Towards Understanding and Applying Security Assurance Cases for Automotive Systems
SAC are gaining focus in the automotive domain as the need for security assurance is growing due to software becoming a main part of vehicles. Market demands for new services and products in the domain require connectivity, and hence, raise security concerns. Regulators and standardisation bodies started recently to require a structured for security assurance of products in the automotive domain, and automotive companies started, hence, to study ways to create and maintain these cases, as well as adopting them in their current way of working.
In order to facilitate the adoption of SAC in the automotive domain, we created CASCADE, an approach for creating SAC which have integrated quality assurance and are compliant with the requirements of ISO/SAE-21434, the upcoming cybersecurity standard for automotive systems.
CASCADE was created by conducting design science research study in two iterative cycles. The design decisions of CASCADE are based on insights from a qualitative research study which includes a workshop, a survey, and one-to-one interviews, done in collaboration with our industrial partners about the needs and drivers of work in SAC in industry, and a systematic literature review in which we identified gaps between the industrial needs and the state of the art.
The evaluation of CASCADE was done with help of security experts from a large automotive OEM. It showed that CASCADE is suitable for integration in industrial product development processes. Additionally, our results show that the elements of CASCADE align well with respect to the way of working at the company, and has the potential to scale to cover the requirements and needs of the company with its large organization and complex products.
Security Assurance Cases – State of the Art of an Emerging Approach
Empirical Software Engineering,; Vol. 26(2021)
Artikel i vetenskaplig tidskrift
Asset-driven Security Assurance Cases with Built-in Quality Assurance
2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS 2021),; (2021)p. 29-36
Paper i proceeding
Assurance Cases for Road Vehicles: an Industry Perspective
ARES '20: Proceedings of the 15th International Conference on Availability, Reliability and Security,; (2020)
Paper i proceeding
CASUS: Konstruktion av IT-säkerhetsunderlag för öppna fordonssystem
VINNOVA, -- .
Room 473, Jupiter, Lindholmen
Opponent: Martin Gilje Jaatun