Building an automotive security assurance case using systematic security evaluations

Madeline Cheah; Siraj Shaikh; Jeremy Bryans; Paul Wooderson

doi:10.1016/j.cose.2018.04.008

Building an automotive security assurance case using systematic security evaluations

Madeline Cheah, Siraj Shaikh, Jeremy Bryans, Paul Wooderson

HORIBA MIRA Ltd.

Research output: Contribution to journal › Article › peer-review

37 Citations (Scopus)

1009 Downloads (Pure)

Abstract

Security testing and assurance in the automotive domain is challenging. This is predominantly due to the increase in the amount of software and the number of connective entry points in the modern vehicle. In this paper we build on earlier work by using a systematic security evaluation to enumerate undesirable behaviours, enabling the assignment of severity ratings in a (semi-) automated manner. We demonstrate this in two case studies; firstly with the native Bluetooth connection in an automotive head unit, and secondly with an aftermarket diagnostics device. We envisage that the resulting severity classifications would add weight to a security assurance case, both as evidence and as guidance for future test cases.

Original language	English
Pages (from-to)	360-379
Number of pages	20
Journal	Computers and Security
Volume	77
Early online date	13 Apr 2018
DOIs	https://doi.org/10.1016/j.cose.2018.04.008
Publication status	Published - Aug 2018

Bibliographical note

NOTICE: this is the author’s version of a work that was accepted for publication in Computers and Security. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Computers and Security. Vol 77,(2018), DOI: 10.1016/j.cose.2018.04.008

© 2017, Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International http://creativecommons.org/licenses/by-nc-nd/4.0/

Keywords

Automotive
Bluetooth
Cybersecurity
Security assurance
Penetration testing

Access to Document

10.1016/j.cose.2018.04.008

Post-PrintAccepted author manuscript, 1.16 MBLicence: CC BY-NC-ND

Jeremy Bryans
- Centre for Future Transport and Cities - Assistant Professor Research
Person: Teaching and Research

Cite this

@article{449115c49fbe49618b785b4bce5105fe,

title = "Building an automotive security assurance case using systematic security evaluations",

abstract = "Security testing and assurance in the automotive domain is challenging. This is predominantly due to the increase in the amount of software and the number of connective entry points in the modern vehicle. In this paper we build on earlier work by using a systematic security evaluation to enumerate undesirable behaviours, enabling the assignment of severity ratings in a (semi-) automated manner. We demonstrate this in two case studies; firstly with the native Bluetooth connection in an automotive head unit, and secondly with an aftermarket diagnostics device. We envisage that the resulting severity classifications would add weight to a security assurance case, both as evidence and as guidance for future test cases.",

keywords = "Automotive, Bluetooth, Cybersecurity, Security assurance, Penetration testing",

author = "Madeline Cheah and Siraj Shaikh and Jeremy Bryans and Paul Wooderson",

note = "NOTICE: this is the author{\textquoteright}s version of a work that was accepted for publication in Computers and Security. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Computers and Security. Vol 77,(2018), DOI: 10.1016/j.cose.2018.04.008 {\textcopyright} 2017, Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International http://creativecommons.org/licenses/by-nc-nd/4.0/ ",

year = "2018",

month = aug,

doi = "10.1016/j.cose.2018.04.008",

language = "English",

volume = "77",

pages = "360--379",

journal = "Computers and Security",

issn = "0167-4048",

publisher = "Elsevier",

}

TY - JOUR

T1 - Building an automotive security assurance case using systematic security evaluations

AU - Cheah, Madeline

AU - Shaikh, Siraj

AU - Bryans, Jeremy

AU - Wooderson, Paul

N1 - NOTICE: this is the author’s version of a work that was accepted for publication in Computers and Security. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Computers and Security. Vol 77,(2018), DOI: 10.1016/j.cose.2018.04.008 © 2017, Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International http://creativecommons.org/licenses/by-nc-nd/4.0/

PY - 2018/8

Y1 - 2018/8

N2 - Security testing and assurance in the automotive domain is challenging. This is predominantly due to the increase in the amount of software and the number of connective entry points in the modern vehicle. In this paper we build on earlier work by using a systematic security evaluation to enumerate undesirable behaviours, enabling the assignment of severity ratings in a (semi-) automated manner. We demonstrate this in two case studies; firstly with the native Bluetooth connection in an automotive head unit, and secondly with an aftermarket diagnostics device. We envisage that the resulting severity classifications would add weight to a security assurance case, both as evidence and as guidance for future test cases.

AB - Security testing and assurance in the automotive domain is challenging. This is predominantly due to the increase in the amount of software and the number of connective entry points in the modern vehicle. In this paper we build on earlier work by using a systematic security evaluation to enumerate undesirable behaviours, enabling the assignment of severity ratings in a (semi-) automated manner. We demonstrate this in two case studies; firstly with the native Bluetooth connection in an automotive head unit, and secondly with an aftermarket diagnostics device. We envisage that the resulting severity classifications would add weight to a security assurance case, both as evidence and as guidance for future test cases.

KW - Automotive

KW - Bluetooth

KW - Cybersecurity

KW - Security assurance

KW - Penetration testing

U2 - 10.1016/j.cose.2018.04.008

DO - 10.1016/j.cose.2018.04.008

M3 - Article

SN - 0167-4048

VL - 77

SP - 360

EP - 379

JO - Computers and Security

JF - Computers and Security

ER -

Building an automotive security assurance case using systematic security evaluations

Abstract

Bibliographical note

Keywords

Access to Document

Fingerprint

Profiles

Jeremy Bryans

Cite this