理解、实施和支持安全关键领域中的安全保障案例
Understanding, Implementing, and Supporting Security Assurance Cases in Safety-Critical Domains
AI总结：
针对安全关键领域安全保障案例（SAC）创建与管理的不足，提出CASCADE方法，结合ISO/SAE-21434和质量保证，通过资产驱动和机器学习分类，提升适用性与泛化性。
摘要：
安全关键领域对连接性的需求日益增长，使得安全保障成为关键考量。在安全关键行业中，软件和连接性已成为满足市场期望不可或缺的部分。监管机构现在要求安全保障案例（SAC）来验证合规性，如汽车领域的ISO/SAE-21434标准所示。然而，现有的SAC创建方法未能充分解决行业特定的约束和要求。在本论文中，我们提出了CASCADE，一种与ISO/SAE-21434对齐并整合质量保证措施的SAC创建方法。CASCADE基于对行业需求的洞察和系统性文献综述而开发。我们探讨了推动SAC采纳的各种因素，包括安全关键领域公司内部和外部的因素，并识别了现有文献中的空白。我们的方法解决了这些空白，并侧重于资产驱动的方法论和质量保证。我们提供了一个说明性示例，并在汽车OEM中评估了CASCADE的适用性和可扩展性。我们在医疗领域评估了CASCADE的泛化性，突出了其优势和必要的适应性调整。此外，我们通过开发机器学习模型对安全相关需求进行分类，并研究安全证据的管理，来支持SAC的创建和管理。我们识别了证据管理实践中的缺陷，并提出了潜在的自动化领域。最后，我们的工作促进了安全保障实践的进步，并为从业者创建和管理SAC提供了实际支持。
英文摘要：
The increasing demand for connectivity in safety-critical domains has made security assurance a crucial consideration. In safety-critical industry, software, and connectivity have become integral to meeting market expectations. Regulatory bodies now require security assurance cases (SAC) to verify compliance, as demonstrated in ISO/SAE-21434 for automotive. However, existing approaches for creating SACs do not adequately address industry-specific constraints and requirements. In this thesis, we present CASCADE, an approach for creating SACs that aligns with ISO/SAE-21434 and integrates quality assurance measures. CASCADE is developed based on insights from industry needs and a systematic literature review. We explore various factors driving SAC adoption, both internal and external to companies in safety-critical domains, and identify gaps in the existing literature. Our approach addresses these gaps and focuses on asset-driven methodology and quality assurance. We provide an illustrative example and evaluate CASCADE's suitability and scalability in an automotive OEM. We evaluate the generalizability of CASCADE in the medical domain, highlighting its benefits and necessary adaptations. Furthermore, we support the creation and management of SACs by developing a machine-learning model to classify security-related requirements and investigating the management of security evidence. We identify deficiencies in evidence management practices and propose potential areas for automation. Finally, our work contributes to the advancement of security assurance practices and provides practical support for practitioners in creating and managing SACs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
