Reproducing a Security Risk Assessment Using Computer Aided Design

2025-09-20

AI Summary

Current safety risk assessments predominantly rely on manual processes, rendering them susceptible to subjectivity, inconsistency, human error, and deficiencies in reproducibility and transparency. To address these limitations, this study presents the first independent replication of a peer-reviewed safety assessment case and introduces a Model-Based Systems Engineering–Computer-Aided Design (MBSE-CAD) methodology that embeds safety analysis directly into the system modeling workflow. This enables structured reconstruction and automated verification of the assessment process. Empirical evaluation—comparing conventional manual approaches with MBSE-CAD tools on real-world industrial cases—demonstrates significant improvements in analytical consistency, traceability, and reproducibility, while substantially reducing human bias. The work establishes a rigorous, scalable, and sustainable framework for safety engineering practice, bridging the gap between industrial application and academic research.

Technology Category

• Natural Language Processing: Safety and Robustness
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Simulating Human Behavior

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Security risk assessment is essential in establishing the trustworthiness and reliability of modern systems. While various security risk assessment approaches exist, prevalent applications are "pen and paper" implementations that -- even if performed digitally using computers -- remain prone to authoring mistakes and inconsistencies. Computer-aided design approaches can transform security risk assessments into more rigorous and sustainable efforts. This is of value to both industrial practitioners and researchers, who practice security risk assessments to reflect on systems' designs and to contribute to the discipline's state-of-the-art. In this article, we report the application of a model-based security design tool to reproduce a previously reported security assessment. The main contributions are: 1) an independent attempt to reproduce a refereed article describing a real security risk assessment of a system; 2) comparison of a new computer-aided application with a previous non-computer-aided application, based on a published, real-world case study; 3) a showcase for the potential advantages -- for both practitioners and researchers -- of using computer-aided design approaches to analyze reports and to assess systems.

Problem

• Addressing inconsistencies in traditional security risk assessment methods
• Applying computer-aided design to improve assessment rigor and sustainability
• Comparing computer-aided versus non-computer-aided security assessment approaches

Innovation

• Model-based security design tool application
• Independent reproduction of security risk assessment
• Comparison of computer-aided versus non-computer-aided approaches