Towards an Ontology for Technical Security Standards

Security is an important quality attribute of today’s systems and services. Much security knowledge is encoded in technical security standards that define requirements on how to develop secure systems. Applying this knowledge is challenging and strives for the development of intelligent applications supporting developers and security experts in their work. We report on the development of an ontology as the structural basis for a knowledge graph that enables reasoning and AI-based methods. For the development of the ontology, we systematically analyzed technical standards in the field of industrial automation and control systems and industrial internet of things to identify the elements and concepts required to describe the standards in a machine-processable form. In this paper, we describe the systematic development and the structure of an ontology to represent technical security standards. The ontology is available online to facilitate further discussion. In our ongoing work, we use the ontology to populate a KG, which serves as basis for a domain expert evaluation on how semantically encoded security standards can support system developer in practice.