On the Definition of SurvivabilityJohn C. Knight*Kevin J. SullivanDepartment of Computer ScienceUniversity of Virginia151 Engineer’s WayP.O. Box 400740Charlottesville, VA 22904-4740(804) 924 2200 (Voice)(804) 982-2214 (FAX) {knight | sullivan}@cs.virginia.eduAbstractKeywordsSubmission CategoryDeclaration1. Introduction2. Related WorkSurvivability:Survivability:Survivability:Survivability:3. Critical Infrastructure Applications3.1. Banking and Financial ServicesFigure 1. Hypothetical banking network3.2. Freight Rail Transportation3.3. Critical Information System Characteristics• System Size• Externally Observable Damage• Damage and Repair Sequences• Time-Dependent Damage Effects• Heterogeneous Criticality• Complex Operational Environments• Time-Varying Operational Environments4. Survivability4.1. The Intuitive Notion4.2. Defining SurvivabilitySurvivable System:Survivability Specification:5. An Example• R1 Preferred.• R2 Industry/Government.• R3 Financial Markets.• R4 Government Bonds.Figure 2. Survivability specification example.• R5 Foreign Transfers.6. Survivability and Fault Tolerance6.1. The Role of Fault Tolerance6.2. Implementing Survivability7. Survivability and Security8. Conclusions and Future WorkAcknowledgmentsReferences[1] Anderson, T. and P. Lee. Fault Tolerance: Principles and Practice. Prentice Hall, Englewood C...[2] Armstrong, J.H., The Railroad: What It Is, What It Does, Simmons-Boardman, Omaha, NE, 1993.[3] Ball, R.E., The Fundamentals of Aircraft Combat Survivability Analysis and Design, American I...[4] Deutsch, M.S. & Willis, R.R., Software Quality Engineering: A Total Technical and Management ...[5] Ellison, B., D. Fisher, R. Linger, H. Lipson, T. Longstaff, and N. Mead. “Survivable Network ...[6] Knight, J., M. Elder, J. Flinn, and P. Marx. “Summaries of Four Critical Infrastructure Syste...[7] Laprie, J. “Dependable Computing: Concepts, Limits, Challenges,” Special Issue FTCS-25: 25th ...[8] Myers, J.F., “On Evaluating The Performability Of Degradable Computing Systems”, IEEE Trans. ...[9] Myers, J.F., W.H. Sanders, “Specification And Construction Of Performability Models” Proceedi...[10] National Defense Industrial Association Symposium, Proceedings of Aircraft Survivability 200...[11] Neumann, P.G., “Risks to the public in computer systems”, Software Engineering Notes, Vol 11...[12] Office of the Undersecretary of Defense for Acquisition and Technology. Report of the Defens...[13] President’s Commission on Critical Infrastructure Protection. Critical Foundations: Protecti...[14] Sullivan, K.J., J.C. Knight, X. Du, and S. Geist, “Information Survivability Control Systems...[15] Summers, B.J. (ed.), The Payment System: Design Management and Supervision, International Mo...[16] U.S. Department of Commerce, National Telecommunications and Information Administration, Ins...[17] http://www.cert.org/research/isw.html[18] http://www.aircraft-survivability.com/On the Definition of SurvivabilityJohn C. Knight* Kevin J. SullivanDepartment of Computer ScienceUniversity of Virginia151 Engineer’s WayP.O. Box 400740Charlottesville, VA 22904-4740(804) 924 2200 (Voice)(804) 982-2214 (FAX){knight | sullivan}@cs.virginia.eduAbstractThe computer systems that provide the information underpinnings for critical infrastructure applica-tions, such as banking systems and telecommunications networks, have become essential to the operation ofthose applications. Failure of the information systems will often cause a major loss of service, and so theirdependability has become a major concern. Current facets of dependability, such as reliability and avail-ability, do not address the needs of critical information systems because they do not include the notion ofdegraded service as an explicit requirement. What is needed is a precise notion of what forms of degradedservice are acceptable to the application, under what circumstances each form is most useful, and the frac-tion of time degraded service levels are acceptable. This concept is termed survivability and in this paper weshow that it is a necessary new facet of dependability. We present a formal definition of survivability andpresent an example of its use.KeywordsSurvivability, critical information systems.Submission CategoryRegular paper.DeclarationThis paper has been cleared through the authors’ affiliation.Page 11. IntroductionMany large infrastructure systems have evolved to a point where organizations rely heavilyupon them. In some cases, such systems are so widespread and so important that the normal activ-ities of society depend upon their continued operation; examples in this latter category includetransportation systems, telecommunications networks, energy generation and distribution systems,and financial services. Such systems are usually referred to as critical infrastructure applications.Powerful information systems have been introduced into critical infrastructure applications asthe cost of computing hardware has dropped and the availability of sophisticated software hasincreased [6]. In many cases, the provision of service by infrastructure applications is now highlydependent on the correct operation of computerized information systems, and, frequently, damageto the information system will lead to a loss of at least part of the service provided by the infra-structure application. In some cases, relatively minor damage can lead to a complete cessation ofservice. We refer to such information systems as critical information systems.The dependability of these critical information systems has become a major concern [12, 13].Dependability is a system property that is usually stated as a set of requirements with which thesystem has to comply. Dependability has many facets—reliability, availability, safety, and soon [7]—and to permit exact requirements statements about systems, each of these terms has a pre-cise meaning. For example, the reliability of a system, R(t), is defined to be the probability that thesystem will meet its requirements up until time t when operating in a prescribed environment. Sim-ilarly, the availability of a system, A(t), is the probability that the system will be operating cor-rectly at time t. For systems for which dependability is important, the system requirements statethe minimum acceptable value for the relevant facet of dependability, such as R(t) or A(t), and it isthen the responsibility of the developers and
View Full Document
Unlocking...