Visible to the public Attack Surface Assessment for Cybersecurity Engineering in the Automotive Domain

TitleAttack Surface Assessment for Cybersecurity Engineering in the Automotive Domain
Publication TypeConference Paper
Year of Publication2021
AuthorsPlappert, Christian, Zelle, Daniel, Gadacz, Henry, Rieke, Roland, Scheuermann, Dirk, Krauß, Christoph
Conference Name2021 29th Euromicro International Conference on Parallel, Distributed and Network-Based Processing (PDP)
Date Publishedmar
Keywordsattack feasibility rating, attack surface, automobiles, Automotive engineering, automotive security, autoSAR, computer security, connected car, cybersecurity engineering, ISO 15118, ISO/SAE 21434, Metrics, pubcrawl, Resiliency, risk analysis, risk management, road vehicles, Scalability, Surface treatment, threat analysis and risk assessment (TARA), threat mitigation and resilience
AbstractConnected smart cars enable new attacks that may have serious consequences. Thus, the development of new cars must follow a cybersecurity engineering process as defined for example in ISO/SAE 21434. A central part of such a process is the threat and risk assessment including an attack feasibility rating. In this paper, we present an attack surface assessment with focus on the attack feasibility rating compliant to ISO/SAE 21434. We introduce a reference architecture with assets constituting the attack surface, the attack feasibility rating for these assets, and the application of this rating on typical use cases. The attack feasibility rating assigns attacks and assets to an evaluation of the attacker dimensions such as the required knowledge and the feasibility of attacks derived from it. Our application of sample use cases shows how this rating can be used to assess the feasibility of an entire attack path. The attack feasibility rating can be used as a building block in a threat and risk assessment according to ISO/SAE 21434.
Citation Keyplappert_attack_2021