Showcasing standards and approaches for cybersecurity, safety, and privacy issues in connected and autonomous vehicles

TL;DR

This paper reviews and consolidates current standards and approaches for risk assessment and threat modeling in connected and autonomous vehicles to improve cybersecurity, safety, and privacy.

Contribution

It provides a comprehensive overview of recent standards and approaches in RA and TM for CAVs, aiding practitioners in aligning stakeholder expectations.

Findings

Highlights latest standards and approaches in RA and TM for CAVs.

Provides a list of approaches to guide threat analysis focus.

Aims to improve stakeholder alignment and safety in automotive cybersecurity.

Abstract

In the automotive industry there is a need to handle broad quality deficiencies, eg, performance, maintainability, cybersecurity, safety, and privacy, to mention a few. The idea is to prevent these issues from reaching end-users, ie, road users and inadvertently, pedestrians, aiming to potentially reduce accidents, and allow safe operation in dynamic attack surfaces, for the benefit of a host of stakeholders. This paper aims to bridge cybersecurity, safety, and privacy concerns in Connected and Autonomous Vehicles (CAV) with respect to Risk Assessment (RA) and Threat Modelling (TM) altogether. Practitioners know the vast literature on this topic given the sheer number of recommendations, standards, best practices, and existing approaches, at times impairing projects and fostering valuable and actionable threat analysis. In this paper we collate key outcomes by highlighting latest standards and approaches in RA and TM research to tackle complex attack surfaces as the ones posed by automotive settings. We aim to provide the community with a list of approaches to align expectations with stakeholders when deciding where and when to focus threat related analysis in automotive solutions.