Overview - Cybersecurity Engineering (ISO/SAE 21434:2021)

This lecture traces the history of ISO 21434, from a 2016 technical committee formation to the 2021 introduction of the first cybersecurity standard for road vehicles.

Define cyber security per ISO/SAE 21434:2021 as safeguarding assets against threat scenarios that could lead to damage, and clarify assets, threat scenarios, and risk reduction.

Define risk as a blend of probability and damage, detailing exposure and controllability, and describe cybersecurity risk via impact and attack feasibility under ISO standards.

Calculate the current risk from attack feasibility and scenario impact, then apply measures to reach an acceptable residual risk, with ISO 2143 four introducing the cyber security assurance level.

Understand the four-level cyber security assurance level used in the concept phase to map threat scenarios to cyber security goals and guide development, verification, and risk reduction.

Explore legal aspects of ISO 21434 cybersecurity standards, differentiating mandatory and optional parts, and learn how state of the art and release dates affect product liability and burden of proof.

Outline the ISO 21434 structure for organizational and project cybersecurity management, covering chapters five to fifteen, life-cycle activities, and risk and threat analysis guiding development and validation.

Explore cybersecurity governance under ISO 21434, detailing policy, rules, processes, responsibilities, and resources, and how executive commitment drives organizational risk management and cross-discipline information exchange.

Explore cybersecurity culture as a company objective and quality attribute, prioritizing it as a top priority, fostering proactive cross-disciplinary collaboration, awareness across departments, guidelines, and continuous improvement to avoid modifications.

Define access rules for information across internal and external parties, implement approvals for exchanges, and synchronize document status to ensure consistent information security in distributed development.

Explore how management systems support cybersecurity engineering by implementing change, documentation, configuration, and requirements management within ISO 9001 and IATF 16949.

Ensure tool management prevents cybersecurity impact in development and production, including model-based tools like Matlab and Simulink, with access control and evidence of safe usage.

Understand information security management within an information security management system. Implement access controls and change-tracking to prevent unauthorized changes, document change descriptions and change requests, and support cyber security audits.

Explore how to determine independence levels for organizational cybersecurity audits under ISO 21434, map ISO 2626 two work products to cybersecurity deliverables, and apply confirmation measures.

Define project level cybersecurity governance and roles; appoint a cybersecurity manager to plan, coordinate, and track activities, ensure qualified personnel and training, and escalate deviations.

Assess whether a product is cyber security relevant using criteria for safe operation, data processing, or networked functions, then create and govern cyber security plan with responsibilities, resources, and timelines.

Tailoring customizes cybersecurity activities for a specific item or component to fit its use cases, with a mandatory, reviewed rationale and distribution across parties in a cyber security agreement.

Define reuse candidates from project pools or platforms and assess modifications for the target environment. Check interfaces, adapt as needed, reevaluate assumptions, and ensure ISO 21434 cybersecurity coverage and documentation.

Explain how a component out of context is developed under ISO 2143 four, with defined external interfaces and validated assumptions to support cybersecurity requirements during integration.

Assess off-the-shelf components against cyber security requirements and external interface compatibility, ensure suitability for the application context, and document plans for integration under ISO/SAE 21434:2021.

Develop the cybersecurity case in accordance with the cybersecurity plan, map outputs and work products to each standard requirement, and coordinate an overall argument across customers and suppliers.

Explore how to trigger and conduct a risk-based cybersecurity assessment per ISO 21434, including documentation in the cybersecurity case, evidence in work products, and the assessment report with acceptance decisions.

Ensure post-development release proceeds only after required conditions are fulfilled, supported by a cyber security case and assessment evidence that ISO 21434 objectives are achieved and post-development requirements are accepted.

Identify and assess supplier capability to perform post development cybersecurity activities according to ISO 21434, request evidence from audits and assessment results, and align responsibilities across customer and suppliers.

Learn to craft a request for quotation that selects a capable supplier, requires evidence of conformity to the cyber security standard, and outlines cyber security responsibilities, goals, and requirements.

Define and allocate cybersecurity activities through a signed Cybersecurity Interface Agreement between customer and supplier, detailing contacts, responsibilities, milestones, and shared work products across lifecycle phases.

Identify sources of cyber security information to enable monitoring. Use triggers to triage information and determine if it becomes a cybersecurity event, guiding event evaluation, vulnerability analysis, and vulnerability management.

Perform cyber security event evaluation with triage of security information to identify weaknesses, and update threat scenarios defined during Tara based on information, impacting other security activities and product development.

Identify whether weaknesses qualify as vulnerabilities by evaluating item definitions and component cybersecurity specifications, and analyze architecture, attack paths, feasibility ratings within threat analysis and risk assessment.

Learn vulnerability management through risk assessment and two options: treatment to reduce risk and remediation, including patches for open source software, with change management triggers and continual cyber security management.

Explore how ISO 21434 follows the V-model, linking chapter nine concept to product development and cyber security validation, from concept and threat analysis to subcomponent design and bottom-up verification.

Define the item boundary and internal and external interfaces to separate the item from its operational environment, enabling threat analysis and risk assessment with a headlamp system example.

Identify assets and perform threat analysis and risk assessment to define cybersecurity goals and risk treatment options under ISO/SAE 21434:2021, and outline threat scenarios and attack paths.

Cover the cybersecurity concept by detailing technical and operational controls, detection and monitoring of a compromise, mapping requirements to goals, and verifying completeness with Doors or Polarion.

Define cybersecurity specifications in the design phase from the cybersecurity concept and requirements, allocate them to components, and verify work products while identifying weaknesses early to reduce post development costs.

Derive integration and verification from cybersecurity specifications to ensure adequate test coverage, minimize vulnerabilities, and map assurance levels to verification independence using methods like requirements analysis and boundary value testing.

Explore cybersecurity validation as the final validation step in the V-model, deriving activities from item definitions, goals, claims, and concept, with a formal rationale and independence levels.

Begin the production phase after cyber security validation and implement a production control plan detailing the sequence of steps, tools, and cybersecurity controls, with ISO 2143 compliance evidence.