System/software resilience
Increasing interconnectivity is a characteristic feature of evolutionary system landscapes,
where inherent system complexity contributes to increased vulnerability to disturbances.
Therefore, adapting to disturbances is of particular interest.
Resilience engineering has established itself as an interdisciplinary engineering paradigm since the early 2000s,
building on insights from systems theory and security research.
One challenge lies in its conceptual approach to risk.
Risk assessment quantifies the probability and consequences of an event to identify critical system components
vulnerable to specific threats.
System resilience, on the other hand, takes a "threat-agnostic" approach.
It is understood as a system's ability to adapt to changing conditions, detect disturbances, and absorb them.
The resilience concept becomes particularly relevant when risks are not sufficiently predictable.
Therefore, measuring resilience requires novel analytical approaches that complement existing risk approaches while
still allowing for differentiation.
Delay -/Holding Attack
In industrial systems, disruptions in messaging systems are considered particularly critical,
as they are essential for the communication of cyber-physical systems (CPS) and
often form a bridge (coupling) between the digital and physical worlds
(for example, in measurement and control technology for motors, valves, and turbines).
In an industrial context, not only availability but also determinism is crucial—that is,
the certainty that a message (I/O signals) arrives within fixed and often very short time windows,
since even slight delays can have significant potential for damage. A delay attack,
also known as a latency or holding attack,
increases the latency of messages by a constant or variable amount.
This exploits protocol weaknesses, for example, in messaging protocols such as
MQTT (CVE-2026-22535, CVE-2026-40046) or OPC UA (CVE-2025-11043),
or vulnerabilities in software systems.
Automated, adaptive systems for responding to security incidents are among the most effective measures
against threat scenarios. This includes integrated automation in “Cyber Threat Intelligence (CTI) frameworks”
to enable rapid containment and remediation of differentiated disruptions.
One example is the STIX/TAXII framework, which can be used to automate the exchange of information between
CTI organizations, security platforms, and government agencies.
STIX stands for Structured Threat Information Expression and can be understood as a standardized CTI language used to describe cyber threats,
attack patterns, campaigns, indicators, malware, threat actors, and more.
TAXII is a protocol for exchanging CTI information and
has been available in version 2.1 since June 2021.
TAXII is used by various CTI platforms, Security Information and Event Management (SIEM) systems, and
Computer Emergency Response Teams (CERTs).
Link(s):STIX Version 2.1 Errata 01, TAXII 2.1
The concept of system resilience (ISO/IEC 9837:2026) consists of three essential capabilities:
(1) detection and assessment of disturbances (t0, see figure),
(2) adaptation/response (t1, t2), and
(3) restoration of consistent system states and data (t3–t5).
To avoid cascading effects (propagation), the highest possible transient stability must be achieved.
A transiently stable state is understood as a consistent state of
elementary system functions (core functionality) that is maintained until
a steady state (above the curve) can be reached again.
Figure: System Resilience (own illustration)
In modern software architecture, system resilience (ISO/IEC 9837:2026) is not understood as “the absence of errors”,
but rather as the ability of a system to maintain its elementary system functions (core functionality) under particular stress or in the event of system malfunctions
(Hollnagel, E., 2011).
This is supported by:
(1) the avoidance of error states,
(2) the response to fault conditions and the maintenance of elementary system functions, and
(3) the restoration of the steady state (target state).
The target state is considered a stationary state in which the system has the required performance (Above the Curve).
Source: Hollnagel, E. (2011) „Resilience Engineering in Practice: A Guidebook“
Resilience engineering
An expanded scope of tasks in software engineering
Resilience engineering is a relatively new discipline that expands the spectrum by focusing on resilience against
random (unmotivated) and provoked (motivated) influences that can potentially lead to system failure
(“drift into failure”).
A fundamental observation that underlies resilience engineering is that complex systems are dynamic and therefore unstable.
An unstable state can “evolve” or appear “unexpectedly”.
describes in „Programs, life cycles, and laws of software evolution“ how
productive software systems are subject to constant pressure to change and become increasingly complex and
difficult to manage unless measures are taken to reduce this.
The principle remains as relevant today as ever. Especially under changing conditions,
such as the increasing networking of previously isolated and predominantly internal organizational infrastructures,
the field of resilience engineering is in ever-greater demand.
This is particularly true for information systems that process sensitive operational, manufacturing, or research data,
as systems with high coupling and low transparency are especially susceptible to cascading errors and propagation effects.
Source: Lehman, M. M. (1980) „Programs, life cycles, and laws of software evolution“