Jul 2020· International Journal of Systems and Software Security and Protection· Vol 11, pp. 38-57· 14 citations· 40 references
Computer Science
TL;DR
The study shows that, because security is a cross-cutting property in complex CPSs, its proficient management requires system-wide competencies and capabilities across the CPSs development and operation.
Abstract
With the expansion of cyber-physical systems (CPSs) across critical and regulated industries, systems must be continuously updated to remain resilient. At the same time, they should be extremely secure and safe to operate and use. The DevOps approach caters to business demands of more speed and smartness in production, but it is extremely challenging to implement DevOps due to the complexity of critical CPSs and requirements from regulatory authorities. In this study, expert opinions from 33 European companies expose the gap in the current state of practice on DevOps-oriented continuous development and maintenance. The study contributes to research and practice by identifying a set of needs. Subsequently, the authors propose a novel approach called Secure DevOps and provide several avenues for further research and development in this area. The study shows that, because security is a cross-cutting property in complex CPSs, its proficient management requires system-wide competencies and capabilities across the CPSs development and operation.
This paper investigates a secure-by-design engineering process focusing on the initial architectural design and examines the role that AI-powered agents can play in supporting it, as well as the conditions required for their effective and reliable use.
C. Ponsard, Jean-François Daune· International Conference on...· 0 citations
Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range (SOR) is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translated into security requirements, the elicitation of which is usually difficult and time-consuming. This work examines how large language models can assist in eliciting security requirements for a service-oriented range and help produce a useful baseline for designers and developers. The approach follows a SEBoK-guided process in which security mission objectives and stakeholder needs were first identified and then provided as a prompt context along with architectural guidelines to five LLMs: GPT-5.2, Gemini 3.1 Pro, Grok 4.1, Sonar, and Kimi K2.5. The models generated 84 security requirements in total, which were consolidated into a comprehensive set of 27 requirements and then mapped to the architectural layers of the service-oriented range. The final set was evaluated by five cybersecurity experts against the criteria of necessity, clarity, completeness, feasibility, and testability, with an additional rejection option. The results showed a high acceptance rate, specifically for necessity with 98.5%, clarity with 87.4%, completeness with 85.2%, feasibility with 78.5%, and rejection with 0.7%. Testability was lower at 44.4%, indicating a slight lack of information on how these requirements could be tested. These findings show that LLMs can support early stages of the elicitation of security requirements, although human review is still needed, especially to improve or adjust certain aspects of the requirements.
Michail Takaronis, Athanasia Kollarou, G. Kavallieratos et al.· 0 citations
This paper introduces OTLabs, emulated operational technology (OT) and industrial control system (ICS) environments designed to support hands-on industrial cybersecurity training in container-based cyber ranges. The approach addresses the need to strengthen practical OT-ICS skills in the face of increasing complexity, ongoing digitalization, and expanding attack surfaces in cyber-physical systems, particularly in the electric and industrial manufacturing sectors. The paper discusses the typical OTLab architecture, the use of orchestration scripts, and the development methodology, covering both technical and educational aspects. In total, thirteen OTLabs were developed, ranging from introductory OT-ICS asset discovery labs to more advanced scenarios. OTLabs have been integrated into undergraduate courses and training programs, with high student acceptance and engagement.
Luiz F. Freitas-Gutierres, J. Cassol, A. Morais et al.· Anais do LIII Seminário Inte...· 0 citations
As enterprises increasingly adopt Software-as-a-Service (SaaS) platforms for mission-critical functions, onboarding these services has emerged as a complex challenge extending well beyond procurement and basic security review. In regulated environments, SaaS onboarding must address multiple interdependent control domains, including Third-Party Risk Management (TPRM), cybersecurity assessment, Identity and Access Management (IAM), and disaster recovery (DR), which are often executed in isolation, resulting in delayed go-lives, duplicated assessments, unclear ownership, and residual operational risk. This paper proposes a control-driven, end-to-end SaaS onboarding framework that integrates TPRM, cybersecurity, IAM, and DR into a unified lifecycle model. The framework introduces a stage-based approach spanning intake and risk scoping, architecture validation, identity design, resilience assessment, and post-production governance. Key contributions include: (1) a structured SaaS onboarding lifecycle emphasizing sequencing and dependency management across control domains; (2) a cross-domain control mapping highlighting failure modes caused by siloed reviews; and (3) practical design patterns for secure connectivity, federated identity, least-privilege access, and shared-responsibility disaster recovery. Supported by operational lessons from enterprise-scale implementations and a reference governance checklist, the framework helps organizations reduce onboarding friction, improve auditability, and strengthen the security and resilience posture of SaaS-enabled platforms.
The automotive industry increasingly relies on complex embedded systems that inte-grate software, electronic hardware, electromechanical, and mechanical components. To ensure quality, the
A
utomotive
S
oftware
P
rocess Improvement and Capability Determination (ASPICE) framework has been extended by cybersecurity, which has become a critical concern. Recognizing these risks, the United Nations Economic Commission for Europe (UNECE) introduced Regulation No. 155 in 2021, establishing mandatory provisions for vehicle type approval and cybersecurity management. To address these regulatory demands, ASPICE for Cybersecurity extends the standard ASPICE model with additional processes focused on identifying, analyzing, and mitigating security threats. While the combined assessment of ASPICE and ASPICE for Cybersecurity ensures both process maturity and security compliance, it presents significant challenges for organizations. Conducting separate assessments for ASPICE and ASPICE for Cybersecurity increases time, cost, and organizational workload, as many process areas overlap in scope and evidence. This paper proposes a unified assessment approach designed to evaluate compliance with both ASPICE and ASPICE for Cybersecurity in a single, integrated process. The approach involves systematically mapping equivalent or related process areas across the two models. This approach was applied in an industry case study, demonstrating a reduction in total assessment time and minimizing disruption to development teams. The results indicate that integrated assessments can maintain the rigor and comprehensiveness of separate evaluations while improving efficiency and reducing operational burden.
Christian Schlager, A. Mashkoor· Journal of universal compute...· 0 citations
The paper is a systematic and multifaceted review of the new trends in cyber-physical security of smart factories, and looks at the threat landscapes, attack vectors, architecture weaknesses, and intersection of the information technology (IT) and operational technology (OT) worlds.
Hiroshi Tanaka, Yuki Nakamura· International Journal of Mod...· 0 citations
Computer-use AI agents struggle with multi-step workflows like email and customer support. Echoverse trains agents in realistic environments rather than simply providing more training tasks, helping them improve as the tasks, tests, and environments evolve. The post Echoverse: Deep, evolving environments for computer-use agents appeared first on Microsoft Research.
