Comprehensive Security Assurance Solutions for Software-Dependent Systems

点击翻译按钮获取中文摘要

There is an ever-growing need to assure the security of critical software-dependent systems, and the information that they use, store, and communicate, in the face of cyber-attacks and failures. As systems grow larger and more complex they become more susceptible to a variety of unforeseen security vulnerabilities. Security should therefore be considered at all stages of their development. The current approach of having security "bolted-on" to the systems that we build is not sufficient. Instead, we need to consider the increasingly critical security requirements for these systems and design them with security "baked-in" so that sufficient evidence to support security assurance claims can be generated and reasoned about alongside the system being developed. The overall aim of this research program is to establish comprehensive security assurance solutions by enhancing security-by-design approaches for engineering secure software-dependent systems. More specifically, it aims to develop more incremental, modular, and compositional solutions for securing systems from the outset and for generating sufficient evidence of their built-in resilience to a range of cyber-attacks and failures. This requires the integration of formal (mathematically rigorous) methods and security-by-design approaches to provide verifiable evidence to support security assurance claims from early stages of system development. We will achieve this by: (1) Developing formal modeling and analysis frameworks with which we can provide mathematical proofs of assurance of security properties of software-dependent systems at early stages of development; (2) Establishing system-level security evaluation methods and techniques for understanding and mitigating the risks to system assets posed by identified security vulnerabilities; and (3) Advancing techniques to support the management, evaluation, and presentation of sufficient evidence for developing incremental security assurance cases. Governments, businesses, and users want to be assured that the cyber systems they use offer adequate protections to mitigate the potential risks and associated losses if they experience an attack or failure. The anticipated outcomes will help in establishing-at all stages of system development-sufficient evidence to provide this assurance. This will contribute to alleviating some of the challenges of reasoning about the security of large and complex software-dependent systems and the high-costs associated with security assurance and certification. This research supports Canada's strategic investment to position itself as a global leader in cybersecurity. The obtained results have the potential to impact and influence the development of standards, regulations, and guidelines pertaining to development, evaluation, and certification practices for high-assurance secure software-dependent systems enabling Canadians to have higher confidence in the cyber systems that underpin their daily lives.