# SPD-Safe: Secure Administration of Railway Intelligent Transportation Systems
## 3 Administration of IoT Deployments
### SPD Measurement  
The SPD multi-metric methodology [69] measures the provided protection level of a system and its various configurations. The system's perimeter is identified and the data sources, entry, and exit points are recorded. Then, the mechanisms that protect each of these elements are assessed based on the standardized Criteria Evaluation Methodology (CEM) [69]. This involves the attack potential risk analysis that evaluates the attacker's motive to misuse specific system elements, expertise, and the resources that they are willing to devote for an attack. Henceforth, five parameters are examined for the analysis of a potential threat:  
* Required time: The time that it is required to perform a specific attack (e.g., in days or weeks):
* Expertise: The technical skills and knowledge that the attacking group can exhibit (such as copy-cat, advanced, or expert):
* Knowledge of the target: Familiarity with the targeted system and its operation (e.g., public, sensitive, or critical information concerning some subsystems, etc.):
* Window of opportunity: The attacker may require appreciable access to the system in order to exploit a vulnerability and avoid detection:
* Resources: The software, hardware, or other equipment that is necessary to perform an attack (such as specialized or common resources).  
Figure 1: The software layers of the proposed security, privacy, and dependability (SPD)-Safe framework.  
The method does not investigate every possible attack but educes a good indication of the defense status in accordance with standard ratings. The protection level for each of the three SPD properties is calculated by integrating the risk analysis with the efficacy of the installed defenses against known attacks and/or other limitations (e.g., based on the latest reports from Computer Emergency Response Teams (CERTs) or Common Vulnerabilities and Exposures (CVE) repositories). The result is a value in the range of 0-100, where 0 represents the absence of defense mechanisms and 100 represents full protection. The final outcome is a vector of <<Security, Privacy, Dependability>>, which represents the total SPD value of the currently composed setting of the system. The SPDs of different system configurations can be estimated either in advance or at runtime. The first option is leveraged by the AI units of SPD-Safe in order to perform proactive and/or automated changes in the state architecture when a safety or security event occurs. The second option provides indications to the human operator in order to take decisions and make manual interventions.  
Therefore, the protection status of all mechanisms and their integration in the demonstration examples are pre-calculated based on this method, as described in Sections 4 and 5. Then, automated administration policies are triggered in response to real-time events, as presented in Section 5.  
These features enable the implementation of a relative novel protection strategy, called Moving Target Defenses (MTDs) [74]. When a system is stable, it is seen as a \"sitting duck\" by the attacker, who has plenty of time to analyze it, detect potential vulnerabilities, and exploit them. With MTD, a system that is aware of the defense level of its various components, their configurations, and the integration of all of them, can alter the setting automatically or semi-automatically in a periodic fashion. The AI modules are always keeping the system in a secure state, while the different configuration and architectural sets increase the system states that have to be analyzed by the attacker. In addition, the time that a specific setting remains active is determined by the time required for an average hacker to analyze it (i.e., based on the \"Required Time\" factor of the attack potential risk analysis). Performing attacks is becoming quite hard, while the window of opportunity for the malicious entities has significantly decreased.