System of systems modelling for safety and cyber security assessments

This report introduces systems of systems (SoS) and of how they can be modelled for safety and cyber security assessments in complex industrial settings. We first establish an understanding of the relevant terminology and standards, which also helps distinguishing SoS from their stand-alone systems (SaS, a term we also introduce in this report) counterparts. The characteristics, classifications, and challenges of SoS are explored, stressing the complexity and importance of managing the interfaces between the different constituent systems. An interesting notion is that differences between a SaS and a SoS are not in the physical or hierarchical structure of its parts but in the behavioural and managerial characteristics of those parts. SoS challenges and the comparison with SaS emphasize the demands placed on systems engineering when dealing with SoS.

The report focuses on the importance of modelling techniques to support risk analyses in cyber-physical SoS. It covers various modelling approaches, such as structure models, behaviour models, SysML, UAF enterprise architecture modelling, system architecture modelling language and method Arcadia, STAMP modelling, data repository modelling with ontologies, and risk analysis modelling with RAAML language. These models are essential for understanding the interactions within SoS and for
identifying potential vulnerabilities, particularly in safety and cyber security contexts.

The normal safety and security analysis methods apply to SoS, but the focus is different from normal stand-alone systems because of the different nature of SoS compared to SaS, such as heterogeneity over homogeneity especially at the enterprise level but also at system level.

In addition to the technical dimension of cyber security assessments. We also discuss the conceptualization and assessment of cyber security culture at the SoS level. We briefly discuss the concept of cyber security culture. We then posit that in a SoS which is formed of a community of organizations, interactions, shared understanding, and alignment to common goals between the members play a key role in the emerging SoS-level cyber security culture. Moreover, we discuss ideas on approaching the assessment of cyber security culture in a SoS using the port community as an example, while recognizing the need for future
investigations on the matter.