²ÝÁñÉçÇø

The ISO/SAE 21434 Road Vehicles¡ªCybersecurity Engineering standard defines the responsibilities for various groups during different stages of automotive product development. The standard requires a commitment from executive management to product development with a focus on cybersecurity engineering. It standardizes the roles and responsibilities between vendors or suppliers and the next entity in supply chains, creating standard terminology across the industry.  The standard defines phases in the product lifecycle with crisp objectives and outcomes from each stage that feeds into subsequent stages. ISO/SAE 21434 describes Threat Analysis and Risk Assessment (TARA) to assess the cybersecurity risks in the product. 

ISO/SAE 21434 stresses the importance of executive management¡¯s commitment to cybersecurity by providing specific guidelines for those responsibilities. The standard goes further by requiring the creation of a cybersecurity policy which enforces cybersecurity rules and processes. The policy then defines cybersecurity roles and identifies who would enforce these roles and processes while providing the necessary resources to enact the policy. There are specific work products defined in the standard that document the policy, roles and resources.

To maintain each products¡¯ cybersecurity assurance, automotive suppliers typically form a dedicated cybersecurity assurance team. Such independent team, which is independent from the product development teams, ensures sufficient scrutiny is exercised and the product commitments including timelines do not compromise the cybersecurity due diligence. The cybersecurity assurance team provides the technology-specific tools required for cybersecurity engineering.  As shown in Figure 1, the independent team has the responsibility to create and maintain:

Cybersecurity policies                                         Cybersecurity competence in the design teams

Cybersecurity processes and procedures       Cybersecurity assurance in the products

Cybersecurity awarenes                                     Cybersecurity assessment of the products

As previously mentioned, ISO/SAE 21434 defines Threat Analysis and Risk Assessment (TARA) to assess the cybersecurity risks in the product. Cybersecurity risk assessment and management requires a thorough investigation of product to identify the possible risks the product can inherently possess Appropriate mitigations should be applied to ensure the risks are not exploited by a malicious entity. The severity of cybersecurity risk can be determined by four factors. As shown in Figure 2, the four factors that aid in determining the risk score are threat scenario, impact of the threat on the product, attack path, and the feasibility of executing the attack to score the risk.  The risk score is used to make an informed decision about how the risk needs to be treated.

The ISO/SAE 21434 Road Vehicles¡ªCybersecurity Engineering standard is a critical resource for development of latest generation of automotive SoCs. Due to the expanded number of attacks on connected car in ADAS/HAD and V2X/Infotainment technologies such as Bluetooth/BLE, WiFi, cellular including 5G, GPS, USB and in car networks such as CAN, MIPI and automotive Ethernet, a holistic  cybersecurity engineering is required. Cybersecurity impacts every level of the automotive supply chain starting with semiconductor SoCs. During development of complex SoCs, partnering with an IP supplier with a structured ISO/SAE 21434 development platform minimizes cybersecurity risks and ensures highest levels of success. ²ÝÁñÉçÇø is developing IP products as per the ISO/SAE 21434 standard.