TARA+AD: Threat Analysis and Risk Assessment for Automated Driving : cybersecurity of road vehicles - Loskin, Ilona (2023)
Cybersecurity of road vehicles has become a genuine matter as vehicles are not manufactured anymore as plain mechanical devices but containing numerous amounts of computers and millions of lines of code. The intelligent and safety-critical vehicular systems are prone to cyberattacks just like any other information system. It is evident that the vehicles need to be protected. A joint global working group prepared a new, international standard to cover the cybersecurity engineering in the automotive industry. The standard is called ISO/SAE JWG 21434 Road vehicles - Cybersecurity engineering. The new cybersecurity engineering standard defines the minimum criteria for cybersecurity of road vehicles which is also a demand by the United Nations Economic Commission for Europe (UNECE). The cybersecurity engineering standard gives requirements and recommendations what a security risk analysis of road vehicles should contain. The standard does not provide instructions how to perform the analysis. This research study targeted to find a threat analysis and risk assessment method which covers the requirements and recommendations of the cybersecurity engineering standard. Such singular method did not exist, thus a new analysis framework named TARA+AD (Threat Analysis and Risk Assessment for Automated Driving) was derived from the best features of two existing security risk analysis methods. The research method used was design science which aims to produce an artifact to resolve real-life problems. The artifact, TARA+AD, and the study was evaluated by using a Design Science Research Method (DSRM) process model. The new framework was tested by executing a use case related to vehicular communication which is the easiest interface to be attacked. The results were satisfactory as the new TARA+AD analysis framework solved the issue with performing a cybersecurity engineering standard compliant security risk analysis.