Proposing HEAVENS 2.0 – an automotive risk assessment model

Abstract

Risk-based security models have seen a steady rise in popularity over the last decades, and several security risk assessment models have been proposed for the automotive industry. The new UN vehicle regulation 155 on cybersecurity provisions for vehicle type approval, as part of the 1958 agreement on vehicle harmonization, mandates the use of risk assessment to mitigate cybersecurity risks and is expected to be adopted into national laws in 54 countries within 1 to 3 years. This new legislation will also apply to autonomous vehicles. The automotive cybersecurity engineering standard ISO/SAE 21434 is seen as a way to fulfill the new UN legislation, so we can expect quick and wide industry adoption. One risk assessment model that has gained some popularity and is in active use in several companies is the HEAVENS model, but since ISO/SAE 21434 introduces additional requirements on the risk assessment process, the original HEAVENS model does not fulfill the standard.In this paper, we investigate the gap between the HEAVENS risk assessment model and ISO/SAE 21434, and we identify and propose 12 model updates to HEAVENS to close this gap. We also discuss identified weaknesses of the HEAVENS risk assessment model and propose 5 additional model updates to overcome them. In accordance with these 17 identified model updates, we propose HEAVENS 2.0, a new risk assessment model based on HEAVENS which is fully compliant with ISO/SAE 21434. CCS CONCEPTS• Computer systems organization → Embedded and cyberphysical systems; Dependable and fault-tolerant systems and networks; • Security and privacy → Security requirements; Systems security; Embedded systems security.

An Integrated Approach of Threat Analysis for Autonomous Vehicles Perception System

“…Threat models for the previous generation of the automotive industry are targeted for automotive E/E architecture, which are either adapted from IT and software industry (e.g., Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege (STRIDE) [34], confidentiality, integrity, and availability (CIA) [35] threat, vulnerability and risk assessment (TVRA) [36], E-safety vehicle intrusion protected applications (EVITA) [37], and healing vulnerabilities to enhance software security and safety (HEAVENS)) [24] or heavily influenced by safety analysis models such as fault tree analysis, Hazard Analysis and Risk Assessment (e.g., security-aware hazard analysis and risk assessment (SAHARA)) [38]. In 2021, the ISO/SAE 21434 standard was published for Road Vehicles-Cybersecurity Engineering, which included EVITA, HEAV-ENS, and TVRA in recommendations for automotive threat modeling.…”

“…In 2021, ISO/SAE 21434 standard was published that provides a threat analysis and risk assessment (TARA) guideline for E/E systems within road vehicles [23]. Most of these threat modeling approaches have the foundation of IT-based threat models with some modifications relevant to E/E systems [24]. However, an ADS has a different kind of operating environment and requires a stricter real-time response to changes in that environment than devices in an IT environment.…”

Threat Assessment and Risk Analysis (TARA) for Interoperable Medical Devices in the Operating Room Inspired by the Automotive Industry

“…The extension HEAVENS 2.0 is improved according to gaps that could be identified when comparing HEAVENS 1.0 to the requirements of ISO/SAE 21434. It includes an attack path analysis and risk treatment decisions with the result of identifying cybersecurity goals, and claims to be compliant with the regulation [ 13 ]. HEAVENS 1.0 and 2.0, as mentioned in [ 13 ], have the potential to be used in industries with similar characteristics, such as the medical device industry, with some slight modifications.…”

“…Besides the SAE J3061 Cybersecurity guidebook, the ISO/SAE 21434 regulation defines an automotive-specific cybersecurity engineering standard concerning the whole vehicle life cycle [ 65 ]. A key aspect of the standard is the TARA, which is used to identify security risks and threats, with the purpose of developing countermeasures and mitigation strategies [ 13 ].…”

“…Alongside these developments, the importance of security rises constantly. Risks and security attacks have been consistently demonstrated over at least the past 15 years [ 13 ].…”