SCSC SSS 2023 Working Group Update

The working group updated SSS 2023 attendees via an A0 poster and an A4 handout

Updates given at previous SSS conferences can be found here.

Current Activities

We are in the process of developing our guidance material to make it ready for publication. We are about to issue a draft of our Task Group 1 material for review (Co-ordination of Safety and Security within the system lifecycle). We have started to refine our Task Group 2 material (Principles on Evaluation of Risk).

We meet fortnightly on a Monday at 1100 (UK time) - meeting 11th December, then 8th January 2024. If you would like to take part, please contact Stephen Bull.

Statement of the Problem

Security of safety-critical systems is becoming more and more of an issue with ever changing threats, attacker skills and changes to the way software and systems are developed (i.e. greater reliance on COTS and supply chain). A system can only be deemed safe if it is also secure to enable it to carry out its safety function; this is true for both new and legacy systems. It is acknowledged over recent years many standards have been produced or are in production; often these are domain specific and are evolutions of IT based standards and good practice rather than considering established safety defence in depth design principles such as diversity and redundancy.

Why is the SCSC involved?

Due to the nature of the SCSC being cross domain and non-profit making, it provides an opportunity for experts from different domains and academia to come together to network and share best practice and experience.

What will the Working Group do?

The working group will aim to capture cross-domain best practice to help engineers find the ‘wood through the trees’ with all the different security standards, their implication and integration with safety design principles to aid the design and protection of secure safety-critical systems and systems with a safety implication.
The working group will aim to keep current with the fast changing security threats and new standards being published.

If you would like to join this group and contribute please contact Stephen Bull

Vision

To produce clear and current guidance on methods to design and protect safety-critical systems, in a way that reflects emerging best practice. This guidance will reflect the integration of safety and security principles.

Terms of Reference and working group goals are available in the SISWG resource area.

Focus Areas

We have established task groups to provide guidance in specific key areas relating to the impact of Cyber Security on Safety. It is intended that this guidance will be published as SCSC documents, although it will be aligned to the recently published IET Code of Practice on Cyber Security and Safety.

The task groups are looking at:

1. Co-ordination of Safety and Security within the system lifecycle
2. Principles on Evaluation of Risk
3. Mapping terminology and language between safety and security

Initial guidance documents have been prepared and we are in the process of refining them as explained here. We hope to publish the first one at SSS'24.

If you would like further information, please contact Stephen Bull