Skip to main content
SpringerLink
Log in

Towards Integration of Compositional Risk Analysis Using Monte Carlo Simulation and Security Testing

  • Conference paper
  • First Online:
Risk Assessment and Risk-Driven Testing (RISK 2013)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 8418))

Included in the following conference series:

  • 705 Accesses

Abstract

This short paper describes ongoing efforts to combine concepts of security risk analysis with security testing into a single process. Using risk analysis artefact composition and Monte Carlo simulation to calculate likelihood values, the method described here is intended to become applicable for complex large scale systems with dynamically changing probability values.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 34.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 44.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. International Organization for Standardization: ISO 31000 Risk Management – Principles and Guidelines (2009)

    Google Scholar 

  2. International Organization for Standardization: ISO Guide 73 Risk Management – Vocabulary (2009)

    Google Scholar 

  3. Bouti, A., Kadi, D.A.: A state-of-the-art review of FMEA/FMECA. Int. J. Reliab. Qual. Saf. Eng. 1, 515–543 (1994)

    Article  Google Scholar 

  4. International Electrotechnical Commission: IEC 61025 Fault Tree Analysis (FTA) (1990)

    Google Scholar 

  5. International Electrotechnical Commission: IEC 60300-3-9 Dependability Management – Part 3: Application guide – Section 9: Risk Analysis of Technological Systems – Event Tree Analysis (ETA) (1995)

    Google Scholar 

  6. Lund, M.S., Solhaug, B., Stølen, K.: Model-Driven Risk Analysis – The CORAS Approach. Springer, Heidelberg (2011)

    Book  Google Scholar 

  7. Lund, M.S., Solhaug, B., Stølen, K.: Evolution in relation to risk and trust management. Computer 43(5), 49–55 (2010). IEEE

    Article  Google Scholar 

  8. Kaiser, B., Liggesmeyer, P., Mäckel, O.: A new component concept for fault trees. In: 8th Australian Workshop on Safety Critical Systems and Software (SCS’03), pp. 37–46. Australian Computer Society (2003)

    Google Scholar 

  9. Papadoupoulos, Y., McDermid, J., Sasse, R., Heiner, G.: Analysis and synthesis of the behaviour of complex programmable electronic systems in conditions of failure. Reliab. Eng. Syst. Saf. 71(3), 229–247 (2001). Elsevier

    Article  Google Scholar 

  10. Viehmann, J.: Reusing risk analysis results - an extension for the CORAS risk analysis method. In: 4th International Conference on Information Privacy, Security, Risk and Trust (PASSAT’12), pp. 742–751. IEEE (2012). doi:10.1109/SocialCom-PASSAT.2012.91

  11. Erdogan, G., Li, Y., Runde, R.K., Seehusen, F., Stølen, K.: Conceptual framework for the DIAMONDS project, Oslo, May 2012

    Google Scholar 

  12. Erdogan, G., Seehusen, F., Stølen, K., Aagedal, J.: Assessing the usefulness of testing for validating the correctness of security risk models based on an industrial case study. In: Proceedings of the International Workshop on Quantitative Aspects in Security Assurance (QASA’12), Pisa (2012)

    Google Scholar 

  13. Benet, A.F.: A risk driven approach to testing medical device software. In: Dale, A., Anderson, T. (eds.) Advances in Systems Safety, pp. 157–168. Springer, London (2011)

    Chapter  Google Scholar 

  14. Kloos, J., Hussain, T., Eschbach, R.: Risk-based testing of safety-critical embedded systems driven by fault tree analysis. In: Software Testing, Verification and Validation Workshops (ICSTW 2011), pp. 26–33. IEEE (2011)

    Google Scholar 

  15. Gleißner, W., Berger, T.: Auf nach Monte Carlo: Simulationsverfahren zur Risiko-Aggregation. RISKNEWS 1, 30–37 (2004). doi:10.1002/risk.200490005. Wiley

    Article  Google Scholar 

  16. Greenland, S.: Sensitivity analysis, Monte Carlo risk analysis, and Bayesian uncertainty assessment. Risk Anal. 21, 579–584 (2001). Wiley

    Article  Google Scholar 

  17. Kolmogorov, A.: Grundbegriffe der Wahrscheinlichkeitsrechnung. Springer, Heidelberg (1933)

    Book  Google Scholar 

  18. Caprotti, O., Carlisle, D.: OpenMath and MathML: semantic markup for mathematics. Crossroads 6(2), 11–14 (1999). doi:10.1145/333104.333110. ACM

    Article  Google Scholar 

  19. Viehmann, J.: The theory of creating trust with a set of mistrust-parties and its exemplary application for the s-network. In: Proceedings of Tenth Annual Conference on Privacy, Security and Trust (PST 2012), pp. 185–194. IEEE (2012). doi:10.1109/PST.2012.6297939

  20. Smith, B., Williams, L.: On the effective use of security test patterns. In: Proceedings of the Sixth International Conference on Software Security and Reliability (SERE 2012), pp. 108–117. IEEE (2012). doi:10.1109/SERE.2012.23

Download references

Author information

Authors and Affiliations

  1. Fraunhofer FOKUS, Kaiserin-Augusta-Allee 31, 10589, Berlin, Germany

    Johannes Viehmann

Authors
  1. Johannes Viehmann
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Johannes Viehmann .

Editor information

Editors and Affiliations

  1. Fraunhofer IESE, Kaiserslautern, Germany

    Thomas Bauer

  2. Fraunhofer Institut FOKUS, Berlin, Germany

    Jürgen Großmann

  3. SINTEF ICT, Oslo, Norway

    Fredrik Seehusen

  4. SINTEF ICT, Oslo, Norway

    Ketil Stølen

  5. Fraunhofer Institut FOKUS, Berlin, Germany

    Marc-Florian Wendland

Rights and permissions

Reprints and permissions

Copyright information

© 2014 Springer International Publishing Switzerland

About this paper

Cite this paper

Viehmann, J. (2014). Towards Integration of Compositional Risk Analysis Using Monte Carlo Simulation and Security Testing. In: Bauer, T., Großmann, J., Seehusen, F., Stølen, K., Wendland, MF. (eds) Risk Assessment and Risk-Driven Testing. RISK 2013. Lecture Notes in Computer Science(), vol 8418. Springer, Cham. https://doi.org/10.1007/978-3-319-07076-6_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-07076-6_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-07075-9

  • Online ISBN: 978-3-319-07076-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation