## 3 Cybersafety Method  
The STAMP framework [14, 15] asserts that accidents are a result of loss of control. Here, the key idea is that a complex system consists of a number of interacting decision-makers or controllers at different abstraction levels of the system (technology, operational, management, regulatory), each trying to enforce certain safety and security constraints on the controlled processes within the system. System-level losses emerge as a result of violation of these constraints. In this paradigm, each controller-controlled process interaction is viewed as a feedback loop. Any disruption of information flows within this feedback loop results in degradation of the controlled process which ultimately causes the system to transition into an unsafe/insecure state. Security, like safety, is therefore, an emergent property of the system that cannot be achieved by securing individual components; rather it requires a holistic view and understanding of the system where each component interaction is understood in the context of the entire system--people, processes, technology and organization. The STAMP-based STPA method is described in detail in the STPA handbook [14] while its application to a real-world industrial control system cybersecurity example is described as the Cybersafety method by [PERSON] [6]. In this section, we describe the proposed improvements to the Cybersafety method to better elicit security requirements from the analysis.  
The basic steps in the Cybersafety method are illustrated in Figure 1[6]. Briefly, the method starts by defining the basis of the analysis which includes identifying the goal of the system, the most critical losses and system-level hazards that can result in those losses (if not adequately controlled) along with system-level constraints to prevent the losses. The next step is to identify controllers responsible for enforcing constraints on the processes (i.e., to control the hazards) and their interactions with one another--this results in the development of a hierarchical functional control structure.  
Next, each control action for each controller is evaluated in the context of the various system and environmental states that the system is subject to, in order to identify hazardous control actions. Finally, loss scenarios are generated by hypothesizing how the interaction between the controllers, flaws within the system and missing constraints can be leveraged by an attacker to cause system-level losses. Countermeasures are then derived to prevent the hazards from propagating into system-level losses.  
We propose the following additions to the Cybersafety method to further focus the analysis on security issues and uncover systemic vulnerabilities:  
In Step 1, system-level hazards should be phrased as system-level threats. This implies rewording the hazards in terms of attacker targets. This would help reduce the gap in terminology with traditional security analyses while focusing the attention of the analyst to 'think like an attacker'.  
In Step 2, controllers enforcing security controls should be explicitly identified in addition to controllers enforcing safety constraints. In addition, for each controller, security responsibilities should also be explicitly identified in parallel to safety responsibilities.  
In Step 3, insecure control actions for each controller should be identified in conjunction with unsafe control actions.  
In Step 4, loss scenarios should encompass not only the failure of the control structure in enforcing safety constraints but also security constraints.  
The addition of these steps would help to bridge the gap between STAMP-based security analyses and traditional approaches used by security analysts.  
Figure 1: Overview of the Cybersafety method [6].