Subscribe
Share
Share
Embed
As cars become smarter and more connected, the demand for top-tier automotive cyber security has never been higher. With expert insights from PlaxidityX, a leading automotive cyber security company, we’ll guide you through the challenges and solutions protecting millions of vehicles worldwide. Whether you’re an industry expert or just curious about how cars are secured in the digital age, this podcast comprehensively looks at how cyber defenses are developed, tested, and deployed.
We don’t just talk about the technology; we talk about what it means for you—the driver, the manufacturer, the tech enthusiast. We explore how automotive cyber security solutions are applied in real-world scenarios to safeguard everything from onboard infotainment systems to critical vehicle control units.
Tune in to gain a deeper understanding of how manufacturers are staying one step ahead of hackers and ensuring a more secure, connected world.
Welcome to cars, hackers and cybersecurity.
Here we break down the latest in automotive cybersecurity,
helping you stay ahead in building secure connected vehicles.
Hi. Today we'll explore how stride based Terra Automation streamlines automotive cybersecurity, offering a more consistent and efficient way to manage risks.
Every living creature on Earth naturally practices risk management and various life situations to intelligently make decisions affecting it. In our human world, risk management is embedded in different industries. For instance, in the food industry, we aim to prevent food borne diseases. In finance, investors aim to make decisions in the face of uncertainty. In the health industry, we prioritize patient safety.
And in construction, it's important to protect the environment. Each industry follows its own regulations and processes for managing risk. It's crystal clear the automotive industry must consider the risks of operating a vehicle on the road. In this industry, there are a variety of risk management processes, including safety, risk management, supply chain risk management, quality risk management, and operational risk management.
In recent years, a new type of risk management is emerging. Cybersecurity risk management. In response to growing concerns about automotive cybersecurity, regulatory bodies and industry groups began developing standards and guidelines. The ISO S80 21 434 international Standard, titled Road Vehicles Cybersecurity Engineering, was released in 2021 and provides a framework for ensuring cybersecurity throughout the lifecycle of a vehicle.
Additionally, there is U.N. regulation number
155 on cybersecurity and cybersecurity management systems, which entered into force on January 22nd,
This regulation was developed by the United Nations Economic Commission for Europe, or Unesco, as part of its World Forum for Harmonization of Vehicle Regulations 1.29 under 155 aims to ensure that automotive manufacturers implement effective cybersecurity measures throughout the vehicle lifecycle.
00:02:16:06 - 00:02:32:03
The regulation requires manufacturers to establish a cybersecurity management system or automotive CMS, and to assess and mitigate cybersecurity risks to protect vehicles from cyber threats. The EU and additional countries in Asia, such as Japan and South Korea
have adopted this regulation. It means every new type of vehicle in these regions needs to be compliant with UNR. 155. Starting from July 2024.
All new vehicles being produced must comply with it. It's important to understand two key concepts threat and risk. A threat is a potential violation of something valuable. While a risk is a threat with likelihood and probability. Threat analysis and risk assessment,
Also known as Tara.
is the process of identifying threats that could potentially manifest in real risks and making decisions about those risks.
Risk can be accepted reduced by implementing mitigations avoided by addressing the root cause, or transferred to another party to whom the risk belongs. The global Nist's Cybersecurity Framework, published by the U.S. National Institute of Standards and Technology, provides common language and best practices for managing cybersecurity risks in an organization in five zones. Identify, protect, detect, respond, and recover back to automotive cybersecurity.
Risk management. The performance of threat analysis and risk assessment
Tara.
is referenced in various requirements within the Cybersecurity Regulation
Une c 29 UNR 155
The implementation framework for TAA is outlined in the
ISO 21 434 colon 2021
standard. However, these documents do not prescribe a specific method for threat analysis,
Providing flexibility for organizations conducting. Tara.
to choose a methodology based on their skills and capabilities.
ISO. SAP
21 434 colon
2021 standard does mention different threat modeling approaches, including Evita, Pasta, and stride as examples for methods that can be used. Organizations which intersect with automotive cybersecurity concerns may choose to follow both
ISO.
MCE 21 for 34 standard and Neste cybersecurity framework at Plex Cityty ECS are threat analysis best practices based on a threat model called Stride, which was first developed by Microsoft engineers and is utilized for threat modeling and cybersecurity.
It categorizes threats into six categories spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
Why use stride? If we gather several cyber security architects in one room and ask them to analyze threats to a target system, there is a high probability that each of them will analyze different threats, and some may even miss certain threats. As an organization, we aim to establish a common ground for our threat analysis process and ensure it provides comprehensive and accurate coverage.
Using stride addresses these needs by offering completeness and predictability, which is why it is widely adopted in the field. Likewise, Stride is a good fit for organizations of all sizes, either small ones with limited budget and resources. It's a simple framework, and it's easy to train experts to implement it.
Why automate Tara?
On one hand,
Tara is a cyber security process that may sometimes need human judgment.
or creativity that cannot be replicated by machines, especially when it comes to risk treatment decisions and recommendation for implementations of security controls.
Besides, let's not forget the ongoing maintenance tasks of automated systems. On the other hand, in the automotive industry, Tara tends to change periodically during the product development lifecycle based on triggers such as change requests or discovery of new cybersecurity vulnerabilities or incidents. Therefore, we would like to leverage expertise and have a systematic way of performing Tara by automating the whole process.
In particular, if you are a very experienced company with a lot of knowledge in this process,
The automation can yield high quality results.
Why automate Tara using stride?
As mentioned above, using an automated process combined with a simple threat modeling approach like stride is a safe way of achieving quality results in valuable time. It also provides consistency and accuracy by reducing human errors or poor quality identified threats.
Additionally, the results of such a tool are very clear. Making the process of handling the risks and considering security requirements for development and countermeasures easier.
Placidity threat analysis and risk assessment automation tool.
The Plaxidity Tara Automation Tool, a product called Security Auto Designer, part of Plaxidity DevSecOps platform,
provides a security solution from scratch based on the stride threat modeling for vehicle architectures, systems, and components. This solution is compliant
With ISO USA 21 434:2021. The tool is designed to facilitate easy modifications based on various triggers, and can be adjusted to accommodate specific organizational skills.
Furthermore, Security Auto Designer is designed to consider annex five of
UNECE 29.
R155 Threat Catalog in the threat analysis process. The tool is using AI capabilities to automatically generate and consolidate all the analysis data into one report.
This data comes from Plaxidity’s
Threat Catalog database, which was built by Plaxidity experts.
It is based on extensive experience over many years in delivering TARA projects to OEMs and tier-one.
Tier two suppliers.
Holistic view of Plaxidity products based on the V model.
To conclude, in various industries like automotive risk management, especially in cybersecurity, is crucial. Emerging standards like
ISO SAE 21434 and UNR 155
are shaping the approach. While methodologies like Stride offer a systematic way, as exemplified by Plaxidity's TARA automation tool, ensuring comprehensive threat analysis and risk assessment for vehicle cybersecurity.
That's all for today's episode. Keep your engines running smooth and your cyber defenses sharp.
Stay connected by subscribing and visiting Plaxidity.com.
Until next time, stay safe on the road and in the cloud.