Attack-Surface Metrics, OSSTMM and Common Criteria Based Approach to “Composable Security” in Complex Systems

In recent studies on Complex Systems and Systems-of-Systems theory, a huge effort has been put to cope with behavioral problems, i.e. the possibility of controlling a desired overall or end-to-end behavior by acting on the individual elements that constitute the system itself. This problem is particularly important in the “SMART” environments, where the huge number of devices, their significant computational capabilities as well as their tight interconnection produce a complex architecture for which it is difficult to predict (and control) a desired behavior; furthermore, if the scenario is allowed to dynamically evolve through the modification of both topology and subsystems composition, then the control problem becomes a real challenge. In this perspective, the purpose of this paper is to cope with a specific class of control problems in complex systems, the “composability of security functionalities”, recently introduced by the European Funded research through the pSHIELD and nSHIELD projects (ARTEMIS-JU programme). In a nutshell, the objective of this research is to define a control framework that, given a target security level for a specific application scenario, is able to i) discover the system elements, ii) quantify the security level of each element as well as its contribution to the security of the overall system, and iii) compute the control action to be applied on such elements to reach the security target. The main innovations proposed by the authors are: i) the definition of a comprehensive methodology to quantify the security of a generic system independently from the technology and the environment and ii) the integration of the derived metrics into a closed-loop scheme that allows real-time control of the system. The solution described in this work moves from the proof-of-concepts performed in the early phase of the pSHIELD research and enrich es it through an innovative metric with a sound foundation, able to potentially cope with any kind of pplication scenarios (railways, automotive, manufacturing, ...)

Efficient systems for the securities transaction industry : a framework for the European Union

This paper provides a framework for the securities transaction industry in the EU to understand the functions performed, the institutions involved and the parameters concerned that shape market and ownership structure. Of particular interest are microeconomic incentives of the industry players that can be in contradiction to social welfare. We evaluate the three functions and the strategic parameters - the boundary decision, the communication standard employed and the governance implemented - along the lines of three efficiency concepts. By structuring the main factors that influence these concepts and by describing the underlying trade-offs among them, we provide insight into a highly complex industry. Applying our framework, the paper describes and analyzes three consistent systems for the securities transaction industry. We point out that one of the systems, denoted as 'contestable monopolies', demonstrates a superior overall efficiency while it might be the most sensitive in terms of configuration accuracy and thus difficult to achieve and sustain