Data-flow-based adaption of the System-Theoretic Process Analysis for Security (STPA-Sec)

Area of Science:

• Cybersecurity Engineering
• System Safety Engineering
• Information Security Analysis

Background:

• Traditional security analysis struggles with complex socio-technical systems.
• System-Theoretic Process Analysis for Security (STPA-Sec) addresses system interactions but overlooks information security.
• Existing methods lack guidance for identifying information security concepts.

Purpose of the Study:

• To propose a data-flow-based adaptation of STPA-Sec (STPA-DFSec).
• To overcome limitations of STPA-Sec in identifying information security issues.
• To systematically elicit security constraints for complex systems.

Main Methods:

• Developed STPA-DFSec, a data-flow-based adaptation of STPA-Sec.
• Applied both STPA-DFSec and STPA-Sec to analyze a vehicle digital key system.
• Investigated the relationship and differences between the two approaches.

Main Results:

• STPA-DFSec directly identifies information-related problems from data processing.
• The study highlights the applicability and differences of STPA-DFSec and STPA-Sec.
• The proposed approach systematically elicits security constraints.

Conclusions:

• STPA-DFSec enhances security analysis by focusing on data flow.
• The approach complements STPA-Sec for comprehensive system security.
• STPA-DFSec facilitates multi-disciplinary system co-design within the STPA framework.