Example of Security Threat and Risk Analysis with MATLAB and Simulink
This project demonstrates a simplified model-based security threat and risk analysis in MATLAB® and Simulink®.
It demonstrates how to:
- identify assets and threats (STRIDE method) in an architectural model,
- estimate the feasibility of attack (simplified method),
- automatically calculate security risk (simplified method),
- define countermeasures and allocate security goals to the model,
- validate the completeness and consistenty of the risk analysis,
- verify the effectiveness of the countermeasure with attack simulation,
- update the risk analysis and identify stale data,
- export results to Excel.
The advantages of a model-based risk analysis are:
- rich, extensible and customizable threat meta-model
- tabular views with links to models and requirements
- validation of tables for completeness and consistency
- custom analysis and validation functions with the full power of MATLAB
- traceability from model to risk to countermeasures
- allocate vulnerabilities and security goals/countermeasures to model
- trace all relationships through the risk model
- consistency: co-evolves the system and risk analysis
- automatically picks up new assets from model
- staleness checks
- change analysis
- security guidance:
- suggests threats based on the STRIDE model
- dominance analysis to focus on the driving risk factors
- synergy with other MathWorks products
- link to safety impacts from FHA
- attacks can be simulated (attack library, non-intrusive)
- countermeasures and their effectiveness can be simulated (e.g., ID(P)S)
- end-to-end tracability from high-level requirements to source code
Prerequisites and Installation
For this tutorial to work you either need to use MATLAB Online or if you using a desktop installation make sure is at least R2024b Update1.
The following products are needed in order for this example to function correctly:
- MATLAB®
- Simulink®
- System Composer™
- Simulink Fault Analyzer™
- Requirements Toolbox™
- Stateflow®
- Navigation Toolbox™
Usage
To get started, open the project Robot.prj. If the live script did not open yet, click "openTutorial" in the project shortcuts, or open doc/Tutorial.mlx.
Disclaimer and Applicability
This project is a simplified, industry-agnostic example for security risk and threat analysis.
It is provided without any implied guarantees, to demonstrate product features and workflows.
If you are interested in applying this workflow to a specific industry or certification standard, contact MathWorks to obtain the appropriate support package.
