What's in the ISO/SAE 21434 ?

As the DIS of the ISO21434 is finally available. This is a collection of the insights and discussions we had while reading it.

What's this about?

If you are unsure about what ISO21434 is and which role it plays for you, we’ve written an overview so that you can get onboard:

Relevance of ISO21434

Work Products

The DIS of ISO21434 distinguishes the three kinds of product phases concept phase, development phase, and operation phase. The general endeavor of performing a TARA is described in chapter 8. The concept phase, as described in chapter 9, consists of defining the item (9.3 Item Definition), finding Cybersecurity Goals (section 9.4) and bundling them into a whole Cybersecurity Concept (section 9.5). The major part of identifying Cybersecurity Goals is to invoke the TARA that is described in chapter 8.

The main steps when performing an ISO21434-conform TARA are (in order of an idealized linear execution):

  • Item Definition (section 9.3)
  • Asset Identification (section 8.3)
  • Threat Scenario Identification (section 8.4)
  • Impact Rating (section 8.5)
  • Attack Path Analysis (section 8.6)
  • Attack Feasability Rating (section 8.7)
  • Risk Determination (section 8.8)
  • Risk Treatment Decision (section 8.9)
  • Cybersecurity Goals [RQ-09-07]
  • Cybersecurity Claims [RQ-09-08]
  • Cybersecurity Concept (section 9.5)
Dependencies of TARA according to ISO21434 are visible

Insights

How to deal with new vulnerabilities according to ISO21434?

An organization that adheres to the DIS of ISO21434 is supposed to continuously monitor cybersecurity information from external and internal sources [RQ-07-01]. It will then decide when to trigger a cybersecurity event, which starts a vulnerability analysis that will eventually initiate according risk treatments. For example…

How does ISO21434 relate to ISO31000?

ISO21434 requires ISO31000 to be fulfilled (Source: Requirement RQ-05-10 in Clause 5). Their use of vocabulary is naturally compatible, with minor differences on the two terms risk and stakeholder. First, ISO31000 includes positive consequences in a “Risk”, which ISO21434 does not. Second, ISO31000 has a quite inclusive definition of “stakeholder”, which the ISO21434 limits to those that may take damage…

How are risks determined according to ISO 21434?

Clause 8.8 of the DIS of ISO21434 determines the risk level value based on impact ratings (IRs) and attack feasibility ratings (AFRs). The IR results from combining the IRs from each described damage scenario (result of Clause 8.5). Each damage scenario was derived from an identified asset (in Clause 8.3). The AFR stems from combining the identified attack paths (8.6) for each threat scenario (8.4)…

What are Security Goals according to ISO21434?

Cybersecurity goals are security requirements that are identified in the concept phase of a product. Each goal is associated with one or more Threat Scenarios. They are part of the security concept that is supposed to be implemented in the development phases. Security goals are created based on the risks that have been decided to be reduced. The risks and their treatment decisions (such as reduction) are the major outcome of the TARA. The role…

Where are the Controls in ISO21434?

The DIS of the ISO21434 considers controls as artifacts that are yielded in the development-phase of a product. In the concept-phase, they are rather called Cybersecurity Goals, which don’t describe the concrete implementation yet. Later when digested they will turn into Cybersecurity Requirements. That’s why…

Let’s Discuss