Towards a security‐driven automotive development lifecycle

Abstract

Cybersecurity has become one of the most crucial challenges in the automotive development lifecycle. The upcoming ISO/SAE 21434 standard provides only a generic framework that is insufficient to derive concrete design methods. This article proposes an actionable cybersecurity development lifecycle model that provides concrete action and work product guidance aligned with the ISO/SAE 21434 and Automotive SPICE® extension for cybersecurity. The model has been inspired by action research in “next” industry practice pilot projects, which ensures that it is actionable. It has been augmented by insights gained from literature research in cybersecurity development for embedded systems. The proposed lifecycle model complements the ISO/SAE 21434 standard and provides the basis for the company‐specific process and practice specifications. It has been validated through the integration of cybersecurity‐related aspects in an electric power steering system. A core characteristic of the model is the central role of threat modeling, vulnerability analyses, and cybersecurity requirements derivation on both system and subsystem levels. Without concrete practice guidelines, the ISO/SAE 21434 is very difficult to understand and apply at this stage. This contribution aims to fill this gap through a model inspired by cutting‐edge embedded cybersecurity practices interpreted for the current and near‐future automotive electronic architectures.

The evolution of embedded systems in automotive industry: A global review

“…With the increasing connectivity and autonomy in vehicles, the attack surface is expanding, leading to a higher risk of security attacks (Sommer et al, 2019). This necessitates a security-driven automotive development lifecycle to address these crucial challenges (Dobaj et al, 2021). Additionally, there is a need for an architectural approach to integrate safety and security requirements in smart products and systems design (Ezeigweneme, et al, 2024;Riel et al, 2018).…”

Experiences with the automotive SPICE for cybersecurity assessment model and tools

“…25 And users expect a high level of safety [26][27][28][29] and security. [30][31][32][33][34][35][36][37] More functions are added constantly and the level of autonomous drive [38][39][40][41][42] is increasing. Such vehicles need connectivity and software updates and show vulnerabilities toward attackers.…”

“…Cybersecurity in automotive has become a major issue because modern cars have gateways, vehicle to infrastructure communication, WLAN communication, busses, domain controllers, a large number of electronic control units, and millions lines of software 25 . And users expect a high level of safety 26–29 and security 30–37 . More functions are added constantly and the level of autonomous drive 38–42 is increasing.…”

A Method for Deriving Technical Requirements of Digital Twins as Industrial Product-Service System Enablers

“…Depending on the industrial sector and the specific use cases, it is necessary to consider domain-specific standards and engineering processes in the CPS design phase to ensure, e.g., system safety and security [11,12]. In addition, fundamental factors like cost, performance, and dependability, as well as other system properties such as usability, manageability, and adaptability, influence technical system design.…”