ISO/SAE 21434 Road Vehicles Cybersecurity Engineering and TARA

ISO/SAE 21434 establishes mandatory lifecycle requirements for managing automotive cyber risks from concept to decommissioning. Threat Analysis and Risk Assessment (TARA) systematically catalogs assets, identifies STRIDE attack vectors, calculates attack feasibility ratings (based on elapsed time, expertise, and equipment), and derives Cybersecurity Goals.

Calculating Attack Feasibility Using Elapsed Time and Expertise

In ISO/SAE 21434, attack feasibility is scored across five parameters: Elapsed Time, Specialist Expertise, Knowledge of the Item, Window of Opportunity, and Equipment. An attack requiring over six months of reverse-engineering by multiple PhD cryptographers with a two-million-dollar focused ion beam (FIB) microscope scores as 'Very Low' feasibility. Conversely, an attack exploitable in five minutes over public Wi-Fi using open-source tools scores as 'High', dictating immediate hardware redesign.

Asset Identification: Pinpointing crown-jewel ECUs, cryptographic keys, and brake actuator control loops.
STRIDE Modeling: Enumerating Spoofing, Tampering, Repudiation, Information Disclosure, DoS, and Elevation of Privilege.
Attack Feasibility Metrics: Quantifying elapsed time, specialist expertise, equipment cost, and window of opportunity.
Cybersecurity Assurance Levels (CAL): Establishing rigorous engineering verification depth from CAL 1 to CAL 4.

Explore Domain Portfolio