The increasing use of software and connectivity in modern vehicles has made cybersecurity an important issue in the automotive industry. ISO 21434 is a standard for automotive cybersecurity engineering that provides guidelines for the development and validation of secure automotive systems. For effective implementation and practical use of ISO 21434, it must be incorporated into existing automotive industry development workflows.
In this paper, we investigate the practical applicability of ISO 21434 in the context of the Security Abstraction Model (SAM), a security modeling approach for the domain-specific modeling language EAST-ADL, and provide insights into the benefits and consequences of this approach. In doing so, we describe the methodological opportunities of integrating ISO 21434 into SAM on the one hand and present a case study illustrating the application of this integrated approach in the development of a secure automotive system on the other hand. Our results suggest that the integration of ISO 21434 into SAM better supports automotive system security in the early development phases and makes it transparent to a wide range of stakeholders. At the same time, it becomes clear that a representation of the interrelationships in the form of a metamodel, in contrast to ISO 21434 in which these are only described textually, significantly improves conceptual understanding and ultimately enables pragmatic usability in industrial development.
Highly connected with the environment via various interfaces, cars have been the focus of malicious cyber attacks for years. These attacks are becoming an increasing burden for a society with growing vehicle autonomization: they are the sword of Damocles of future mobility. Therefore, research is particularly active in the area of vehicle IT security, and in part also in the area of dependability, in order to develop effective countermeasures and to maintain a minimum of one step ahead of hackers. This paper examines the known state-of-the-art security and dependability measures based on a detailed and systematic analysis of published cyber attacks on automotive software systems. The sobering result of the analysis of the cyber attacks with the model-based technique SAM (Security Abstraction Model) and a categorization of the examined attacks in relation to the known security and dependability measures is that most countermeasures against cyber attacks are hardly effective. They either are not applicable to the underlying problem or take effect too late; the intruder has already gained access to a substantial part of the vehicle when the countermeasures apply. The paper is thus contributing to an understanding of the gaps that exist today in the area of vehicle security and dependability and concludes concrete research challenges.