  By exploiting the increasing surface attack of systems, cyber-attacks can
cause catastrophic events, such as, remotely disable safety mechanisms. This
means that in order to avoid hazards, safety and security need to be
integrated, exchanging information, such as, key hazards/threats, risk
evaluations, mechanisms used. This white paper describes some steps towards
this integration by using models. We start by identifying some key technical
challenges. Then we demonstrate how models, such as Goal Structured Notation
(GSN) for safety and Attack Defense Trees (ADT) for security, can address these
challenges. In particular, (1) we demonstrate how to extract in an automated
fashion security relevant information from safety assessments by translating
GSN-Models into ADTs; (2) We show how security results can impact the
confidence of safety assessments; (3) We propose a collaborative development
process where safety and security assessments are built by incrementally taking
into account safety and security analysis; (4) We describe how to carry out
trade-off analysis in an automated fashion, such as identifying when safety and
security arguments contradict each other and how to solve such contradictions.
We conclude pointing out that these are the first steps towards a wide range of
techniques to support Safety and Security Engineering. As a white paper, we
avoid being too technical, preferring to illustrate features by using examples
and thus being more accessible.
