# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 2 Literature Review
### Types of Software Test Techniques to Improve Trustworthiness of Security Assessment  
Intrusion Modes and Effects Criticality Analysis (IMECA): The US military made a commitment in the late 1940s to switch from a strategy of \"detect failure and fix it\" to one of \"predict failure and prevent it [36].\" The techniques created centered on identifying qualitative and quantitative risks in order to avoid failure. A technique called Failure Mode, Effects & Criticality Analysis (FMECA) includes quantitative failure analysis. The FMECA entails establishing a number of connections between anticipated failures (Failure Modes), their effects on the mission, and their causes (Causes and Mechanisms). The FMECA's methodologies and practices were made public in a number of Military Standards. The most well-known of these standards, MIL-STD-1629A, is still in use today [37]. An IMECA is a variation to the FMECA-technique that considers potential system invasions. The technique can be used to different kinds of vulnerabilities, but its primary use is to evaluate technical vulnerabilities [38]. At each level of the SDLC, where risk factors and security are evaluated, for safety-related sectors, IMECA can be utilized in addition to standardized FMECA, because if such systems are breached, any vulnerability could result in a failure. It is necessary to develop a security criticality matrix in order to analyze the cyber security concerns [39]. Thus, depending on the breadth of the assessment, the following situations are conceivable:  
1. A selection of specific IMECA tables are used to evaluate the complicated product or system as a whole (which are a collection of discrepancies that represent all the identified gaps) should be added to the IMECA table's one global representation of the entire system. In this instance, a global criticality matrix is built using each row of the global IMECA table as a foundation [40]. 2. Evaluation of specific (sub-)systems inside the complex system/product: An adequate set of local criticality matrices can be made to correspond to certain (sub-)systems, based on a number of neighborhood IMECA tables [40]. Attack Tree Analysis: Attack tree analysis was introduced in 1999 as a method for listing different attack pathways to accomplish an attack objective [41]. The assault goal is stated at the top of the tree, and branches are a list of the sub-goals that are listed below. Each branch has a number of leaf nodes, or actions, that must be taken in order to accomplish the sub-goals and, eventually, the main objective [41]. An arc indicating \"AND\" logic connects leaf nodes that must be executed simultaneously to accomplish a sub-goal. In contrast, leaf nodes that indicate different ways to achieve a sub-goal are not coupled, illustrating \"OR\" logic. Attack trees are derived from fault tree analysis, a technique used in the aerospace industry to identify defects in intricate systems. In order to identify the failure modes and dangers for intercontinental ballistic missiles (ICBMs), Bell Telephone Laboratories created fault trees in 1962 [41; 42]. Attack trees have come under fire for being static and arbitrary, despite being very helpful for a quick risk assessment [42]. Researchers have standardized attack tree components to lessen their subjectivity, which makes it easier to compare attack trees across many systems, scale them over numerous systems, and automate attack trees using AI planning logic [41]. However, there are other structural variants of attack trees that would be relevant and appropriate for security assessments. Vulnerability/Fault Injection Testing: This is a software testing approach that involves inserting errors into the code to increase coverage. It is sometimes combined with stress testing to determine how robust the generated software is [43]. To test and strengthen a system's stability and dependability, mistakes and defects are purposefully introduced into it.