, especially when it comes to security. We find security as an important factor to be included in adjusting an SLA according to user defined objectives. Incorporating it in an SLA is challenging due to difficulty to provide complete and quantifiable metrics, thus we propose to focus on a systematic way of addressing security using the security process. In this paper we investigate ways in which security might be incorporated already in the service negotiation process and captured in an SLA. We propose a corresponding process to develop and maintain an SLA that considers both design-, and run-time. To demonstrate the approach we built upon the existing SLAC language and extend its syntax to support security. An example of a service being provided with security guarantees illustrates the concept.

Place, publisher, year, edition, pages
SciTePress, 2019
Keywords
Cloud computing, Run-time monitoring, Security, Security process, Service level agreement, SLAC, Outsourcing, Contractual agreements, Negotiation process, Quality of Service parameters, Runtime Monitoring, Security parameters, Service Level Agreements, Quality of service
National Category
Computer and Information Sciences
Identifiers
urn:nbn:se:mdh:diva-44880 (URN)10.5220/0007658000480057 (DOI)2-s2.0-85067500149 (Scopus ID)9789897583650 (ISBN)
Conference
9th International Conference on Cloud Computing and Services Science, CLOSER 2019, 2 May 2019 through 4 May 2019
Note

Conference code: 148430; Export Date: 11 July 2019; Conference Paper

Available from: 2019-07-11 Created: 2019-07-11 Last updated: 2019-10-15Bibliographically approved
Moradi, F., Sedaghatbaf, A., Abbaspour Asadollah, S., Causevic, A. & Sirjani, M. (2019). On-Off Attack on a Blockchain-based IoT System. In: First Workshop on Secure and Trustable Wirelessly Connected Industrial IoT ETFA - WS01: . Paper presented at First Workshop on Secure and Trustable Wirelessly Connected Industrial IoT ETFA - WS01, 10 Sep 2019, Zaragoza, Spain.
Open this publication in new window or tab >>On-Off Attack on a Blockchain-based IoT System
Show others...
2019 (English)In: First Workshop on Secure and Trustable Wirelessly Connected Industrial IoT ETFA - WS01, 2019Conference paper, Published paper (Refereed)
Abstract [en]

There is a growing interest in using the Blockchain for resolving IoT security and trustworthiness issues existing in today’s complex systems. Blockchain concerns trust in peer to peer networks by providing a distributed tamper-resistant ledger. However, the combination of these two emerging technologies might create new problems and vulnerabilities that attackers might abuse.

In this paper, we aim to investigate the trust mechanism of Lightweight Scalable BlockChain (LSB), that is a Blockchain specifically designed for Internet of Things networks, to show that a malicious participant in a Blockchain architecture have possibility to pursue an On-Off attack and downgrade the integrity of the distributed ledger. We choose a remote software update process as an instance to represent this violation. Finally, using the actor-based language Rebeca, we provide a model of a system under attack and verify the described attack scenario.

Index Terms—Blockchain, Distributed Trust, On-Off Attack, IoT, Security.

National Category
Engineering and Technology Computer Systems
Identifiers
urn:nbn:se:mdh:diva-45050 (URN)
Conference
First Workshop on Secure and Trustable Wirelessly Connected Industrial IoT ETFA - WS01, 10 Sep 2019, Zaragoza, Spain
Projects
Serendipity - Secure and dependable platforms for autonomy
Available from: 2019-08-23 Created: 2019-08-23 Last updated: 2019-08-23Bibliographically approved
Causevic, A., Papadopoulos, A. & Sirjani, M. (2019). Towards a Framework for Safe and Secure Adaptive Collaborative Systems. In: The 9th IEEE International Workshop on Industrial Experience in Embedded Systems Design IEESD 2019: . Paper presented at The 9th IEEE International Workshop on Industrial Experience in Embedded Systems Design IEESD 2019, 15 Jul 2019, Milwaukee, Wisconsin, United States.
Open this publication in new window or tab >>Towards a Framework for Safe and Secure Adaptive Collaborative Systems
2019 (English)In: The 9th IEEE International Workshop on Industrial Experience in Embedded Systems Design IEESD 2019, 2019Conference paper, Published paper (Refereed)
National Category
Engineering and Technology Computer Systems
Identifiers
urn:nbn:se:mdh:diva-43936 (URN)
Conference
The 9th IEEE International Workshop on Industrial Experience in Embedded Systems Design IEESD 2019, 15 Jul 2019, Milwaukee, Wisconsin, United States
Projects
Future factories in the CloudSAFSEC-CPS -- Securing the safety of autonomous cyber-physical systemsSerendipity - Secure and dependable platforms for autonomy
Available from: 2019-06-20 Created: 2019-06-20 Last updated: 2019-06-20Bibliographically approved
Lisova, E., Causevic, A., Hänninen, K., Thane, H. & Hansson, H. (2018). A Systematic Way to Incorporate Security in Safety Analysis. In: Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018: . Paper presented at 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018; Parc Alvisse, Hotel Luxembourg City; Luxembourg; 25 June 2018 through 28 June 2018 (pp. 166-171). Luxembourg, Luxemburg
Open this publication in new window or tab >>A Systematic Way to Incorporate Security in Safety Analysis
Show others...
2018 (English)In: Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018, Luxembourg, Luxemburg, 2018, p. 166-171Conference paper, Published paper (Refereed)
Abstract [en]

