English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The widespread use of software-intensive cyber systems in criticalinfrastructures such as ships (CyberShips) has brought huge benefits, yet ithas also opened new avenues for cyber attacks to potentially disruptoperations. Cyber risk assessment plays a vital role in identifying cyberthreats and vulnerabilities that can be exploited to compromise cyber systems.A number of methodologies have been proposed to carry out these analyses. Thispaper evaluates and compares the application of three risk assessmentmethodologies: system theoretic process analysis (STPA-Sec), STRIDE and CORASfor identifying threats and vulnerabilities in a CyberShip system. Wespecifically selected these three methodologies because they identify threatsnot only at the component level, but also threats or hazards caused due to theinteraction between components, resulting in sets of threats identified witheach methodology and relevant differences. Moreover, STPA-Sec which is avariant of the STPA is widely used for safety and security analysis of cyberphysical systems (CPS); CORAS offers a framework to perform cyber riskassessment in a top-down approach that aligns with STPA-Sec; and STRIDE(Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service,Elevation of Privilege) considers threat at the component level as well asduring the interaction that is similar to STPA-Sec. As a result of thisanalysis, this paper highlights the pros and cons of these methodologies,illustrates areas of special applicability, and suggests that theircomplementary use as threats identified through STRIDE can be used as an inputto CORAS and STPA-Sec to make these methods more structured.

A Comparative Risk Analysis on CyberShip System with STPA-Sec, STRIDE and CORAS