Formalized Risk Assessment for Safety and Security

The manifold interactions between safety and security aspects in embedded systems makes it plausible to handle safety and security risks in a unified way. The paper develops a corresponding risk measure in the context of discrete event systems (DEVS). The chosen approach is based on a simulation of system dynamics, which allows risk assessments even in cases with stepwise system degradation, cascading failures, or cognitive attackers. The plausibility of the proposed risk measure is shown by its consistency with ’classical’ notions of risk. Its non-computability, on the other hand, indicates a realistic behavior in the presence of complex dynamics. Power grids are discussed as an application example and indicate some of the advantages of the proposed method.