Cybersecurity Assessment and Risk Enumeration for Systems (CARES)

Although the resilience of Navy systems to cyber attacks is critically important, cybersecurity is still frequently “bolted on” to deployed systems and is rarely built in during the early design stages. Bolted-on security is costly and not as effective as building it in from the start. Current approaches for assessing security during the design stage tend to be manual, which is slow, expensive, and can also lead to conflicting recommendations. Tools in this space often provide qualitative results and are challenged by a lack of detailed information, which is often not available during the system design stage. During the Phase I effort, we demonstrated the feasibility of our Cybersecurity Assessment and Risk Enumeration for Systems (CARES) approach, which supports system designers and cyber analysts modeling systems during the early design stages. CARES uses systemic functional grammars to provide an expressive, scalable enumeration of the entire attack space, then automatically generates a quantitative list of security vulnerabilities for the target system, along with consistent recommendations for remediating vulnerabilities that take into account other system and design needs, such as performance and cost. In Phase II, we plan to fully develop CARES and focus on scalability to complex systems of systems.