Aerospace and Electronic Systems Magazine November 2017 - 9

Asgari et al.
scenario can be completed successfully and practically, and realized according to the scale specified in SecRAM. The SecRAM
scoring is subjective and depends on definition of scales, best practices, intuition, and the security experts' knowledge. This method
is opinion based but it is still one of the main methods to access
the impact and likelihood by accounting for various real-world parameters. According to the SecRAM, the likelihood is built from a
split into exposure or frequency of occurrence of the threat source
and potentiality, the probability that once the threat source occurs,
the threat scenario sequence is completed successfully. Once both
likelihood layers have been evaluated, the likelihood is obtained
from the average of both values rounded up to the next integer.
Once the likelihood and impact of each threat has been assessed, the level of risk is calculated according to the SecRAM recommendation. Treatment actions or security controls are defined
to protect SA. They are a collection of measures for managing
risks and to ensure the security objectives are met. They include,
but are not limited to, procedures, policies, more robust technical
solutions, and management actions. The security objective level
comes from the definition of the impact area such as performance,
economic, etc. A security need is defined whether a risk should be
treated or not; when the level of a risk is higher than the security

NOVEMBER 2017

objective of an SA (i.e. the lowest security objective) it is targeting,
a treatment shall be applied.
The risk treatment option should be selected from the actions,
i.e., tolerate, reduce, avoid, or transfer. Here, we choose the "tolerate" option for the threats with 'low' risk level and the "reduce"
option in combating threats with 'medium' and 'high' risk levels to
meet security objective levels. In defining the security controls, it
is important to take into account the three parameters (i.e., likelihood, impact, and risk level). For example, if the likelihood has a
high value and impact has a low value, but risk level is high, the
security control should be primarily defined to counter the likelihood and it could overlook the impact.
Once the type of treatment has been evaluated (e.g. for reduction of the risk), a strategy of protection for SA is applied in order
to choose the best set of security controls. The strategy proposed by
SESAR offers two approaches for combined security control: "defense in depth" and "strength of control." Defense in depth relies on a
multilayered set of unrelated controls acting together to provide protection to a supporting asset. The multilayered approach to controls
means that if one control is compromised then another control should
act as the next layer of defense. Strength of control relies on improving the performance of one "type" of control (e.g., rigorous access

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017