SCSC April 2018 A model for including cyber threat in safety cases Andrew Eaton 2018

The Civil Aviation Authority The CAA is the UK's specialist aviation regulator. Its regulatory activities range from making sure that the aviation industry meets the highest technical and operational safety standards to preventing holidaymakers from being stranded abroad or losing money because of tour operator insolvency.

Andrew Eaton Safety critical systems engineer with the United Kingdom Civil Aviation Authority in the Intelligence, Strategy and Policy division. Focused on Regulatory Models, Models of Regulation, Regulatory Risk, Risk Assessment & Mitigation techniques, Safety Case Development and Safety Case Evaluation for CNS/ATM services and systems. Innovation, Strategy and Policy 2W Aviation House, Gatwick Airport South, West Sussex, RH6 0YR. andrew.eaton@caa.co.uk

Motivation European Law requires: Risk based objective safety cases that argue that the behaviour of the services that they provide are tolerably safe Safety cases have to be produced for any change in the context in which the service is provided the system providing the service the service provided Cyber threat constitutes part of the operational context of a service can modify the system providing a service can change the service being provided

Essential features of change safety case “A Safety Case is a structured argument, supported by evidence, intended to justify that a system is acceptably safe for a specific application in a specific operating environment.” The Change Safety Case (CSC) is a behavioural prediction of safety that Defines what is ‘safe’ safety performance Predicts what will be actual safety performance Compares the two (objectively) Claims results show safety will be achieved Does this for all states of the system Service oriented - the system being changed or being influenced by a change produces a service

The expected scope of a change safety case The safety of: The change to the service being made The activities being undertaken to make the change Any support services required to keep the changed service running Any external services bought in to make the service run

Safety perspective of cyber threat (1) In a CSC, we are interested in safety risk Safety risk = f(harm to people and probability) due to behaviour of the functional system that provides the service Cyber threats are just another potential cause of aberrant behaviour in/of the functional system Just like random and systematic faults, EMC-induced failures etc Therefore concerned with the behaviour that may arise from cyber threats Expressed in changes to the ‘Parts of the Operational and Support Systems’ (POSS) specifications These changes stem from redefining the operational context to include Cyber threats

Safety perspective of cyber threat (2) Persistent malevolent actor(s) therefore can deliberately involve simultaneous actions to bypass safeguards – defeating safety architecture insider-threat, introducing modifications to functional system Cyber threats (with above caveat) do not introduce new accidents or hazards Can increase probability of existing hazards Can make incredible hazards possible (both previously imagined and unimagined) need enhanced HAZOPS techniques Can increase probability of an accident arising from a hazard

Consequently….. Safety cases need to be informed by cyber security assurance measures and analysis to be considered valid. They need additional cyber induced behaviour to be identified and evaluated for its potential impact on the system the safety of the service to be demonstrated in the presence of any cyber-induced behaviour to take into account responses to cyber induced behaviour when detected (CSOC). The amount of cyber protection provided by a service provider is at its discretion and will result in a delicate balance of cost of protection against the cost of assuring the additional behaviour created by potential cyber activity. If the cyber threat evolves so that it is outside that considered by the safety case, a new safety case will be needed

Cyber Threat-Induced Behaviour Identification (CTIBI) analysis (1) An analysis that establishes the environmental cyber threat, and determines the potential effects on the functional system, in terms of potential behaviour of the POSSs within the scope of the change. The analysis takes account of the functional system architecture, including the mitigations provided by the cyber and physical security controls and the activities of the SOC (defined in its procedures). The analysis should address threats attacking the existing system and its interfaces, and threats involving physical modification (e.g. an insider fits a USB device with malware, or enables a new communications link). The analysis needs to be conducted according to a procedure that must be justified, either directly or by prior approval for it to be admissible in the safety case.

Cyber Threat-Induced Behaviour Identification (CTIBI) analysis (2) The CTIBI results in: the potential cyber threat-induced behaviour, which is included into the POSS specifications (the CTIBI is the supporting evidence for these specification elements) a record to support an argument that the CTIBI has been carried out completely and correctly by competent personnel.

Consequences of this view Delineates safety engineering responsibilities from cyber security responsibilities. In that it enables: the cyber team to establish the environmental cyber threat, and determine the potential effects on the functional system, in terms of potential behaviour of the POSSs within the scope of the change. the safety team to address the consequences of this behaviour without having cyber expertise So you don’t need safety experts that understand cyber security or vice versa

Cyber security issues in safety case The Security Operations Centre (SOC)* A POSS representing the SOC (if new or changed/impacted) Threat monitoring Incident detection and response Changes to operational mode Patches and configuration changes (within scope of safety case) Instigation of changes * Either the safety case or a separate cyber assessment needs to demonstrate the adequacy of: the security analysis method to identify and verify ‘new’ behaviour in POSSs the operations of the SOC.

Thank you

Cyber security issues in safety case (Descriptions and justifications variously) Rationale for extent to which cyber security has been addressed for this change Additional system description - major security features Additional behaviour in POSS specifications (incl for supplied services)* Additional considerations when the scope of the change was established Additions to safety models Additional requirement for resources (spares & prepared parts) to be uncompromised Additional evidence supporting the specifications