An Ontological Approach to Address Socio-Technical Gaps in Co-Engineering of Safety and Security

The co-engineering of safety and security in modern systems is a complex endeavor that requires the combined consideration of these qualities and their interactions. This is problematic in existing approaches as they focus mostly on a single quality and hence hinder the explicit consideration and analysis of the interactions. In addition to the technical complex-ity, human factors and social constructs lead to socio-technical challenges in the co-engineering, that can potentially result in unsafe and insecure systems. This research aims to simplify the identification and management of socio-technical challenges in safety and security co-engineering of complex, safety-critical systems. This research proposes a tool-based solution using ontologies and knowledge bases to facilitate knowledge exchange among stakeholders. The proposed tool-based solution improves upon the existing manual identification and management of socio-technical gaps. As a start, the research focuses on the challenges imposed by the different models, engineering views and analysis techniques used by safety and security domains, which convey actionable information to the stakeholders from other domains. To validate the usefulness of the proposed ontological approach, a proof-of-concept was created using the data flow diagram model of an existing Industry 4.0 use case and its threat risk analysis. The created domain ontology leveraged the security model and threat analysis, and was able to identify certain socio-technical gaps in the existing security threat modelling and analysis. The gaps identified were in regard to the modeling choices made during the analysis, the engineering rigor adopted to protect the most critical elements identified during the analysis and avoiding confusions when communicating the results of the analysis. Thus, the potential of the ontological approach to enhance understanding and communication within the security team, as well as between the safety and security teams, was demonstrated.