Risk analysis of a distributed test object

Abstract

The present invention relates to a method, a computer program with instructions, and to a system for the risk analysis of a distributed test object. The invention also relates to devices for use in such a system. According to the invention, a risk analysis for a part of the test object located in a first context is carried out (10). In addition, a risk analysis for a part of the test object located in a second context is carried out (11). If a protection requirement is determined (12) in the case of one of the risk analyses, information relating to this determined (12) protection requirement is exchanged between the risk analyses (13). The determined (12) protection requirement can then be taken into account in that a risk-enhancing measure is determined (14). In this case, information relating to the determined (14) risk-enhancing measure can be exchanged between the risk analyses (15).

Description

[0001] Description

[0002] Risk analysis of a distributed object of investigation

[0003] The present invention relates to a method, a computer program with instructions, and a system for risk analysis of a distributed object of investigation. The invention further relates to devices for use in such a system.

[0004] An object of investigation for a cybersecurity risk analysis, e.g., a distributed function, can have components in various analysis contexts. These analysis contexts can be, for example, an embedded system, a backend or IT system, or a mobile device. A risk analysis is performed for the part of the object of investigation located in a context in a defined analysis context. This analysis context can be delimited by various properties, such as a distinct set of rules or a distinct analysis method, and a distinct rule for modeling the object of investigation.

[0005] Against this background, US 2010 / 0250476 A1 describes a method for assessing the risk of conflict between a number of security solutions to be integrated. A number of fragmentary security solutions are received in a computer system. A set of the received fragmentary security solutions is integrated into a composite security solution to meet a number of security requirements. The risk of conflict between the fragmentary security solutions to be integrated is assessed.

[0006] The CAIRIS tool is an open-source platform for the identification, specification, and validation of secure and usable systems. CAIRIS supports the concept of environments, thus enabling the modeling of usage contexts.

[0007] There is currently no technical solution that allows the consideration of distributed risk objects in different contexts. Either a holistic risk analysis is performed, which does not allow for dedicated assumptions about the context of a part of the risk object, or multiple analyses are performed that make mutual assumptions. The composability of risk analyses of a distributed risk object in different contexts is not known. In the case of a holistic analysis, a uniform set of rules, a uniform analysis method, and uniform modeling of the distributed parts of the risk object are required. In the case of separate analyses, assumptions about the various parts of the risk object must be transferred manually.

[0008] It would therefore be desirable to have a tool for conducting risk analyses that, on the one hand, allows the analysis of functional components in different contexts and, on the other hand, allows linking across different contexts for a holistic view of distributed functions.

[0009] It is an object of the invention to provide improved solutions for risk analysis of a distributed object of investigation.

[0010] This object is achieved by a method having the features of claim 1, by a computer program with instructions according to claim 9, by a system having the features of claim 10, and by devices according to claim 11 and claim 12. Preferred embodiments of the invention are the subject of the dependent claims.

[0011] According to a first aspect of the invention, a method for risk analysis of a distributed object of investigation comprises the steps:

[0012] - Carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation;

[0013] - Carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modelling the object of investigation; and

[0014] - Exchange of information on an identified protection need between the risk analyses, wherein, based on a transmission path of a data item for which a protection need has been identified, it is automatically determined which further risk analysis should consider the protection need. According to a further aspect of the invention, a computer program comprises instructions which, when executed by a computer, cause the computer to perform the following steps for risk analysis of a distributed object of investigation:

[0015] - Carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation;

[0016] - Carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modelling the object of investigation; and

[0017] - Exchange of information on an identified protection need between the risk analyses, whereby, based on a transmission path of a date for which a protection need has been identified, it is automatically determined which further risk analysis should take the protection need into account.

[0018] The term "computer" should be understood broadly. It specifically includes workstations, distributed systems, and other processor-based data processing devices.

[0019] The computer program may, for example, be made available for electronic retrieval or stored on a computer-readable storage medium.

[0020] According to a further aspect of the invention, a system for risk analysis of a distributed object of investigation comprises:

[0021] - a first analysis module for carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation; and

[0022] - a second analysis module for carrying out a partially or fully automated risk analysis for a part of the object of investigation located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation; wherein the first analysis module and the second analysis module are configured to exchange information on an identified protection need, wherein, based on a transmission path of a data item for which a protection need has been identified, it is automatically determined in which further risk analysis the protection need should be taken into account.

