In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a maximum number of failures per hour of operation. It is generally of a very small magnitude for the most critical components of a system, i.e., 10^-9 failures per hour of operation at most.
As there is a trend towards inter-connected safety-critical systems, there are higher risks that such systems become the target of remote attackers. In this context, remote attackers can eventually control the system remotely (e.g., CarShark attack or Jeep Cherokee remote control). Therefore, there are cyber-attacks that can impact the safety of the system (i.e., endanger the environment of the system).
Therefore, more and more works are dedicated to integrate security and safety such that the addition of security countermeasures inside a system can increase the system overall safety. In existing works, to the best of my knowledge, nobody takes into account the fact that security mechanisms can fail, just as any other components.
My question to you guys is the following: do you have any information about what could be the consequences of a security countermeasure failure on a component or system safety? Is it possible for example that, if an encryption mechanism fails, it flips a bit in a message which could provoke (eventually) a DoS (or anything else), that could lead to a catastrophic event (again, think of it as a worst case)? Is there any discussion/document about this?