Streamlining Security Relevance Analysis According to ISO 21434

Abstract

ISO 21434, as the cybersecurity standard for automotive systems, was released not long ago. Nevertheless, the automotive industry needed to adhere to the standard since its draft release due to long development times. Therefore, most automotive companies accomplished the first development cycle according to ISO 21434. The biggest problem still is the efficiency of the cybersecurity process. In order to enable a continuous, traceable, and efficient cybersecurity process, each step needs to be evaluated and integrated into a common framework. As a first step, we analyze ISO 21434s concept of security relevance evaluation (SRE). We evaluate the suggested method of ISO 21434 and extend it to the notion of criticality. The initial criticality rating allows prioritization of the subsequent security process and accomplishment of the assessment requirement in ISO 21434. Additionally, we propose the idea of clustered SREs to raise efficiency.