[0023] A first device for use in a system according to the invention comprises a first analysis module for performing a partially or fully automated risk analysis for a part of an object of investigation located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation. The first analysis module is configured to transmit information relating to an identified protection requirement to a second analysis module for performing a risk analysis for a part of the object of investigation located in a second context. Based on a transmission path of a datum for which a protection requirement has been identified, it is automatically determined in which further risk analysis the protection requirement should be considered.

[0024] A second device for use in a system according to the invention comprises a second analysis module for performing a partially or fully automated risk analysis for a part of an object of investigation located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model or a distinct analysis method and a distinct rule for modeling the object of investigation. The second analysis module is configured to consider a protection requirement determined by a first analysis module when performing a risk analysis for a part of the object of investigation located in a first context during the risk analysis in the second context.

[0025] The inventive solution enables the automation of resolving interdependencies by adding a modeling step in which information on an identified protection requirement is exchanged between the risk analyses. Based on the transmitted information, the same protection requirement can be adopted in each of the risk analyses involved. This eliminates the need for iterative, usually manual, synchronization of risk analyses in different contexts. Since manual implementation and maintenance of the risk analysis by a specialist is no longer required, the inventive solution is less complex and error-prone than known solutions. In particular, the additional time required for repetitive filing and review work by a specialist is eliminated.

[0026] According to the invention, risk analyses are conducted taking into account various regulations. A risk analysis is performed for the part of the object of investigation located in a specific context within a defined analysis context. This analysis context is delimited by various characteristics, such as a distinct set of rules or a distinct analysis method, and a distinct regulation for modeling the object of investigation.

[0027] According to the invention, the transmission path of a piece of data for which a need for protection has been identified is used to determine in which further risk analysis the protection need should be considered. A cross-context composition of the context-specific risk analyses can be achieved particularly advantageously by considering the information flows between the considered parts of the object of investigation. These information flows transport assets worthy of protection, i.e., data that should be represented in the risk analyses of the parts of the object of investigation. This representation can, if necessary, take place at different levels of abstraction.

[0028] According to one aspect of the invention, the identified protection needs are taken into account by defining a risk-mitigating measure. Defining or implementing a suitable risk-mitigating measure ensures that the identified protection needs are met.

[0029] According to one aspect of the invention, information on the defined risk-mitigating measure is exchanged between the risk analyses. In this way, the measure can then be incorporated into the risk analysis that identified the original protection requirement. This allows the risk-mitigating effect to be taken into account there as well. In particular, no further verification of the consistency of assumptions and measures is required, since no more assumptions need to be made.

[0030] According to one aspect of the invention, the risk mitigation measure is determined automatically or through manual intervention. For example, the risk mitigation measure can be automatically selected from relevant catalogs of measures based on the assigned protection requirement. This has the advantage that no manual intervention is required. Alternatively, the risk mitigation measure can also be determined at the personal discretion of a specialist. In this way, the decision-making authority regarding the measures taken lies with the responsible specialist.

[0031] According to one aspect of the invention, a threat to the protection requirement identified during the risk analysis in one context is taken into account in the risk analysis in the other context. Through the reciprocal linking of the risk analyses in the various contexts, in addition to the identified protection requirements and the respective risk-mitigating measures, threats to a protection requirement identified in another risk analysis can also be taken into account in the risk analysis that originated the protection requirement determination.

[0032] According to one aspect of the invention, an identified protection requirement is also taken into account in a risk analysis for a part of the object of investigation located in a third context. Traceability is also ensured across multiple analyses or analysis clusters, provided that the data is consistently identified. Implementation can be achieved using any algorithm that can identify all loop-free communication paths in a "network" of risk analyses. The propagation of the protection requirements and protective measures can then occur with or against the direction of data communication.

[0033] According to one aspect of the invention, the first context relates to a means of transportation, a mobile device, or an embedded system. The second context can, for example, relate to a backend or an IT system. The solution according to the invention can be used in all applications in which risk analyses are performed on distributed objects of investigation. Examples include applications on mobile phones with communication to an IT backend, the communication of industrial plants with IT systems, or the communication of embedded systems, such as chip cards or similar, with other systems.

