Dependability and Security Specification Flashcards
Name the three key types of requirements in relation to Dependability?
Functional Requirements
- define error checking and recovery facilities and protection against system failures and external attacks.
Non-Functional Requirements
- defining the required reliability and availability of the system.
Excluding Requirements
- defining states and conditions that must not arise.
What is meant by Risk-Driven Specification
A process that involves understanding the risks (safety, security, etc) faced by the system and to define requirements that reduce these risks.
Critical systems’ specifications should be risk-driven as risks pose a threat to the system.
Note: This approach has been widely used in safety and security-critical systems
Name three different types of (phased) risk analysis
Preliminary Risk Analysis
- Risks from the systems environment. Aim is to develop an initial set of system security and dependability requirements.
Life Cycle Risk Analysis
- Risks that emerge during design and development and are associated with the technologies used for system construction. Requirements are extended to protect against these risks.
Operational Risk Analysis
- Risks associated with the system user interface and operator errors. Further protection requirements may be added to cope with these.
Name each part of a risk-driven specification
Risk Identification
- Identify potential risks that may arise.
Risk Analysis
- Assess the seriousness of each risk.
Risk Decomposition
- Decompose risks to discover their potential root causes.
Risk Reduction
- Define how each risk can be eliminated or reduced in design.
What is meant by Safety Specification?
Meaning: Identify protection requirements that ensure that system failures do not cause injury or death or environmental damage.
- Risk identification = Hazard identification
- Risk analysis = Hazard assessment
- Risk decomposition = Hazard analysis
- Risk reduction = Safety requirement specification
What is Hazard Identification?
Meaning: Identify the hazards that may threaten the system.
- Hazard identification may be based on different types of hazard:
- Physical hazards
- Electrical hazards
- Biological hazards
- Service failure hazards, etc.
What is Hazard Assessment?
Meaning: Assessing the likelihood that a risk will arise and what are the potential
consequences if an accident should occur?
- Risks are categorised as (Risk Triangle):
- Intolerable - Must never arise or
result in an accident - As low as reasonably practical
(ALARP) - Must minimise the
possibility of
risk given cost and schedule
constraints - Acceptable - The consequences of
the risk are acceptable and no extra
costs should be incurred to reduce
hazard probability
- Intolerable - Must never arise or
Describe the Risk Triangle
Three Regions:
- Unacceptable region (Risk cannot be tolerated)
- Risk tolerated only if risk reduction is impractical or excessively expensive
- Acceptable region
- Negligible Risk (Minimal Damage)
What is the general ‘social acceptance’ of safety-related risks?
- In most societies, the boundaries between the regions are pushed upwards with time i.e. society is less willing to accept risk.
- For example, the costs of cleaning up pollution may be less than the costs of preventing it but this may not be socially acceptable.
- Risk assessment is subjective
- Risks are identified as probable, unlikely, etc. This depends on who is making the assessment.
What is meant by Hazard Assessment?
(alternative defintion)
Meaning: Estimating the hazard probability and the hazard severity.
- It is not normally possible to do this precisely so relative values are used
(probable, unlikely, low, medium, high, rare) - The aim is to make sure that the system can handle hazards that are likely to arise or that have high severity.
What is meant by Hazard Analysis?
Meaning: Concerned with discovering the root causes of risks in a particular system.
- Techniques have been mostly derived from safety-critical systems and can be:
- Inductive, bottom-up techniques.
Start with a proposed system
failure and assess the hazards that
could arise from that failure; - Deductive, top-down techniques.
Start with a hazard and deduce
what the causes of this could be.
- Inductive, bottom-up techniques.
How does Fault-Tree Analysis Work?
- Put the risk or hazard at the root of the tree and identify the system states that could lead to that hazard.
- Identify first-level, second-level, n-level contributors to the top-level event.
- Where appropriate, link these with ‘and’ or ‘or’ conditions.
- The key goal should be to minimise the number of single causes of system failure. (No single point of failure).
What is Risk Reduction?
Name three different Risk Reduction Strategies?
Meaning: to identify dependability requirements that specify how the risks should be managed and ensure that accidents/incidents do not arise.
Risk Reduction Strategies:
* Risk avoidance;
* Risk detection and removal;
* Damage limitation.
How are the risk reduction strategies used?
- Normally, in critical systems, a mix of risk reduction strategies are used.
- In a chemical plant control system, the system will include sensors to detect and correct excess pressure in the reactor.
- However, it will also include an independent protection system that opens a relief valve if dangerously high pressure is detected.
Summary of Topic so far (Dependability and Security Specification)
- Risk analysis is an important activity in the specification of security and dependability requirements. It involves identifying risks that can result in accidents or incidents.
- A hazard-driven approach may be used to understand the system’s safety requirements. You identify potential hazards and decompose these (using methods such as fault tree analysis) to discover their root causes.
- Safety requirements should be included to ensure that hazards and
accidents do not arise or, if this is impossible, to limit the damage caused by system failure.
