New Publication: Automated Security Risk Management for trains

Patric Birr and I published an article in SIGNAL+DRAHT, the leading international medium for control and safety technology plus communication and information technology in the railway sector.

In the article we propose automating Security Risk Assessments by using digital twins. These allow attack trees to be derived automatically enabling a systematic analysis of potential attack paths into a system.

Besides the Security Risk Assessments in the design phase of a system, this approach also simplifies the necessary updates of the Security Risk Assessment throughout the whole lifecycle of the system as well as simulating the security impact of changes e.g. by adding new components or interfaces to an existing system.

In the article, we use a train as an example to explain the principle. This approach is not limited to trains or the railway domain, however, and can be applied to all kinds of OT/IT systems.

Here is a link to the corresponding blog post on the ICS GmbH website, where you can find a link to the full article. The blog post is in German, but the article is available in both English and German:

🌐 Security-Risiken in Zügen automatisiert erkennen – mit Digitalem Zwilling und normkonformer Analyse