[0034] Further features of the present invention will become apparent from the following description and the appended claims taken in conjunction with the figures.

[0035] Fig. 1 schematically shows a method for risk analysis of a distributed object of investigation; Fig. 2 shows a system for risk analysis of a distributed object of investigation;

[0036] Fig. 3 illustrates a well-known approach to risk analysis of a distributed

[0037] subject of investigation;

[0038] Fig. 4 illustrates an inventive approach for risk analysis of a distributed object of investigation;

[0039] Fig. 5 illustrates an object of investigation that is distributed between a means of transport and an IT backend;

[0040] Fig. 6 illustrates a risk analysis of the object of investigation from Fig. 5; and

[0041] Fig. 7 illustrates a first phase of a risk analysis according to the invention of an object of investigation extending over four contexts;

[0042] Fig. 8 illustrates a second phase of a risk analysis according to the invention of an object of investigation that extends to four contexts; and

[0043] Fig. 9 illustrates a third phase of an inventive risk analysis of an object of investigation that extends to four contexts.

[0044] To better understand the principles of the present invention, embodiments of the invention are explained in more detail below with reference to the figures. It is understood that the invention is not limited to these embodiments and that the described features may also be combined or modified without departing from the scope of the invention as defined in the appended claims.

[0045] Fig. 1 schematically shows a method for risk analysis of a distributed object of investigation. In the method, a partially or fully automated risk analysis is performed for a part of the object of investigation located in a first context 10. For example, the first context can relate to a means of transportation, a mobile device, or an embedded system. Furthermore, a partially or fully automated risk analysis is performed for a part of the object of investigation located in a second context 11. The second context can relate, for example, to a backend or an IT system. If a protection requirement is identified 12 during one of the risk analyses, information about this identified 12 protection requirement is exchanged between the risk analyses 13.In particular, based on the transmission path of a piece of data for which a protection need was identified, it is determined in which further risk analysis the protection need should be considered. The identified 12 protection need can then be taken into account by defining a risk-mitigating measure 14. The risk-mitigating measure can, for example, be defined automatically or through manual intervention. Information on the defined 14 risk-mitigating measure can then be exchanged between the risk analyses 15. Preferably, a threat to the protection need identified during the risk analysis in one context is also taken into account in the risk analysis in the other context. An identified protection need can also be additionally taken into account in a risk analysis for a part of the object of investigation located in a third context.

[0046] Fig. 2 shows a system 70 for risk analysis of a distributed object of investigation. In this example, the system 70 comprises a first device 20 for risk analysis and a second device 30 for risk analysis. The two devices 20, 30 communicate with each other via respective interfaces 21, 31. The first device 20 has a first analysis module 22 for performing a partially or fully automated risk analysis for a part of the object of investigation located in a first context. For example, the first context can relate to a means of transportation, a mobile device, or an embedded system. Accordingly, the second device 30 has a second analysis module 32 for performing a partially or fully automated risk analysis for a part of the object of investigation located in a second context. The second context can relate, for example, to a backend or an IT system.The first analysis module 22 and the second analysis module 32 are set up to exchange information on an identified protection requirement SB via the interfaces 21, 31. In particular, based on a transmission path of a date for which a protection requirement SB was identified, it is determined in which further risk analysis the protection requirement SB should be taken into account, i.e. with which analysis module 22, 32 corresponding information should be exchanged. The identified protection requirement SB can then be taken into account by the analysis modules 22, 32 by defining a risk-mitigating measure M. The risk-mitigating measure M can, for example, be defined automatically or through manual intervention. The analysis modules 22, 32 can then exchange information on the defined risk-mitigating measure M via the interfaces 21, 31.Preferably, information on threats to the protection requirement identified in the risk analyses will also be exchanged so that they can be taken into account by the analysis modules 22, 32.

[0047] The analysis modules 22, 32 can each be controlled by a control module 23, 33. Settings of the analysis modules can be changed via user interfaces 25, 35.

