Complete Guide To TARA for ISO 21434 Automotive Security

In this section we will introduce the "item" as a system or subsystem in TARA. The item definition involves creating a data-centric system model. Practical advice includes defining trust boundaries, application entry points, and user roles with clear representations of trust levels.

In this section on asset definition, we will explain what is an asset according to the standard. What are the Relevant properties. The protection of these properties is essential for ISO 21434.

In this section on damage scenarios, We will discuss the identification of damage scenarios based on compromised properties and their impact. ISO 21434 defines four types of damage each with four diffent impact levels. The road user is prioritized as the main stakeholder. we will also provide practical advice on using functional analysis and asset-based analysis for damage scenario identification and when too use each. We will conclude this section with an exercise, applying impact ratings to a scenario involving compromised security property. The overall impact level is determined.

In this section, we will discuss threat identification and introduce the STRIDE methodology. Threats are defined as circumstances with the potential to cause damage. We will also explain how each element of STRIDE relates to potential threats and provides practical examples using a hypothetical scenario. We will explore the use of UN 155 Annex 6 as another source for threat identification.

In the Attack Path Identification section, we will discuss the process of identfy the attack paths. Each threat scenario can be realized by one or more attack paths using a practical example. Security engineers play a crucial role in ensuring comprehensive consideration of all possible attack paths and staying updated on new attack techniques. The Mitre Corporation's attack framework is recommended as a valuable source for tracing potential attack paths, covering all phases of attacks from reconnaissance to data exfiltration.

In this section, the speaker introduces the concept of Feasibility Rating in the context of ISO 21434. The objective of Feasibility Rating is to understand how feasible each attack path is, categorizing them into four levels: high, medium, low, and very low. ISO 21434 offers three general methods for Feasibility Rating: Vector-based, CBSS-based, and Attack Potential-based.

Pros and cons of each method are discussed.

Finally, the most feasible attack path determines the overall feasibility of the threat scenario.

In this section, we discuss risk and risk rating, bringing together the previous sections' work. Two methods for calculating risk in ISO 21434 are introduced: the risk matrix and the risk formula.

After determining risks, the next step is risk treatment, with four options provided by ISO 21434:

Risk Elimination.

Risk Mitigation.

Risk Sharing.

Risk Acceptance.

ISO 21434 allows choosing any of these options without requiring justification, except for justifying any accepted risks.
Security engineers play a crucial role by providing expertise on effective security controls, insights to reduce impact, and understanding attack path analysis for identifying common points to impact multiple risks.

After performing the risk assessment, the following activities are crucial in the cybersecurity process:

1. Identification of Risks:

   • Risks identified.

2. Cybersecurity Goals:

   • Risks inform the cybersecurity goals.

3. Cybersecurity Requirements:

   • The organization defines cybersecurity requirements based on the cybersecurity goals.

4. Security Controls:

   • Cybersecurity requirements are materialized through security controls.

5. Verification:

   • Ensures correct and complete implementation of security controls.

6. Validation:

   • Assess whether cybersecurity goals are sufficiently protected by security controls.

7. Cybersecurity Case Creation:

   • Develops an argument about the cybersecurity of the item.

Final Remarks:

• Tara (Risk Assessment) enables systematic risk identification, minimizing biases.

• Considers both impact and feasibility of risks.

• Guides the identification of risks based on the organization's risk appetite.

• Drives the solicitation of specific security requirements directly related to identified risks.

• Acts as input for creating the cybersecurity case, supporting arguments for the cybersecurity of the design.