Why We Cannot (Yet) Ensure the Cybersecurity of Safety-Critical Systems

There is a growing threat to the cyber-security of safety-critical systems.
\nThe introduction of Commercial Off The Shelf (COTS) software, including
\nLinux, specialist VOIP applications and Satellite Based Augmentation Systems
\nacross the aviation, maritime, rail and power-generation infrastructures has created
\ncommon, vulnerabilities. In consequence, more people now possess the technical
\nskills required to identify and exploit vulnerabilities in safety-critical systems.
\nArguably for the first time there is the potential for cross-modal attacks
\nleading to future ‘cyber storms’. This situation is compounded by the failure of
\npublic-private partnerships to establish the cyber-security of safety critical applications.
\nThe fiscal crisis has prevented governments from attracting and retaining
\ncompetent regulators at the intersection of safety and cyber-security. In particular,
\nwe argue that superficial similarities between safety and security have led
\nto security policies that cannot be implemented in safety-critical systems. Existing
\noffice-based security standards, such as the ISO27k series, cannot easily be integrated
\nwith standards such as IEC61508 or ISO26262. Hybrid standards such as
\nIEC 62443 lack credible validation. There is an urgent need to move beyond
\nhigh-level policies and address the more detailed engineering challenges that
\nthreaten the cyber-security of safety-critical systems. In particular, we consider
\nthe ways in which cyber-security concerns undermine traditional forms of safety
\nengineering, for example by invalidating conventional forms of risk assessment.
\nWe also summarise the ways in which safety concerns frustrate the deployment of
\nconventional mechanisms for cyber-security, including intrusion detection systems.