[0048] 22, 32 or the control modules 23, 33 can be changed. The data generated in the devices 20, 30 can be stored in a memory 24, 34 as needed, for example, for later evaluation or for use by the components of the device 20, 30. The analysis modules 22, 32 and the control modules 23, 33 can be implemented as dedicated hardware, for example, as integrated circuits. Of course, they can also be partially or completely combined or implemented as software running on a suitable processor, for example, a GPU or a CPU. The interfaces 21, 31 can alternatively be divided into separate inputs and outputs.

[0049] The memories 24, 34 of the described devices 20, 30 can have both volatile and non-volatile memory areas and can comprise a wide variety of storage devices and storage media, for example hard disks, optical storage media or semiconductor memories.

[0050] Fig. 3 illustrates a known approach to risk analysis of a distributed object of investigation UG. A first part 40 of the object of investigation UG is located in a first context, a second part 40' of the object of investigation UG is located in a second context. A risk analysis Ri, R2 is performed for the part 40, 40' of the object of investigation UG located in a context in a defined analysis context. This analysis context can be delimited by various properties, such as a distinct assessment model BM1, BM2 or a distinct analysis method AM1, AM2, and a distinct rule for modeling MV1, MV2 of the object of investigation UG. A cross-context composition of the context-specific analyses Ri, R2 is not possible.If the analysis result AE in a protection requirement assessment SBF results in a protection requirement SB that can only be met by a protective measure of a part 40, 40' of the distributed object of investigation UG located in a different context, an assumption A must be made regarding the existence of this measure. This measure can then be considered in the affected sub-analysis Ri, R2, but must itself be part of the analysis scope of the sub-analysis Ri, R2 in the other context. The analysis result AE must then be transferred sequentially to the requesting sub-analysis Ri, R2. This process must be repeated until all mutual effects have been considered.

[0051] Fig. 4 illustrates an inventive approach for risk analysis of a distributed object of investigation UG. A first part 40 of the object of investigation UG is located in a first context, a second part 40' of the object of investigation UG is located in a second context. A risk analysis Ri, R2 is carried out partially or fully automatically for the part 40, 40' of the object of investigation UG located in a context in a defined analysis context. This analysis context is, as usual, delimited by various properties, such as a distinct assessment model BM1, BM2 or a distinct analysis method AM1, AM2, and a distinct rule for modeling MV1, MV2 of the object of investigation UG. A cross-context composition of the context-specific analyses Ri, R2 is achieved by considering the information flows between the considered parts 40, 40' of the object of investigation UG.These information flows transport assets worthy of protection, i.e., data D, which must be represented in the analyses Ri, R2 of parts 40, 40' of the object of investigation UG. The protection requirement SB determined as the analysis result AE in a protection requirement assessment SBF and the resulting risk mitigating measure M can be mutually considered across contexts by tracking the information flow, independent of the modeling of parts 40, 40' of the distributed object of investigation UG. In this case, the sub-analyses Ri, R2 can be performed in parallel, and mutual consideration of the analysis results AE can be performed either assisted or automated.

[0052] A preferred embodiment of a solution according to the invention will be described below with reference to Fig. 5 to Fig. 9 using a concrete application example.

[0053] Fig. 5 illustrates an object of investigation that is distributed between a means of transport 50 and an IT backend 60. In the example shown, a function for user registration in the means of transport 50 is to be considered. This function has a component Fi in the means of transport 50 for carrying out the registration and storage of the registered user, and a component F2 in the IT backend 60, which is responsible for user administration and user authentication. The means of transport 50 and the backend 60 communicate for this purpose via a mobile network. Separate cybersecurity risk analyses must be performed for both components Fi and F2 of the function, i.e., in the means of transport 50 and in the backend 60. Between the functional components, there are two signals with two transmitted data items D: the registration data from the means of transport 50 and the result of the user authentication from the backend 60.

[0054] The problem arises from the fact that risk analyses are conducted taking into account different regulations regarding the assessment model, analysis methodology, and modeling rules, i.e., different analysis contexts exist. This prevents the risk analysis of both functional components from being performed in one go, i.e., using one tool or in a comprehensive risk analysis. Due to the different regulations and premises, the analysis of the two components must be performed separately.

