2020 2021 2021 eng 2502 2509 8 conferenceobject Research Publishing Services Singapore 1 -- -- -- Security cannot be implemented into a system retrospectively without considerable effort, so security must be taken into consideration already at the beginning of the system development. The engineering of automotive software is by no means an exception to this rule. For addressing automotive security, the AUTOSAR and EAST-ADL standards for domain-specific system and component modeling provide the central foundation as a start. The EASTADL extension SAM enables fully integrated security modeling for traditional feature-targeted attacks. Due to the COVID-19 pandemic, the number of cyber-attacks has increased tremendously and of these, about 98 percent are based on social engineering attacks. These social engineering attacks exploit vulnerabilities in human behaviors, rather than vulnerabilities in a system, to inflict damage. And these social engineering attacks also play a relevant but nonetheless regularly neglected role for automotive software. The contribution of this paper is a novel modeling concept for social engineering attacks and their criticality assessment integrated into a general automotive software security modeling approach. This makes it possible to relate social engineering exploits with feature-related attacks. To elevate the practical usage, we implemented an integration of this concept into the established, domain-specific modeling tool MetaEdit+. The tool support enables collaboration between stakeholders, calculates vulnerability scores, and enables the specification of security objectives and measures to eliminate vulnerabilities. Proceedings of the 31st European Safety and Reliability Conference (ESREL 2021) Modeling Human-targeted Attacks with SAM 10.3850/978-981-18-2016-8_720-cd true {"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2022,4,2]],"date-time":"2022-04-02T14:08:49Z","timestamp":1648908529822},"publisher-location":"Singapore","reference-count":0,"publisher":"Research Publishing Services","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.3850\/978-981-18-2016-8_720-cd","type":"proceedings-article","created":{"date-parts":[[2021,9,27]],"date-time":"2021-09-27T19:07:07Z","timestamp":1632769627000},"source":"Crossref","is-referenced-by-count":0,"title":["Social Engineering Exploits in Automotive Software Security: Modeling Human-targeted Attacks with SAM"],"prefix":"10.3850","author":[{"given":"Matthias","family":"Bergler","sequence":"first","affiliation":[]},{"given":"Juha-Pekka","family":"Tolvanen","sequence":"additional","affiliation":[]},{"given":"Markus","family":"Zoppelt","sequence":"additional","affiliation":[]},{"given":"Ramin Tavakoli","family":"Kolagari","sequence":"additional","affiliation":[]}],"member":"2215","event":{"name":"Proceedings of the 31st European Safety and Reliability Conference","acronym":"ESREL","number":"31","start":{"date-parts":[[2021,9,19]]},"end":{"date-parts":[[2021,9,23]]}},"container-title":["Proceedings of the 31st European Safety and Reliability Conference (ESREL 2021)"],"original-title":[],"deposited":{"date-parts":[[2021,9,27]],"date-time":"2021-09-27T19:10:03Z","timestamp":1632769803000},"score":1,"resource":{"primary":{"URL":"https:\/\/rpsonline.com.sg\/proceedings\/9789811820168\/html\/720.xml"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":0,"URL":"http:\/\/dx.doi.org\/10.3850\/978-981-18-2016-8_720-cd","relation":{},"subject":[],"published":{"date-parts":[[2021]]}}} proceedings-article crossref PersonAuthorFirstName_1,PersonAuthorLastName_1,PersonAuthorFirstName_2,PersonAuthorLastName_2,PersonAuthorFirstName_3,PersonAuthorLastName_3,PersonAuthorFirstName_4,PersonAuthorLastName_4,Enrichmentconference_title,PublisherName,PublisherPlace,TitleMain_1,TitleParent_1,CompletedYear Proceedings of the 31st European Safety and Reliability Conference Begutachtet/Reviewed doi-import false false Matthias Bergler Juha-Pekka Tolvanen Markus Zoppelt Ramin Tavakoli Kolagari eng uncontrolled automotive systems, social engineering attacks, design, model-based development, modeling, security Fakultät Informatik Digitalisierung & Künstliche Intelligenz