# A Framework for Measuring the Costs of Security at Runtime

## TL;DR

This paper introduces a Security Cost Modelling Framework to evaluate the runtime costs of security measures in IoT-based Cyber-Physical Systems within Industry 4.0, addressing a gap in existing evaluation methodologies.

## Contribution

It proposes a novel framework for measuring security costs at runtime and details its components and experimental application in IoT environments.

## Key findings

- Framework effectively models security costs in IoT systems
- Experimental design demonstrates practical application at runtime
- Provides a basis for comparing security strategies

## Abstract

In Industry 4.0, Cyber-Physical Systems (CPS) are formed by components, which are interconnected with each other over the Internet of Things (IoT). The resulting capabilities of sensing and affecting the physical world offer a vast range of opportunities, yet, at the same time pose new security challenges. To address these challenges there are various IoT Frameworks, which offer solutions for managing and controlling IoT-components and their interactions. In this regard, providing security for an interaction usually requires performing additional security-related tasks (e.g. authorisation, encryption, etc.) to prevent possible security risks. Research currently focuses more on designing and developing these frameworks and does not satisfactorily provide methodologies for evaluating the resulting costs of providing security. In this paper we propose an initial approach for measuring the resulting costs of providing security for interacting IoT-components by using a Security Cost Modelling Framework. Furthermore, we describe the necessary building blocks of the framework and provide an experimental design showing how it could be used to measure security costs at runtime.