[0055] Let us assume that the respective analysis determines that a) the user data from the means of transport 50 must be treated confidentially and b) the authentication result must be authentic. Taking into account the respective damage scenario, namely a) a violation of the user's privacy and b) an illegitimate login to the means of transport 50, a risk arises which, depending on the circumstances, requires mitigation, i.e., risk treatment through reduction, through appropriate security measures. However, these security measures cannot be defined and implemented unilaterally in all cases. If the authentication result is received by the means of transport 50, the means of transport 50 cannot do anything to ensure the required authenticity. This must be guaranteed by the backend 60.

[0056] Typically, assumptions about the communication partner are made. A first assumption, for example, is that the means of transport 50 ensures the confidentiality of user data during storage, processing, and transmission. A second assumption, for example, is that the backend 60 ensures the authenticity of the authentication result during processing and transmission.

[0057] Functional requirements arise from these assumptions about the communication partner. One functional requirement for the means of transport 50 is, for example, that the means of transport 50 stores user data confidentially in a secure storage area using suitable encryption and transmits the data via a channel that enables confidential transmission, e.g., TLS (Transport Layer Security). One functional requirement for the backend 60 is, for example, that the backend 60 transmits the authentication result via a channel that enables authentic transmission, e.g., TLS. These functional requirements must, in turn, be taken into account in the analysis of the respective counterpart.Therefore, with known approaches, the implementation of analyses with mutual dependence is a manual and, above all, iterative process, since the assumptions must be transferred after the (initial) analysis and the functional implementation must then be taken into account in a (secondary) analysis.

[0058] Fig. 6 illustrates an inventive risk analysis of the object of investigation UG from Fig. 5. In this case too, two analyses are carried out due to the differing analysis contexts, ie a first risk analysis Ri in the context “means of transport” 50 and a second risk analysis R2 in the context “IT backend” 60.

[0059] For the risk analysis Ri in the "means of transport" context, 50 an assessment model BMi can be used for the "embedded system" context, e.g., an assessment according to UNECE (United Nations Economic Commission for Europe) specifications. Accordingly, an analysis method AMi can be used for the "embedded system" context, e.g., a methodology according to UNECE specifications, and a modeling specification MVi can be used for the "embedded system" context. The modeling specification MVi can also be part of the external specifications, as shown in Fig. 6.

[0060] For the risk analysis R2 in the context of “IT backend” 60, an assessment model BM2 for the context of “IT system” can be used, e.g. an analysis according to the specifications of local institutions such as the BSI (Federal Office for Information Security).

[0061] Accordingly, an analysis method AM2 can be used for the "IT system" context, e.g., a methodology according to BSI specifications, and a modeling specification MV2 can be used for the "IT system" context. As with the risk analysis Ri, the modeling specification MV2 can be part of the external specifications.

[0062] However, for data D exchanged between the means of transport 50 and the backend 60, the respective data origin is annotated or taken into account. Between the analyses Ri, R2 performed, a uniform identification of transmitted data D is then enabled, either through alignment or assignment. This can occur independently of the analysis context and, in particular, the respective modeling rule MVi, MV2. The modeling of the object of investigation UG on the side of the means of transport 50 and the backend 60 is thus supplemented by only one step. If a protection requirement SB for a data item D is determined as the analysis result AE in a protection requirement determination SBF, e.g.For example, if the authentication result for the means of transport 50 is authentic, the methods by which the data D is transmitted can be automatically tracked, in this case from the backend 60, and the same protection requirement SB can be adopted in the analysis Ri, R2 of the transmission partner. In the analysis Ri, R2 of the transmission partner, a risk-mitigating measure M can then be defined, e.g., an authentic transmission, which can be automatically selected from relevant catalogs of measures based on the transmitted protection requirement SB or can be determined at the transmission partner's discretion.

[0063] Measure M, in this case the authentic transfer of the date, can now be reversed and applied to the analysis Ri, R2, which determined the original protection requirement SB, and the risk-mitigating effect can also be taken into account there. In particular, no further verification of the consistency of assumptions and measures is required, since no more assumptions need to be made.

[0064] Traceability is also ensured across multiple analyses Ri, R2, or analysis clusters, provided that the data D is consistently identified. Implementation can be achieved using any algorithm that can identify all loop-free communication paths in a "network" of risk analyses Ri, R2. The propagation of the protection requirements SB and the protection measures M can then occur with or against the direction of communication of the data D.

