why 2 times 2 ain’t necessarily 4 – at least not in it...

siemens.com© Siemens AG 2016 – All rights reserved.

Why 2 times 2 ain’t necessarily 4 – at least not in IT security risk assessment?

Prof. Dr. Jens Braband

2016-11-11

© Siemens AG 2016 – All rights reserved.

Mobility Division

Prelude

It ain't necessarily soIt ain't necessarily soThe t'ings dat yo' li'bleTo read in de Bible,It ain't necessarily so.

Sung by Sportin’ Life, Drug Dealer

Von Ealmagro - Eigenes Werk, GFDL, https://commons.wikimedia.org/w/index.php?curid=6368328By Source, Fair use, https://en.wikipedia.org/w/index.php?curid=2214592

2016-11-11


Mobility Division

Introduction

2 x 2 = 4

Von Eigenes Werk - Eigenes Werk, GFDL, https://commons.wikimedia.org/w/index.php

2016-11-11


Mobility Division

Some additional thoughts

2 apples times 2 pears = 4 fruits?

Rank 2 times Rank 2 =????????

2016-11-11


Mobility Division

Basic approach for IT security risk assessment from IEC 62443

1. Breakdown of the system into zones and conduits so that• the IT security requirements are coordinated in zones or conduits • each object is allocated to a zone or conduit

2. Assessment of the risk for each zone or conduit and each fundamental requirement (FR)• identification and authentication control (IAC)• use control (UC)• system integrity (SI)• data confidentiality (DC)• restricted data flow (RDF)• timely response to events (TRE)• resource availability (RA)

3. Determine Security Level (SL) for each zone or conduit for each FR

2016-11-11


Mobility Division

Security-Level (SL) based on IEC 62443

Safety

Hacker

Organisation

Cyberwar

2016-11-11


Mobility Division

What’s the problem?

IEC 62443-3-2:2015 proposal for the determination of the target security level

What’s wrong with that?

2016-11-11


Mobility Division

Analysis

1. SL is by definition a seven-dimensional vector e. g. (1,2,1,4,3,3,3), not a single scalar

2. Setting all FR for a zone or conduit to the same scalar value is not reasonable3. For safety-related systems SL 0 is not reasonable, as all safety-related

systems have to cope with operator errors or forseeable misuse4. It is not justified why 4 is taken as a threshold. Why not take 5?5. The type of the parameters is ordinal. So only a ranking of values is implied.

How is multiplication defined semantically for ordinal or rank scales?6. For ordinal values we could have used the decriptors A, B, C, D and E. What

does BxC mean or CxD/4?

2016-11-11


Mobility Division

How can we rescue the concept?

The problem of ordinal scales is well known from semi-quantitative risk analysis, e. g. risk priority numbers (RPN) from IEC 60812.

Usually two criteria have to be fulfilled1) Scenarios with similar risks should lead to the same RPN.2) Scenarios with the same RPN should have similar risk

Unfortunately these criteria can‘t be fulfilled by multiplication.

2016-11-11


Mobility Division

OK. Let’s add the numbers…

• Multiplication is continued summation...• How is summation defined for ordinal numbers?• But summation is easier to justify. If R=L x I then the ordinal numbers can be interpreted of the logs of the original values (order of magnitude) and logs add• But what about proper calibration?• And how do we get SL from that?

2016-11-11


Mobility Division

New approach

1) Start with an educated guess of SL-T vector for a zone or conduit, say SL0

2) Perform a threat and risk analysis (TRA) assuming that all requirements forSL0 are fulfilled.

3) Change the SL for the FR that relate to the not acceptable risk giving SL0. Perform the TRA again.

Repeat these steps until SLn with acceptable risks is reached. Similar as in numerical bisection aka regula falsi.

2016-11-11


Mobility Division

Summary

We have discussed a new approach for SL determination from draft IEC 62443-3-2. The major new results are:

• The approach is seriously flawed

• The tolerable risk is not justified

• The derived SL does not fit to the definition of SL

• The multiplication of ordinal numbers is not defined

An alternative approach that overcomes these problems was sketched.

I'm preachin' dis sermon to show,It ain't nece-ain't neceAin't nece-ain't nece

Ain't necessarily ... so !

why 2 times 2 ain’t necessarily 4 – at least not in it...

Documents