What's technically inside the ISO/SAE 21434 ?

As the DIS of the ISO21434 is finally available. This is a collection of the insights and discussions we had while reading it. Read now inside the ISO/SAE 21434.

What's this about?

If you are unsure about what ISO21434 is and which role it plays for you, we’ve written an overview so that you can get onboard:

Relevance of ISO21434

Work Products

The DIS of ISO21434 distinguishes the three kinds of product phases concept phase, development phase, and operation phase. The general endeavor of performing a TARA is described in chapter 8. The concept phase, as described in chapter 9, consists of defining the item (9.3 Item Definition), finding Cybersecurity Goals (section 9.4) and bundling them into a whole Cybersecurity Concept (section 9.5). The major part of identifying Cybersecurity Goals is to invoke the TARA that is described in chapter 8.

The main steps when performing an ISO21434-conform TARA are (in order of an idealized linear execution):

  • Item Definition (section 9.3)
  • Asset Identification (section 8.3)
  • Threat Scenario Identification (section 8.4)
  • Impact Rating (section 8.5)
  • Attack Path Analysis (section 8.6)
  • Attack Feasability Rating (section 8.7)
  • Risk Determination (section 8.8)
  • Risk Treatment Decision (section 8.9)
  • Cybersecurity Goals [RQ-09-07]
  • Cybersecurity Claims [RQ-09-08]
  • Cybersecurity Concept (section 9.5)
Dependencies of TARA according to ISO21434 are visible

Insights

As this place is a living document, we are continuously adding the questions and discussions that arise. Here you go with some of them.

What are Security Goals according to ISO21434?

Cybersecurity goals are security requirements that are identified in the concept phase of a product. Each goal is associated with one or more Threat Scenarios. They are part of the security concept that is supposed to be implemented in the development phases. Security goals are created based on the risks that have been decided to be reduced. The risks and their treatment decisions (such as reduction) are the major outcome of the TARA. The role…

Where are the Controls in ISO21434?

The DIS of the ISO21434 considers controls as artifacts that are yielded in the development-phase of a product. In the concept-phase, they are rather called Cybersecurity Goals, which don’t describe the concrete implementation yet. Later when digested they will turn into Cybersecurity Requirements. That’s why…

How could such process look like?

We’ve been giving a couple of presentations on how we interpret the ISO/SAE 21434 to be practically carried out.

Here is an 8min video on the Yakindu Security Analyst (we might be biased, as we’re developing it).

Here is a more detailed walk through the ISO/SAE 21434 Annex G example, first as in the ISO, then with tool support (1h44min):

Let’s Discuss