Workshop on Whole-Lifecycle Security for Smart Systems:
Methods and Tools (LIFESEC)

Workshop on Whole-Lifecycle Security for Smart Systems: Methods and Tools (LIFESEC)

Ensuring secure hardware and software systems requires trustworthy methodologies for analysis, verification, and dynamic testing, supported by best practices and IT security guidelines throughout a product’s lifecycle. A holistic approach combining runtime monitoring and design-time methods like static analysis and program synthesis is crucial for robust formal guarantees. Key areas include firmware, communication protocols, operating systems, APIs, and cloud software, with careful consideration of supply chain integration of hardware and software. Papers are invited to discuss research into addressing challenges about the whole-lifecycle of software & hardware components: from upstream hardware & software supply chains, where dependencies are brought into the device under test (DUT) or system under test (SUT); through security by design of the DUT/SUT; and the secure operation of that device/system in many and varied cyber-physical situations, each of which has different priorities and presents different threats.

Topics of relevance include, but are not limited to:

1. Access control management of devices in systems
2. Management of updates and patching at scale and in different environments
3. Modelling of security threats and effects in terms of risks to stakeholders in cyber-physical situations
4. Security throughout the lifecycle of the IoT/Cyber Physical System (CPS)
5. Holistic methodologies for whole-lifecycle security management and how components and tools interoperate within such a methodology
6. Support for current relevant regulation, e.g. Cybersecurity Act, GDPR, Cyber Resilience Act
7. Security by design and / or security in operation
8. Certification & security evaluation
9. Security and Digital Twins
10. New solutions for secure bootstrapping and commissioning of smart systems
11. Tools and methods providing assurances about the hardware / software supply chain – e.g. provenance assurance of upstream libraries / components
12. Audit methods, plus auditable data structures and tools to support whole-lifecycle security assurance and device provenance
13. Dynamic scanning and detection tools, e.g. advanced vulnerability / attack / anomaly detection tools
14. Vulnerability scanning tools for hardware and software
15. Software-bill-of-materials generation from binaries
16. AI-assisted tools for security testing
17. Testing with fuzzing techniques