Towards Understanding and Applying Security Assurance Cases for Automotive Systems
Licentiatavhandling, 2021

Security Assurance Cases (SAC) are structured bodies of arguments and evidence used to reason about security properties of a certain artefact.
SAC are gaining focus in the automotive domain as the need for security assurance is growing due to software becoming a main part of vehicles. Market demands for new services and products in the domain require connectivity, and hence, raise security concerns. Regulators and standardisation bodies started recently to require a structured for security assurance of products in the automotive domain, and automotive companies started, hence, to study ways to create and maintain these cases, as well as adopting them in their current way of working.
In order to facilitate the adoption of SAC in the automotive domain, we created CASCADE, an approach for creating SAC which have integrated quality assurance and are compliant with the requirements of ISO/SAE-21434, the upcoming cybersecurity standard for automotive systems.
CASCADE was created by conducting design science research study in two iterative cycles. The design decisions of CASCADE are based on insights from a qualitative research study which includes a workshop, a survey, and one-to-one interviews, done in collaboration with our industrial partners about the needs and drivers of work in SAC in industry, and a systematic literature review in which we identified gaps between the industrial needs and the state of the art.
The evaluation of CASCADE was done with help of security experts from a large automotive OEM. It showed that CASCADE is suitable for integration in industrial product development processes. Additionally, our results show that the elements of CASCADE align well with respect to the way of working at the company, and has the potential to scale to cover the requirements and needs of the company with its large organization and complex products.

security claims

assurance case





automotive systems

Room 473, Jupiter, Lindholmen
Opponent: Martin Gilje Jaatun


Mazen Mohamad

Göteborgs universitet

Security Assurance Cases – State of the Art of an Emerging Approach

Empirical Software Engineering,; Vol. 26(2021)

Artikel i vetenskaplig tidskrift

Asset-driven Security Assurance Cases with Built-in Quality Assurance

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS 2021),; (2021)p. 29-36

Paper i proceeding

Assurance Cases for Road Vehicles: an Industry Perspective

ARES '20: Proceedings of the 15th International Conference on Availability, Reliability and Security,; (2020)

Paper i proceeding

CASUS: Konstruktion av IT-säkerhetsunderlag för öppna fordonssystem




Datavetenskap (datalogi)




Room 473, Jupiter, Lindholmen


Opponent: Martin Gilje Jaatun

Mer information

Senast uppdaterat