A new model-based risk analysis approach that generate cyberattacks scenarios and combine them with safety risks

Tamara Oueidat (1, 2) , Jean-Marie Flaus (1, 2) , François Massé (3)

1 G-SCOP_GCSP - Gestion et Conduite des Systèmes de Production
2 UGA - Université Grenoble Alpes
3 INERIS - Institut National de l'Environnement Industriel et des Risques

For many years, the introduction of connected systems and digital technology in critical industries worldwide makes them vulnerable to cyberattacks that can lead to undesirable safety accidents. Thus, analysing these attacks becomes an important matter during risk analysis. In most proposed risk analysis approaches applied in the industries, the safety subjects are taking into consideration without analysing the cyberattack that can lead to the same dangerous phenomenon as a safety incident, the safety and security subjects are treated separately, despite the common consequences and the interdependencies between them. Therefore, there is a strong interest in the development of risk analysis approaches combining safety and security, particularly in the process industry, which is a major potential hazard for local populations and the environment. In this article, a new model-based risk analysis approach is proposed, it presents a new way to generate the cyberattacks systematically based on the modelling system architecture and a list of generic vulnerabilities encountered on industrial systems. A likelihood evaluation for these attacks is presented with their combination with the safety risks.

Mots clés: Safety; Cybersecurity; Cyberattack; Accidental situation; Undesirable event; Risk analysis

Domaines: Systèmes et contrôle [cs.SY]

Tamara Oueidat, Jean-Marie Flaus, François Massé. A new model-based risk analysis approach that generate cyberattacks scenarios and combine them with safety risks. ESREL 2019 - 31st European Safety and Reliability Conference, Sep 2021, Angers, France. ⟨10.3850/981-973-0000-00-0⟩. ⟨hal-03355097⟩