Today's systems are being built to connect to public or semi-public networks, are able to communicate with other systems, e.g., in the context of Internet-of-Things (IoT), involve multiple stakeholders, have dynamic system reconfigurations, and operate in increasingly unpredictable environments. In such complex systems, assuring safety and security in a continuous and joint effort is a major challenge, not the least due to the increasing number of attack surfaces arising from the increased connectivity. In this paper we present an approach that aims to bridge the gap between safety and security engineering. The potential of the approach is illustrated on the example of E-gas system, discussing the cases when unintentional faults as well as malicious attacks are taken into consideration when assuring safety of the described system. 

Place, publisher, year, edition, pages
Luxembourg, Luxemburg: , 2018
National Category
Computer Systems
Identifiers
urn:nbn:se:mdh:diva-39268 (URN)10.1109/DSN-W.2018.00058 (DOI)2-s2.0-85051231991 (Scopus ID)9781538655955 (ISBN)
Conference
48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018; Parc Alvisse, Hotel Luxembourg City; Luxembourg; 25 June 2018 through 28 June 2018
Projects
Closing the safety-security gap in software intensive systemsSAFSEC-CPS -- Securing the safety of autonomous cyber-physical systemsSerendipity - Secure and dependable platforms for autonomy
Available from: 2018-05-22 Created: 2018-05-22 Last updated: 2018-08-23Bibliographically approved
Surkovic, A., Hanic, D., Lisova, E., Causevic, A., Wenslandt, D. & Falk, C. (2018). Towards Attack Models in Autonomous Systems of Systems. In: 2018 13th System of Systems Engineering Conference, SoSE 2018: . Paper presented at System of Systems Engineering Conference SoSE 2018, 19 Jun 2018, Paris, France (pp. 583-585). , Article ID 8428701.
Open this publication in new window or tab >>Towards Attack Models in Autonomous Systems of Systems
Show others...
2018 (English)In: 2018 13th System of Systems Engineering Conference, SoSE 2018, 2018, p. 583-585, article id 8428701Conference paper, Published paper (Refereed)
National Category
Computer Systems
Identifiers
urn:nbn:se:mdh:diva-39264 (URN)10.1109/SYSOSE.2018.8428701 (DOI)2-s2.0-85052332713 (Scopus ID)9781538648766 (ISBN)
Conference
System of Systems Engineering Conference SoSE 2018, 19 Jun 2018, Paris, France
Projects
SAFSEC-CPS -- Securing the safety of autonomous cyber-physical systemsSeCRA - Security Case Run-Time AdaptationSerendipity - Secure and dependable platforms for autonomy
Available from: 2018-05-23 Created: 2018-05-23 Last updated: 2018-09-06Bibliographically approved
Lisova, E. & Causevic, A. (2018). Towards security case run-time adaptation by system decomposition into services. In: Proceedings: IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society. Paper presented at IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society (pp. 4102-4108). Institute of Electrical and Electronics Engineers Inc.
Open this publication in new window or tab >>Towards security case run-time adaptation by system decomposition into services
2018 (English)In: Proceedings: IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society, Institute of Electrical and Electronics Engineers Inc. , 2018, p. 4102-4108Conference paper, Published paper (Refereed)
Abstract [en]

For interconnected and complex systems, security is paramount for establishing trust in their correctness and design adequacy. Thus, security needs to be assured and a corresponding security assurance case needs to be presented to system stakeholders, security assessors, as well as to system users. However, security is dynamic by its nature and to maintain its acceptable security level, frequent updates might be required. Traditionally, a security assurance case is built from scratch whenever a change occurs, however given the cost of resources needed for such a task, a more effective and less time consuming way of handling updates is needed. Hence, the challenge of security case run-time adaptation is considered in this work. We survey the state of the art in security assurance and security case development to refine the challenge and identify system decomposition as one the enablers for security case run-time adaptation. We propose to apply system decomposition in terms of services and use service choreographies to facilitate security case run-time adaptation. The proposed approach is illustrated on an E-gas example.

