Skip to main content

Automotive Cyber Security

UN R 155 and the country specific cybersecurity regulation(s) provides an high – level overview on the cybersecurity threats concerning the approval of vehicles with regards to cyber security and cyber security management system.

ISO 21434: Road vehicles – Cybersecurity Engineering a frame work that provides cybersecurity requirements, process and methods to engineer cybersecurity in the electrical and electronic (E/E) systems of road vehicles.

Cybersecurity Management

As first and foremost, the organization has to commit and ensure the following points in order to develop and maintain ‘secured state’ of a product

  • Cybersecurity policy and rules
  • Cybersecurity awareness and culture
  • Objective defined Cybersecurity Process and Management systems 
  • Cybersecurity assessment 
  • Vulnerability Management and Incident response process 
  • Update Management System 

Project Cybersecurity Management

Every project needs cybersecurity. Cybersecurity Management of project needs go through the following phases to ensure the execution of cybersecurity within the project

  • Cybersecurity pre-analysis and agreements
  • Cybersecurity Planning
  • Cybersecurity case
  • Post-development measures (SOP – EOP)
  • Vulnerability Management

Engineering Cybersecurity

As we know cybersecurity is neither a plug in nor an additional feature but a necessary feature to be built into system for which cybersecurity engineering needs to be considered from the early stages of development. 

  • Item definition – Cybersecurity
  • Threat Analysis and Risk Assessment
  • Cybersecurity goals and requirements
  • Cybersecurity concept
  • Cybersecurity specification
  • Cybersecurity implementation
  • Cybersecurity testing
  • Cybersecurity validation

Cybersecurity – Risk assessment

Threat Analysis and Risk Assessment (TARA) is an extensive cybersecurity risk analysis method to analyze, identify and prevent the probable risk of electrical and electronic (E/E) systems of road vehicles due to the possible cybersecurity threats. TARA includes the following steps, 

  • Asset Identification using Cybersecurity properties
  • Damage scenario derivation and impact rating
  • Identification of cybersecurity threats in relation to the cybersecurity properties
  • Elicitation of attack tress for identified cybersecurity threats
  • Evaluation and Attack feasibility rating
  • Determination of risk value
  • Determination of risk treatment

ARK facilitates tailored creation and development of ISO 21434 cybersecurity engineering work products in alignment with the existing product development process.