Boeing

MBSE Threat Trees

This student team sought to create a framework for cybersecurity Threat Trees (Attack Trees) in the Boeing MBSE Environment. The framework related the Threat Trees to SysML model elements such as Fault Tree objects, structural blocks, and system behavior (which will be provided by Boeing). The Threat Trees aimed to establish qualitative ranges, in rough quantitative terms, to help determine likelihoods and assurance levels. The intended outcomes for this project included: 1) Identify and customize a graphical front-end a. Used to create Threat Trees for Cyber-Physical avionics systems, needs to be simple and flexible b. Create custom Threat Tree symbols and add Properties to support the framework c. Properties must support rough quantitative assessments using basic risk assessment methods d. Properties must support integration of Security Assessment with Safety Analyses (fault trees) 2) Create Cameo macro (Python) to parse the Threat Trees (which are presumably exported to xml) and build Cameo Generic Tables containing Threat Tree objects to be used in the framework 3) Create the Risk Assessment framework for threat tree objects in SysML and Python. The framework must be capable of relating threat conditions to system hazards and fault tree elements, see RTCA DO-356. There is some design freedom, but the framework should be adaptable to various avionics systems, and is expected to include proper SysML relationships, SysML diagrams, and Cameo dependency matrices. 4) Create a demonstration project which uses the framework. The demo should be based on a simple aircraft function which uses an ARINC 664 network. The demonstration must show end-to-end capabilities of the framework (threat tree creation to system hazards, structure, and fault trees). 5) Present the demonstration and project summary to Boeing Cybersecurity team members, ARINC 664 network team members, Avionics team members, Boeing Fellows, and associated managers.