[0065] In the examples in Fig. 5 and Fig. 6, the protection requirement SB of a datum D is determined by the risk analysis Ri, R2 on whose side the datum D is sent. However, the protection requirement SB can just as well be determined by the risk analysis Ri, R2 on whose side the datum D is received.

[0066] Fig. 7 illustrates a first phase of a risk analysis according to the invention of an object of investigation that extends across four contexts. Four associated risk analyses RA1-RA4 are performed for the four contexts. In this example, the protection requirement is determined by the receiving side in each case. In the example shown, a first risk analysis RA1 of a part of the object of investigation in a first context determines the transmission of a first datum DA to a part of the object of investigation in a second context. The risk analysis RA2 in the second context also shows that the first datum DA is transmitted to a part of the object of investigation in a third context, for which a third risk analysis RA3 is performed.In a fourth risk analysis RA4 of a part of the object of investigation in a fourth context, the transmission of a second datum DB to the part of the object of investigation in the third context is also established.

[0067] Fig. 8 illustrates a second phase of the risk analysis according to the invention. The fourth risk analysis RA4 transmits a protection requirement SBB determined for the second date DB to the third risk analysis RA3. In addition, a protection requirement SB determined for the first date DA A 2 to the second risk analysis RA2. The second risk analysis RA2 determines the protection requirements SB based on the submitted protection requirements A 2 a total resulting protection requirement SB A2 ,I and transmits it to the first risk analysis RA1.

[0068] Fig. 9 illustrates a third phase of the risk analysis according to the invention. In response to the identified protection needs SB A2,I the first risk analysis RA1 defines a suitable risk mitigating measure M A I and transmits the relevant information to the second risk analysis RA2. Accordingly, the second risk analysis RA2, in response to the identified protection needs SB A 2 a suitable risk mitigating measure M A 2 and transmits the corresponding information to the third risk analysis RA3. The fourth risk analysis RA4, in response to the identified SBB protection needs, determines a suitable risk mitigation measure MB and transmits the corresponding information to the third risk analysis RA3. Thus, none of the risk analyses RA1-RA4 are dependent on making assumptions about the respective communication partners.

[0069] List of reference symbols

[0070] 10 Conducting a risk analysis in a first context

[0071] 11 Conducting a risk analysis in a second context

[0072] 12 Determining a need for protection

[0073] 13 Exchange of information on protection needs

[0074] 14 Determining a risk mitigating measure

[0075] 15 Exchange of information on the specified measure

[0076] 20 Device

[0077] 21 Interface

[0078] 22 Analysis module

[0079] 23 Control module

[0080] 24 storage

[0081] 25 User interface

[0082] 30 Device

[0083] 31 Interface

[0084] 32 Analysis module

[0085] 33 Control module

[0086] 34 storage

[0087] 35 User interface

[0088] 40, 40' Subject of investigation

[0089] 50 means of transport

[0090] 60 backend

[0091] 70 systems

[0092] A Assumption

[0093] AE analysis result

[0094] AMi, AM2Analysis method BMi, BM2Assessment model D, DA, DB Date FI, F2Functional share M, MAI, Risk mitigating measure MA2, MB

[0095] MF determination of measures

[0096] MVi, MV2Modeling specification RA1-RA4 Risk analysis SB, SB B Protection requirement SBA2, SBA2,1

