Computer Security: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers

Description

This book constitutes the thoroughly refereed post-conference proceedings of the Third International Workshop on the Security of Industrial Control Systems and of Cyber-Physical Systems, CyberICPS 2017, and the First International Workshop on Security and Privacy Requirements Engineering, SECPRE 2017, held in Oslo, Norway, in September 2017, in conjunction with the 22nd European Symposium on Research in Computer Security, ESORICS 2017. The CyberICPS Workshop received 32 submissions from which 10 full and 2 short papers were selected for presentation. They cover topics related to threats, vulnerabilities and risks that cyber-physical systems and industrial control systems face; cyber attacks that may be launched against such systems; and ways of detecting and responding to such attacks. From the SECPRE Workshop 5 full papers out of 14 submissions are included. The selected papers deal with aspects of security and privacy requirements assurance and evaluation; and security requirements elicitation and modelling. Front Matter ....Pages I-XII Front Matter ....Pages 1-1 Towards End-to-End Data Protection in Low-Power Networks (Vasily Mikhalev, Laurent Gomez, Frederik Armknecht, José Márquez)....Pages 3-18 Development of an Embedded Platform for Secure CPS Services (Vincent Raes, Jan Vossaert, Vincent Naessens)....Pages 19-34 Introducing Usage Control in MQTT (Antonio La Marra, Fabio Martinelli, Paolo Mori, Athanasios Rizos, Andrea Saracino)....Pages 35-43 Front Matter ....Pages 45-45 Towards Security Threats that Matter (Katja Tuma, Riccardo Scandariato, Mathias Widman, Christian Sandberg)....Pages 47-62 A Methodology to Assess Vulnerabilities and Countermeasures Impact on the Missions of a Naval System (Bastien Sultan, Fabien Dagnat, Caroline Fontaine)....Pages 63-76 STRIDE to a Secure Smart Grid in a Hybrid Cloud (Bojan Jelacic, Daniela Rosic, Imre Lendak, Marina Stanojevic, Sebastijan Stoja)....Pages 77-90 Front Matter ....Pages 91-91 Stealthy Deception Attacks Against SCADA Systems (Amit Kleinmann, Ori Amichay, Avishai Wool, David Tenenbaum, Ofer Bar, Leonid Lev)....Pages 93-109 On Ladder Logic Bombs in Industrial Control Systems (Naman Govil, Anand Agrawal, Nils Ole Tippenhauer)....Pages 110-126 Enforcing Memory Safety in Cyber-Physical Systems (Eyasu Getahun Chekole, John Henry Castellanos, Martín Ochoa, David K. Y. Yau)....Pages 127-144 Front Matter ....Pages 145-145 Supporting the Human in Cyber Defence (Kirsi Helkala, Benjamin J. Knox, Øyvind Jøsok, Ricardo G. Lugo, Stefan Sütterlin, Geir Olav Dyrkolbotn et al.)....Pages 147-162 CRBP-OpType: A Constrained Approximate Search Algorithm for Detecting Similar Attack Patterns (Ambika Shrestha Chitrakar, Slobodan Petrović)....Pages 163-176 Multistage Downstream Attack Detection in a Cyber Physical System (Rizwan Qadeer, Carlos Murguia, Chuadhry Mujeeb Ahmed, Justin Ruths)....Pages 177-185 Front Matter ....Pages 187-187 A UML Profile for Privacy-Aware Data Lifecycle Models (Majed Alshammari, Andrew Simpson)....Pages 189-209 Evaluation of a Security and Privacy Requirements Methodology Using the Physics of Notation (Vasiliki Diamantopoulou, Michalis Pavlidis, Haralambos Mouratidis)....Pages 210-225 Front Matter ....Pages 227-227 What Users Want: Adapting Qualitative Research Methods to Security Policy Elicitation (Vivien M. Rooney, Simon N. Foley)....Pages 229-249 An Anti-pattern for Misuse Cases (Mohammad Torabi Dashti, Saša Radomirović)....Pages 250-261 Decision-Making in Security Requirements Engineering with Constrained Goal Models (Nikolaos Argyropoulos, Konstantinos Angelopoulos, Haralambos Mouratidis, Andrew Fish)....Pages 262-280 Erratum to: Enforcing Memory Safety in Cyber-Physical Systems (Eyasu Getahun Chekole, John Henry Castellanos, Martín Ochoa, David K. Y. Yau)....Pages E1-E1 Back Matter ....Pages 281-281