Towards Interdependent Safety Security Assessments Using Bowties

Luca Arnaboldi; David Aspinall

doi:10.1007/978-3-031-14862-0_16

Towards Interdependent Safety Security Assessments Using Bowties

Luca Arnaboldi^*, David Aspinall

^*Corresponding author for this work

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

Original language	English
Title of host publication	Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops
Subtitle of host publication	DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings
Editors	Mario Trapp, Erwin Schoitsch, Jérémie Guiochet, Friedemann Bitsch
Place of Publication	Cham
Publisher	Springer
Pages	211–229
Number of pages	19
Edition	1
ISBN (Electronic)	9783031148620
ISBN (Print)	9783031148613
DOIs	https://doi.org/10.1007/978-3-031-14862-0_16
Publication status	Published - 7 Sept 2022
Event	The 41st International Conference on Computer Safety, Reliability and Security - Munich, Germany Duration: 6 Sept 2022 → 9 Sept 2022

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	13415
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	The 41st International Conference on Computer Safety, Reliability and Security
Abbreviated title	SAFECOMP 2022
Country/Territory	Germany
City	Munich
Period	6/09/22 → 9/09/22

Keywords

Safety and security
Bowtie diagrams
Risk analysis

Access to Document

10.1007/978-3-031-14862-0_16

Cite this

Arnaboldi, L., & Aspinall, D. (2022). Towards Interdependent Safety Security Assessments Using Bowties. In M. Trapp, E. Schoitsch, J. Guiochet, & F. Bitsch (Eds.), Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops: DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings (1 ed., pp. 211–229). (Lecture Notes in Computer Science; Vol. 13415). Springer. https://doi.org/10.1007/978-3-031-14862-0_16

Arnaboldi, Luca ; Aspinall, David. / Towards Interdependent Safety Security Assessments Using Bowties. Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops: DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings. editor / Mario Trapp ; Erwin Schoitsch ; Jérémie Guiochet ; Friedemann Bitsch. 1. ed. Cham : Springer, 2022. pp. 211–229 (Lecture Notes in Computer Science).

@inproceedings{880448175fab475da89348324aa80ba3,

title = "Towards Interdependent Safety Security Assessments Using Bowties",

abstract = "We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.",

keywords = "Safety and security, Bowtie diagrams, Risk analysis",

author = "Luca Arnaboldi and David Aspinall",

year = "2022",

month = sep,

day = "7",

doi = "10.1007/978-3-031-14862-0_16",

language = "English",

isbn = "9783031148613",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "211–229",

editor = "Mario Trapp and Erwin Schoitsch and J{\'e}r{\'e}mie Guiochet and Friedemann Bitsch",

booktitle = "Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops",

edition = "1",

note = "The 41st International Conference on Computer Safety, Reliability and Security, SAFECOMP 2022 ; Conference date: 06-09-2022 Through 09-09-2022",

}

Arnaboldi, L & Aspinall, D 2022, Towards Interdependent Safety Security Assessments Using Bowties. in M Trapp, E Schoitsch, J Guiochet & F Bitsch (eds), Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops: DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings. 1 edn, Lecture Notes in Computer Science, vol. 13415, Springer, Cham, pp. 211–229, The 41st International Conference on Computer Safety, Reliability and Security, Munich, Germany, 6/09/22. https://doi.org/10.1007/978-3-031-14862-0_16

Towards Interdependent Safety Security Assessments Using Bowties. / Arnaboldi, Luca; Aspinall, David.
Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops: DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings. ed. / Mario Trapp; Erwin Schoitsch; Jérémie Guiochet; Friedemann Bitsch. 1. ed. Cham: Springer, 2022. p. 211–229 (Lecture Notes in Computer Science; Vol. 13415).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Towards Interdependent Safety Security Assessments Using Bowties

AU - Arnaboldi, Luca

AU - Aspinall, David

PY - 2022/9/7

Y1 - 2022/9/7

N2 - We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

AB - We present a way to combine security and safety assessments using Bowtie Diagrams. Bowties model both the causes leading up to a central failure event and consequences which arise from that event, as well as barriers which impede events. Bowties have previously been used separately for security and safety assessments, but we suggest that a unified treatment in a single model can elegantly capture safety-security interdependencies of several kinds. We showcase our approach with the example of the October 2021 Facebook DNS shutdown, examining the chains of events and the interplay between the security and safety barriers which caused the outage.

KW - Safety and security

KW - Bowtie diagrams

KW - Risk analysis

U2 - 10.1007/978-3-031-14862-0_16

DO - 10.1007/978-3-031-14862-0_16

M3 - Conference contribution

SN - 9783031148613

T3 - Lecture Notes in Computer Science

SP - 211

EP - 229

BT - Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops

A2 - Trapp, Mario

A2 - Schoitsch, Erwin

A2 - Guiochet, Jérémie

A2 - Bitsch, Friedemann

PB - Springer

CY - Cham

T2 - The 41st International Conference on Computer Safety, Reliability and Security

Y2 - 6 September 2022 through 9 September 2022

ER -

Arnaboldi L, Aspinall D. Towards Interdependent Safety Security Assessments Using Bowties. In Trapp M, Schoitsch E, Guiochet J, Bitsch F, editors, Computer Safety, Reliability, and Security. SAFECOMP 2022 Workshops: DECSoS, DepDevOps, SASSUR, SENSEI, USDAI, and WAISE Munich, Germany, September 6–9, 2022, Proceedings. 1 ed. Cham: Springer. 2022. p. 211–229. (Lecture Notes in Computer Science). Epub 2022 Sept 6. doi: 10.1007/978-3-031-14862-0_16

Towards Interdependent Safety Security Assessments Using Bowties

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this