D.3.3 ALGORITHMS FOR INCREMENTAL ... - SecureChange

Tactical
Monitor air
R
controller
traffic
Observe air
situation display
Surveillance
Flight data
data
De
Manage
Surveillance
surveillance
data
data
+
AND
Availability of
Manage radar Gather aircraft
radar signal
signal
position
Run fault
De
tolerant
MRT
RDPS crashes
[possible]
Failure in
Unreliable
Component
provisioning
RDPS
failure
of surveillance
Failure of A/C data
tracking [possible]
[likely]
Loss of radar
signal in MRT
Run fault
tolerant MRT
minor
Availability of
surveillance
data
De
FDPS
RDPS
Radar
Insufficient
radar
maintenance
Radar
(a)
(b)
Fig. 2. SI* and CORAS models examples
surveillance data to be fulfilled. The provision of Surveillance data is delegated to the
RDPS. The RDPS is concerned about the availability of the radar signal as expressed
by the soft goal Availability of radar signal since the radar signal is crucial for the computation
of aircrafts’ arrival sequence.
2.2 CORAS
Risk management may be referred to as activities to direct and control an organization
with regard to risk. CORAS is a model-driven approach to risk management that is
based on the ISO 31000 standard for risk management [13], and offers a method for
risk analysis. The CORAS risk analysis method is supported by the CORAS language,
that serves as the basis for building different kinds of diagrams for risk modeling and
analysis. The method and language are firmly based on a set of well-defined risk related
concepts. The most important of these, as well as the relationships between them, are
shown in the UML class diagram of Figure 3.
An unwanted incident is an event that harms or reduces the value of an asset, where
an asset is something to which a party assigns value and hence for which the party requires
protection. A party is a stakeholder, i.e. an organization, company, person, group
or other body, on whose behalf a risk analysis is conducted. A risk is the likelihood of
an unwanted incident and its consequence for a specific asset, where the likelihood is
the frequency or probability for something to occur and the consequence is the impact
of an unwanted incident on an asset in terms of harm or reduced asset value. A threat
is the potential cause of an unwanted incident, whereas a threat scenario is a chain or
series of events that is initiated by a threat and that may lead to an unwanted incident.
A vulnerability is a weakness, flaw or deficiency that opens for, or may be exploited
by, a threat to cause harm to or reduce the value of an asset. Finally, a treatment is an
appropriate measure to reduce risk level.
Example 2. The CORAS threat diagram of Figure 2 (b) documents a risk with respect
to the asset Availability of surveillance data. The provisioning of surveillance data partly
relies on the radar data processing system (RDPS) and aircraft (A/C) tracking by radar,
and failure in any of the two may lead to loss of availability.