[0097] SBF protection needs assessment

[0098] UG subject of investigation

Claims

Patent claims Method for risk analysis of a distributed investigation object (UD), comprising the steps: - Performing (10) a semi- or fully automated risk analysis (R1-R4) for a part (40) of the subject of investigation (SU) located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model (BM1) or a distinct analysis method (AM1) and a distinct rule for modeling (MV1) of the subject of investigation (SU); - Performing (11) a semi- or fully automated risk analysis (R1-R4) for a part (40') of the subject of investigation (SU) located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model (BM2) or a distinct analysis method (AM2) and a distinct rule for modeling (MV2) of the subject of investigation (SU); and - Exchanging (13) information about an identified (12) protection requirement (SB, SBB, SBA2, SBA2,I) between the risk analyses (R1-R4), wherein, based on a transmission path of a date (D, DA, DB) for which a protection requirement (SB, SBB, SBA2, SBA2,I) has been identified (12), it is automatically determined which further risk analysis (R1-R4) should take the protection requirement (SB, SBB, SBA2, SBA2,I) into account. Method according to claim 1, wherein the identified (12) protection requirement (SB, SBB, SBA2, SBA2,I) is taken into account by defining a risk-mitigating measure (M, MAI, MA2, MB) (14). Method according to claim 2, wherein information about the defined (14) risk-mitigating measure (M, MAI, MA2, MB) is exchanged between the risk analyses (R1-R4) (15). Method according to claim 2 or 3, wherein the risk mitigating measure (M, MAI, MA2, MB) is determined automatically or by manual intervention (14).Method according to one of the preceding claims, wherein a risk to the protection requirement (SB, SBB, SBA2, SBA2,I) identified in the risk analysis (R1-R4) in one context is taken into account in the risk analysis (R1-R4) in the other context. Method according to one of the preceding claims, wherein a determined (12) protection requirement (SB, SBB, SBA2, SBA2,I) is additionally taken into account in a risk analysis (R1-R4) for a part of the object of investigation (UG) located in a third context. Method according to one of the preceding claims, wherein the first context relates to a means of transport (50), a mobile device, or an embedded system. Method according to one of the preceding claims, wherein the second context relates to a backend (60) or an IT system. Computer program with instructions which, when executed by a computer, cause the computer to execute the steps of a method according to one of claims 1 to 8 for risk analysis of a distributed object of investigation (UG). System (70) for risk analysis of a distributed object of investigation (UG), comprising: - a first analysis module (22) for performing (10) a semi- or fully automated risk analysis (R1-R4) for a part (40) of the object of investigation (UG) located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model (BM1) or a distinct analysis method (AM1) and a distinct rule for modeling (MV1) the object of investigation (UG); and - a second analysis module (32) for performing (11) a semi- or fully automated risk analysis (R1-R4) for a part (40') of the subject of investigation (SU) located in a second context in a second analysis context, wherein the second analysis context is delimited by a distinct assessment model (BM2) or a distinct analysis method (AM2) and a distinct rule for modeling (MV2) of the subject of investigation (SU); wherein the first analysis module (22) and the second analysis module (32) are set up to exchange information on a determined (12) protection requirement (SB, SBB, SBA2, SBA2,I) (13), wherein, based on a transmission path of a date (D, DA, DB) for which a protection requirement (SB, SBB, SBA2, SBA2,I) has been determined (12), the protection requirement (SB, SBB, SBA2, SBA2,I) is to be taken into account in further risk analysis (R1-R4).Device (20) for use in a system according to claim 10, comprising a first analysis module (22) for performing (10) a semi- or fully automated. Risk analysis (R1-R4) for a part (40) of an object of investigation (UG) located in a first context in a first analysis context, wherein the first analysis context is delimited by a distinct assessment model (BM1) or a distinct analysis method (AM1) and a distinct rule for modeling (MV1) of the object of investigation (UG), wherein the first analysis module (22) is set up to transmit information on a determined (12) protection requirement (SB, SBB, SBA2, SBA2,I) to a second analysis module (32) for carrying out (11) a risk analysis (R1-R4) for a part (40') of the object of investigation (UG) located in a second context (13), wherein a transmission path of a data (D, DA, D) B ), for which there is a need for protection (SB, SB B , SB A2, SB A 2,I) was determined (12), is automatically determined, in the case of further soft risk analysis (R1-R4) the protection requirement (SB, SB B , SB A2, SBA2,I) should be taken into account. Device (30) for use in a system according to claim 10, comprising a second analysis module (32) for performing (11) a semi- or fully automated risk analysis (R1-R4) for a part (40') of an object of investigation (UG) located in a second context, wherein the second analysis context is delimited by a distinct assessment model (BM2) or a distinct analysis method (AM2) and a distinct rule for modeling (MV2) of the object of investigation (UG), wherein the second analysis module (32) is configured to take into account (12) a protection requirement (SB, SBB, SBA2, SBA2,I) determined by a first analysis module (22) when performing (10) a risk analysis (R1-R4) for a part (40) of the object of investigation (UG) located in a first context during the risk analysis (R1-R4) in the second context.

Images