Cybersecurity decision diagrams

Cyber-physical systems (CPS) that integrate computation and physical components are part of the solutions for many problems of our time like the shift towards renewable energies, an aging population, or mobility. However, they are fragile, especially if misused for purposes out of their specification – for example in a cyber-attack. Therefore, considering security during CPS design just as functional aspects, “security by design”, is gaining the attention of policymakers around the globe. In regulations like the EU Cyber Resilience Act (CRA), security by design is mandated. This leaves CPS engineers with a new task. Not only do they have to consider cybersecurity, but they also need to communicate their cybersecurity decisions to auditors and authorities, users and operators, product owners and managers, and engineers from other domains or organizations that also contribute to CPS design. Hence the overarching question driving this work: how can CPS cybersecurity effectively and efficiently be communicated? More specifically, the first research question asks what engineers need to document during CPS design for communicating cybersecurity, and the second asks how it can be ensured that engineers are aware of cybersecurity decisions during design. The Cybersecurity Decision Diagrams concept was developed in this dissertation to make the increasing complexity of CPS cognitively manageable while designing them. It defines how to document cybersecurity decisions, their rationales, and the relevant information for making them – regardless of the chosen decision-making path. The documentation is model-based and visual, represented by three cybersecurity diagram types that can collaboratively be worked on by different engineering domains. Cybersecurity decisions are explicitly marked in these diagrams, and decision points cluster related cybersecurity decisions and couple them to deliverables of any existing CPS engineering workflow to remind CPS engineers to consider security during design. The concept was implemented as a software demonstrator and validated in three case studies re-iterating past engineering projects at a CPS user / operator (INEOS) and a CPS manufacturer (HIMA). The validation shows that introducing the Cybersecurity Decision Diagrams as a new common deliverable for all CPS engineering disciplines improves the identification of required cybersecurity decisions, the collaborative decision-making during design and the communication of these decisions afterwards. The concept can be applied both for defining the appropriate elements of cybersecurity documentation for a specific communication intention as well as for creating this documentation. Finally, the plurality of security decision-making paths encountered in the validation shows that there are valid reasons to settle for compromises in cybersecurity decisions – as long as there are no compromises made regarding their communication.