Place, publisher, year, edition, pages
Institute of Electrical and Electronics Engineers Inc., 2018
National Category
Computer and Information Sciences
Identifiers
urn:nbn:se:mdh:diva-42758 (URN)10.1109/IECON.2018.8591530 (DOI)2-s2.0-85061528503 (Scopus ID)9781509066841 (ISBN)
Conference
IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society
Available from: 2019-02-22 Created: 2019-02-22 Last updated: 2019-02-26Bibliographically approved
Causevic, A. (2017). A Risk and Threat Assessment Approaches Overview in Autonomous Systems of Systems. In: The 26th International Conference on Information, Communication and Automation Technologies ICAT2017: . Paper presented at The 26th International Conference on Information, Communication and Automation Technologies ICAT2017, 26 Oct 2017, Sarajevo, Bosnia and Herzegovina (pp. 1-6).
Open this publication in new window or tab >>A Risk and Threat Assessment Approaches Overview in Autonomous Systems of Systems
2017 (English)In: The 26th International Conference on Information, Communication and Automation Technologies ICAT2017, 2017, p. 1-6Conference paper, Published paper (Refereed)
Abstract [en]

Systems of systems (SoS) have been introduced in early 1990s in air traffic control domain, defense and information technologies. Systems like this contain a set of components, being systems itself, with constituent components retaining operational independence. The definition and configuration of SoS have evolutionary nature and emergent behavior is one of the many important characteristics to be mentioned. Over the past ten years fast technological and industrial advances in the domain of autonomous and cooperating systems started to occur, which created new opportunities to use the benefits of SoS. In the near future, fully autonomous and cooperating systems are expected to become our reality and increase the production efficiency, while decreasing the human effort in harmful environments. There exist the need to make sure that critical properties of SoS, such as safety and security are guaranteed as a joint effort, since it is not sufficient anymore to address these properties independently in the development process. In this paper an overview of the most common approaches and methods used to provide reasoning about joint safety and security is provided, as well as a check of the latest updates in standards related to these properties

National Category
Computer Systems
Identifiers
urn:nbn:se:mdh:diva-37068 (URN)000426931000029 ()2-s2.0-85046810085 (Scopus ID)978-1-5386-3337-3 (ISBN)
Conference
The 26th International Conference on Information, Communication and Automation Technologies ICAT2017, 26 Oct 2017, Sarajevo, Bosnia and Herzegovina
Projects
SafeCOP - Safe Cooperating Cyber-Physical Systems using Wireless CommunicationClosing the safety-security gap in software intensive systemsSAFSEC-CPS -- Securing the safety of autonomous cyber-physical systems
Funder
EU, Horizon 2020, 692529 Vinnova
Available from: 2017-10-31 Created: 2017-10-31 Last updated: 2019-04-18Bibliographically approved
Lisova, E., Causevic, A., Uhlemann, E. & Björkman, M. (2017). Clock Synchronization Considerations in Security Informed Safety Assurance of Autonomous Systems of Systems. In: IECON 2017 - 43RD ANNUAL CONFERENCE OF THE IEEE INDUSTRIAL ELECTRONICS SOCIETY: . Paper presented at 43rd Annual Conference of the IEEE Industrial Electronics Society IECON 2017, 30 Oct 2017, Beijing, China (pp. 8385-8390).
Open this publication in new window or tab >>Clock Synchronization Considerations in Security Informed Safety Assurance of Autonomous Systems of Systems
2017 (English)In: IECON 2017 - 43RD ANNUAL CONFERENCE OF THE IEEE INDUSTRIAL ELECTRONICS SOCIETY, 2017, p. 8385-8390Conference paper, Published paper (Refereed)
National Category
Computer Systems
Identifiers
urn:nbn:se:mdh:diva-37065 (URN)000427164808040 ()2-s2.0-85046668958 (Scopus ID)978-1-5386-1127-2 (ISBN)
Conference
43rd Annual Conference of the IEEE Industrial Electronics Society IECON 2017, 30 Oct 2017, Beijing, China
Projects
SafeCOP - Safe Cooperating Cyber-Physical Systems using Wireless CommunicationSAFSEC-CPS -- Securing the safety of autonomous cyber-physical systems
Funder
EU, Horizon 2020, 692529 Vinnova
Available from: 2017-11-07 Created: 2017-11-07 Last updated: 2019-04-17Bibliographically approved
Organisations
Identifiers
ORCID iD: ORCID iD iconorcid.org/0000-0001-5293-3804

Search in DiVA

Show all publications