Our dependability on software in every aspect of our lives has exceeded the level that was expected in the past. We have now reached a point where we are currently stuck with technology, and it made life much easier t...Our dependability on software in every aspect of our lives has exceeded the level that was expected in the past. We have now reached a point where we are currently stuck with technology, and it made life much easier than before. The rapid increase of technology adoption in the different aspects of life has made technology affordable and has led to an even stronger adoption in the society. As technology advances, almost every kind of technology is now connected to the network like infrastructure, automobiles, airplanes, chemical factories, power stations, and many other systems that are business and mission critical. Because of our high dependency on technology in most, if not all, aspects of life, a system failure is considered to be very critical and might result in harming the surrounding environment or put human life at risk. We apply our conceptual framework to integration between security and safety by creating a SaS (Safety and Security) domain model. Furthermore, it demonstrates that it is possible to use goal-oriented KAOS (Knowledge Acquisition in automated Specification) language in threat and hazard analysis to cover both safety and security domains making their outputs, or artifacts, well-structured and comprehensive, which results in dependability due to the comprehensiveness of the analysis. The conceptual framework can thereby act as an interface for active interactions in risk and hazard management in terms of universal coverage, finding solutions for differences and contradictions which can be overcome by integrating the safety and security domains and using a unified system analysis technique (KAOS) that will result in analysis centrality. For validation we chose the Systems-Theoretic Accident Model and Processes (STAMP) approach and its modelling language, namely System-Theoretic Process Analysis for safety (STPA), on the safety side and System-Theoretic Process Analysis for Security (STPA-sec) on the security side in order to be the base of the experiment in comparison to what was done in SaS. The concepts of SaS domain model were applied on STAMP approach using the same example @RemoteSurgery.展开更多
随着云计算的快速发展及其普及,企业的传统数据安全边界被打破,出现云资产管理混乱、越权、误操作等现象,对用户的信息安全产生巨大威胁。基于此,对目前云计算环境下身份认证和访问管理(identity and access management,IAM)的安全问题...随着云计算的快速发展及其普及,企业的传统数据安全边界被打破,出现云资产管理混乱、越权、误操作等现象,对用户的信息安全产生巨大威胁。基于此,对目前云计算环境下身份认证和访问管理(identity and access management,IAM)的安全问题进行研究,提出结合内生安全思想,采取拟态防御手段构建出一种具有内生安全效应的拟态身份认证和访问管理(mimicry identity and access management,MIAM)体系架构方案,并对其进行详细描述。将该方案分别进行稳定性测试、系统性能测试以及系统安全性评估,实验数据表明,该方案具有可行性和安全性。展开更多
目的探讨医疗失效模式与效应分析(healthfailuremode and effect analysis,HFMEA)在腹腔镜手术中转开放手术配合中的应用效果。方法选取2022年1—6月厦门大学附属第一医院收治的718例腹腔镜手术患者作为实施前;选取2022年7—12月厦门大...目的探讨医疗失效模式与效应分析(healthfailuremode and effect analysis,HFMEA)在腹腔镜手术中转开放手术配合中的应用效果。方法选取2022年1—6月厦门大学附属第一医院收治的718例腹腔镜手术患者作为实施前;选取2022年7—12月厦门大学附属第一医院收治的662例腹腔镜手术患者作为实施后。2022年6月组建跨专业的多学科小组,梳理腹腔镜手术中转开放手术实施的关键环节,对中转开放手术实施过程中可能出现的失效模式进行严重度、发生的可能性、探测的可能性评分,根据危害评分矩阵评估风险优先指数(risk priority number,RPN),针对RPN>125分的5项失效模式进行改进。比较实施前后的RPN和应急抢救配合满意度。结果腹腔镜手术中转开放手术安全管理体系中包括手术间管理不符合要求、人员管理不符合要求、临床实施操作不规范、仪器及设备运行失效、手术护理记录不规范5个方面17个风险点;其中有8个风险点需要采取措施进行控制,实施控制措施后,8个风险点的RPN值均有下降,且均<8分。手术医护团队对于实施腹腔镜手术中转开放手术管理策略的实践均表示认可。结论基于HFMEA对腹腔镜手术中转开放手术配合应急抢救进行风险识别及评估,建立腹腔镜手术中转开放手术配合安全管理机制,可有效降低腹腔镜手术中转开放手术配合应急抢救RPN,保障腹腔镜手术中转开放手术配合顺利,保障患者安全。展开更多
文摘Our dependability on software in every aspect of our lives has exceeded the level that was expected in the past. We have now reached a point where we are currently stuck with technology, and it made life much easier than before. The rapid increase of technology adoption in the different aspects of life has made technology affordable and has led to an even stronger adoption in the society. As technology advances, almost every kind of technology is now connected to the network like infrastructure, automobiles, airplanes, chemical factories, power stations, and many other systems that are business and mission critical. Because of our high dependency on technology in most, if not all, aspects of life, a system failure is considered to be very critical and might result in harming the surrounding environment or put human life at risk. We apply our conceptual framework to integration between security and safety by creating a SaS (Safety and Security) domain model. Furthermore, it demonstrates that it is possible to use goal-oriented KAOS (Knowledge Acquisition in automated Specification) language in threat and hazard analysis to cover both safety and security domains making their outputs, or artifacts, well-structured and comprehensive, which results in dependability due to the comprehensiveness of the analysis. The conceptual framework can thereby act as an interface for active interactions in risk and hazard management in terms of universal coverage, finding solutions for differences and contradictions which can be overcome by integrating the safety and security domains and using a unified system analysis technique (KAOS) that will result in analysis centrality. For validation we chose the Systems-Theoretic Accident Model and Processes (STAMP) approach and its modelling language, namely System-Theoretic Process Analysis for safety (STPA), on the safety side and System-Theoretic Process Analysis for Security (STPA-sec) on the security side in order to be the base of the experiment in comparison to what was done in SaS. The concepts of SaS domain model were applied on STAMP approach using the same example @RemoteSurgery.
文摘随着云计算的快速发展及其普及,企业的传统数据安全边界被打破,出现云资产管理混乱、越权、误操作等现象,对用户的信息安全产生巨大威胁。基于此,对目前云计算环境下身份认证和访问管理(identity and access management,IAM)的安全问题进行研究,提出结合内生安全思想,采取拟态防御手段构建出一种具有内生安全效应的拟态身份认证和访问管理(mimicry identity and access management,MIAM)体系架构方案,并对其进行详细描述。将该方案分别进行稳定性测试、系统性能测试以及系统安全性评估,实验数据表明,该方案具有可行性和安全性。
