Abstract:Security Assurance Cases (SAC) are structured bodies of arguments and evidence used to reason about security properties of a certain artefact. SAC are gaining focus in the automotive domain as the need for security assurance is growing due to software becoming a main part of vehicles. Market demands for new services and products in the domain require connectivity, and hence, raise security concerns. Regulators and standardisation bodies started recently to require a structured for security assurance of products in the automotive domain, and automotive companies started, hence, to study ways to create and maintain these cases, as well as adopting them in their current way of working. In order to facilitate the adoption of SAC in the automotive domain, we created CASCADE, an approach for creating SAC which have integrated quality assurance and are compliant with the requirements of ISO/SAE-21434, the upcoming cybersecurity standard for automotive systems. CASCADE was created by conducting design science research study in two iterative cycles. The design decisions of CASCADE are based on insights from a qualitative research study which includes a workshop, a survey, and one-to-one interviews, done in collaboration with our industrial partners about the needs and drivers of work in SAC in industry, and a systematic literature review in which we identified gaps between the industrial needs and the state of the art. The evaluation of CASCADE was done with help of security experts from a large automotive OEM. It showed that CASCADE is suitable for integration in industrial product development processes. Additionally, our results show that the elements of CASCADE align well with respect to the way of working at the company, and has the potential to scale to cover the requirements and needs of the company with its large organization and complex products

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is: as the importance of software in automotive systems is increasing day by day, how to ensure and prove the safety of automotive products. Specifically, the paper focuses on how to create and apply Security Assurance Cases (SAC) to meet the strict requirements of the automotive industry for product safety. ### Decomposition of the Main Problem 1. **External Driving Factors**: - **Mandatory Requirements of Regulations and Standards**: In recent years, regulatory agencies and standardization organizations have begun to require the automotive industry to provide structured safety assurance methods. In particular, the ISO/SAE - 21434 standard clearly stipulates that SAC needs to be created to prove cybersecurity compliance. - **Market Demand**: The market's demand for new services and functions (such as mobile phone connection, navigation services, etc.) has prompted automobile manufacturers to improve the connectivity of vehicles, thus triggering higher requirements for safety. 2. **Internal Requirements**: - **Internal Security Requirements of the Company**: Automobile companies are aware of the strategic significance of developing SAC, which can not only meet regulatory requirements but also improve their own cybersecurity development processes. - **Lifecycle Management**: SAC needs to cover the entire product lifecycle and involve multiple roles and departments, so specific requirements in different scenarios need to be considered. 3. **Gap between Existing Research and Practice**: - **Lack of Quality Assurance**: Most of the existing SAC creation methods do not take into account the actual industrial requirements, especially lacking in quality assurance. - **Unbalanced Coverage**: The SAC creation methods proposed in the literature have unbalanced coverage in different aspects and cannot fully meet the needs of the industry. ### Solutions To solve the above - mentioned problems, the author proposes the CASCADE method, which is an asset - driven SAC creation method integrated with quality assurance. The main features of CASCADE include: - **Compliance with ISO/SAE - 21434 Standard**: Ensure that the created SAC meets the requirements of the upcoming standard. - **Integrated Quality Assurance**: Incorporate a quality assurance mechanism in SAC to ensure its effectiveness and reliability in industrial applications. - **Adaptation to Industrial Requirements**: Through cooperation with industrial partners, ensure that CASCADE can meet the actual industrial requirements and can be smoothly integrated into the existing work processes. ### Research Objectives The main objective of this research is to help automotive industry practitioners make product release decisions using SAC, especially providing support in terms of safety. Specifically, the research aims to: - **Understand the Specific Requirements of SAC in the Automotive Industry**. - **Understand the Current Research Status of SAC in Existing Literature**. - **Create and Evaluate an SAC Creation Method Suitable for the Needs of the Automotive Industry**. Through these efforts, the author hopes to provide the automotive industry with a practical and effective tool to cope with the increasingly complex cybersecurity challenges.

Towards Understanding and Applying Security Assurance Cases for Automotive Systems

Evaluating the Role of Security Assurance Cases in Agile Medical Device Development

Security Assurance Cases -- State of the Art of an Emerging Approach

Security Assurance Cases for Road Vehicles: an Industry Perspective

How do practitioners perceive assurance cases in safety-critical software systems?

Cybersecurity Threat Analysis, Risk Assessment and Design Patterns for Automotive Networked Embedded Systems: A Case Study

RESOLUTION OF SAFETY RELEVANT SECURITY THREATS IN THE SYSTEM ARCHITECTURE DESIGN PHASE ON THE EXAMPLE OF AUTOMOTIVE INDUSTRY

Security Risk Analysis Methodologies for Automotive Systems

ACCESS: Assurance Case Centric Engineering of Safety-critical Systems

A Systematic Approach to Automotive Security

Managing Security Evidence in Safety-Critical Organizations

I came, I saw, I certified: some perspectives on the safety assurance of cyber-physical systems

A Methodology for Automating Assurance Case Generation

A Formal Model to Facilitate Security Testing in Modern Automotive Systems

Security Engineering for ISO 21434

A Framework for Cybersecurity Requirements Management in the Automotive Domain

Guidance on the Safety Assurance of Autonomous Systems in Complex Environments (SACE)

Automating Semantic Analysis of System Assurance Cases using Goal-directed ASP

Leveraging Traceability to Integrate Safety Analysis Artifacts into the Software Development Process

Cybersecurity Framework for Connected and Automated Vehicles: A Modeling Perspective