A Proposal of Security Requirements Definition Methodology in Connected Car Systems by CVSS V3

Abstract

The use of connected cars has been spreading recently. Security for connected cars is very important because an attacker can access connected cars remotely. Security requirements defined based on risk assessment are necessary to protect connected cars from attackers. However, the conventional risk assessment technique mostly depends on the evaluator's security knowledge. Therefore, we propose a security requirement definition methodology for connected car systems. The proposed methodology is based on the security requirements definition methodology in IoT (Internet of Things) systems, which consists of four processes: modelization of target system, definition of security problems, consideration of security requirements, and decision of security function components. We applied the methodology in IoT systems to connected car systems. In particular, the risk assessment, which is executed to define security problems, uses CVSS v3 which was released in 2015. We can assess the risk of connected car systems objectively by using the base metrics of CVSS v3.