A framework for risk analysis in automotive cybersecurity

We address the problem of automotive cybersecurity from the point of view of Threat Analysis and Risk Assessment (TARA). The central question that motivates the thesis is the one about the acceptability of risk, which is vital in taking a decision about the implementation of cybersecurity solutions. For this purpose, we develop a quantitative framework in which we take in input the results of risk assessment and define measures of various facets of a possible risk response; we then exploit the natural presence of trade-offs (cost versus effectiveness) to formulate the problem as a multi-objective optimization. Finally, we develop a stochastic model of the future evolution of the risk factors, by means of Markov chains; we adapt the formulations of the optimization problems to this non-deterministic context. The thesis is the result of a collaboration with the Vehicle Electrification division of Marelli, in particular with the Cybersecurity team based in Bologna; this allowed us to consider a particular instance of the problem, deriving from a real TARA, in order to test both the deterministic and the stochastic framework in a real world application. The collaboration also explains why in the work we often assume the point of view of a tier-1 supplier; however, the analyses performed can be adapted to any other level of the supply chain.

A framework for the environmental risk assessment of offshore carbon storage in CCS systems

Carbon capture and storage (CCS) represents an interesting climate mitigation option, however, as for any other human activity, there is the impelling need to assess and manage the associated risks. This study specifically addresses the marine environmental risk posed by CO2 leakages associated to CCS subsea engineering system, meant as offshore pipelines and injection / plugged and abandoned wells. The aim of this thesis work is to start approaching the development of a complete and standardized practical procedure to perform a quantified environmental risk assessment for CCS, with reference to the specific activities mentioned above. Such an effort would be of extreme relevance not only for companies willing to implement CCS, as a methodological guidance, but also, by uniformizing the ERA procedure, to begin changing people’s perception about CCS, that happens to be often discredited due to the evident lack of comprehensive and systematic methods to assess the impacts on the marine environment. The backbone structure of the framework developed consists on the integration of ERA’s main steps and those belonging to the quantified risk assessment (QRA), in the aim of quantitatively characterizing risk and describing it as a combination of magnitude of the consequences and their frequency. The framework developed by this work is, however, at a high level, as not every single aspect has been dealt with in the required detail. Thus, several alternative options are presented to be considered for use depending on the situation. Further specific studies should address their accuracy and efficiency and solve the knowledge gaps emerged, in order to establish and validate a final and complete procedure. Regardless of the knowledge gaps and uncertainties, that surely need to be addressed, this preliminary framework already finds some relevance in on field applications, as a non-stringent guidance to perform CCS ERA, and it constitutes the foundation of the final framework.