What's in the ISO/SAE 21434 ?
As the DIS of the ISO21434 is finally available. This is a collection of the insights and discussions we had while reading it.
The DIS of ISO21434 distinguishes the three kinds of product phases concept phase, development phase, and operation phase. The general endeavor of performing a TARA is described in chapter 8. The concept phase, as described in chapter 9, consists of defining the item (9.3 Item Definition), finding Cybersecurity Goals (section 9.4) and bundling them into a whole Cybersecurity Concept (section 9.5). The major part of identifying Cybersecurity Goals is to invoke the TARA that is described in chapter 8.
The main steps when performing an ISO21434-conform TARA are (in order of an idealized linear execution):
- Item Definition (section 9.3)
- Asset Identification (section 8.3)
- Threat Scenario Identification (section 8.4)
- Impact Rating (section 8.5)
- Attack Path Analysis (section 8.6)
- Attack Feasability Rating (section 8.7)
- Risk Determination (section 8.8)
- Risk Treatment Decision (section 8.9)
- Cybersecurity Goals [RQ-09-07]
- Cybersecurity Claims [RQ-09-08]
- Cybersecurity Concept (section 9.5)
As this place is a living document, we are continuously adding the questions and discussions that arise. Here you go with some of them.
The GENIVI Alliance is holding a technical summit on a virtual base on May 12-14, 2020. On the 14. at 10:45 CEDT, we’ll be showing a presentation on how to run ISO21434-conformant projects in practice. If you are curious in learning about 21434, you should come around.
In Clause 8.3, the DIS of ISO21434 allows to enumerate the relevant assets with a variety of methods. As examples, it suggests to enumare them by their impact rating, or threat scenarios, or even using predefined catalogues. Learn more.
An organization that adheres to the DIS of ISO21434 is supposed to continuously monitor cybersecurity information from external and internal sources [RQ-07-01]. It will then decide whether or not to trigger a cybersecurity event, which starts a vulnerability analysis that will eventually initiate according risk treatments. For example…
ISO21434 requires ISO31000 to be fulfilled (Source: Requirement RQ-05-10 in Clause 5). Their use of vocabulary is naturally compatible, with minor differences on the two terms risk and stakeholder. First, ISO31000 includes positive consequences in a “Risk”, which ISO21434 does not. Second, ISO31000 has a quite inclusive definition of “stakeholder”, which the ISO21434 limits to those that may take damage…
Clause 8.8 of the DIS of ISO21434 determines the risk level value based on impact ratings (IRs) and attack feasibility ratings (AFRs). The IR results from combining the IRs from each described damage scenario (result of Clause 8.5). Each damage scenario was derived from an identified asset (in Clause 8.3). The AFR stems from combining the identified attack paths (8.6) for each threat scenario (8.4)…
Cybersecurity goals are security requirements that are identified in the concept phase of a product. Each goal is associated with one or more Threat Scenarios. They are part of the security concept that is supposed to be implemented in the development phases. Security goals are created based on the risks that have been decided to be reduced. The risks and their treatment decisions (such as reduction) are the major outcome of the TARA. The role…
The DIS of the ISO21434 considers controls as artifacts that are yielded in the development-phase of a product. In the concept-phase, they are rather called Cybersecurity Goals, which don’t describe the concrete implementation yet. Later when digested they will turn into Cybersecurity Requirements. That’s why…
How could such process look like?
We’ve been giving a couple of presentations on how we interpret the ISO/SAE 21434 to be practically carried out.
Here is an 8min video on the Yakindu Security Analyst (we might be biased, as we’re developing it).
Here is a more detailed walk through the ISO/SAE 21434 Annex G example, first as in the ISO, then with tool support (1h44min):