What's technically inside the ISO/SAE 21434 ?

As the DIS of the ISO21434 is finally available. This is a collection of the insights and discussions we had while reading it. Read now inside the ISO/SAE 21434.

What's this about?

If you are unsure about what ISO21434 is and which role it plays for you, we’ve written an overview so that you can get onboard:

Relevance of ISO21434

Work Products

The DIS of ISO21434 distinguishes the three kinds of product phases concept phase, development phase, and operation phase. The general endeavor of performing a TARA is described in chapter 8. The concept phase, as described in chapter 9, consists of defining the item (9.3 Item Definition), finding Cybersecurity Goals (section 9.4) and bundling them into a whole Cybersecurity Concept (section 9.5). The major part of identifying Cybersecurity Goals is to invoke the TARA that is described in chapter 8.

The main steps when performing an ISO21434-conform TARA are (in order of an idealized linear execution):

  • Item Definition (section 9.3)
  • Asset Identification (section 8.3)
  • Threat Scenario Identification (section 8.4)
  • Impact Rating (section 8.5)
  • Attack Path Analysis (section 8.6)
  • Attack Feasability Rating (section 8.7)
  • Risk Determination (section 8.8)
  • Risk Treatment Decision (section 8.9)
  • Cybersecurity Goals [RQ-09-07]
  • Cybersecurity Claims [RQ-09-08]
  • Cybersecurity Concept (section 9.5)
Dependencies of TARA according to ISO21434 are visible

Insights

As this place is a living document, we are continuously adding the questions and discussions that arise. Here you go with some of them.

How to deal with new vulnerabilities according to ISO21434?

An organization that adheres to the DIS of ISO21434 is supposed to continuously monitor cybersecurity information from external and internal sources [RQ-07-01]. It will then decide whether or not to trigger a cybersecurity event, which starts a vulnerability analysis that will eventually initiate according risk treatments. For example…

How does ISO21434 relate to ISO31000?

ISO21434 requires ISO31000 to be fulfilled (Source: Requirement RQ-05-10 in Clause 5). Their use of vocabulary is naturally compatible, with minor differences on the two terms risk and stakeholder. First, ISO31000 includes positive consequences in a “Risk”, which ISO21434 does not. Second, ISO31000 has a quite inclusive definition of “stakeholder”, which the ISO21434 limits to those that may take damage…

How are risks determined according to ISO 21434?

Clause 8.8 of the DIS of ISO21434 determines the risk level value based on impact ratings (IRs) and attack feasibility ratings (AFRs). The IR results from combining the IRs from each described damage scenario (result of Clause 8.5). Each damage scenario was derived from an identified asset (in Clause 8.3). The AFR stems from combining the identified attack paths (8.6) for each threat scenario (8.4)…

How could such process look like?

We’ve been giving a couple of presentations on how we interpret the ISO/SAE 21434 to be practically carried out.

Here is an 8min video on the Yakindu Security Analyst (we might be biased, as we’re developing it).

Here is a more detailed walk through the ISO/SAE 21434 Annex G example, first as in the ISO, then with tool support (1h44min):

Let’s Discuss