Abstract:As threat vectors and adversarial capabilities evolve, Cloud-Assisted Connected and Autonomous Vehicles (CCAVs) are becoming more vulnerable to cyberattacks. Several established threat analysis and risk assessment (TARA) methodologies are publicly available to address the evolving threat landscape. However, these methodologies inadequately capture the threat data of CCAVs, resulting in poorly defined threat boundaries or the reduced efficacy of the TARA. This is due to multiple factors, including complex hardware–software interactions, rapid technological advancements, outdated security frameworks, heterogeneous standards and protocols, and human errors in CCAV systems. To address these factors, this study begins by systematically evaluating TARA methods and applying the Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privileges (STRIDE) threat model and Damage, Reproducibility, Exploitability, Affected Users, and Discoverability (DREAD) risk assessment to target system architectures. This study identifies vulnerabilities, quantifies risks, and methodically examines defined data processing components. In addition, this study offers an attack tree to delineate attack vectors and provides a novel defense taxonomy against identified risks. This article demonstrates the efficacy of the TARA in systematically capturing compromised security requirements, threats, limits, and associated risks with greater precision. By doing so, we further discuss the challenges in protecting hardware–software assets against multi-staged attacks due to emerging vulnerabilities. As a result, this research informs advanced threat analyses and risk management strategies for enhanced security engineering of cyberphysical CCAV systems.

Quantitative Evaluation and Analysis of On-board Network Components Risk Rate Based on AFC-TARA

Stochastic Stability Analysis of Networked Control Systems with Random Cryptographic Protection under Random Zero-Measurement Attacks

Network Security Risk Assessment Framework Based on Tactical Correlation

Technical Research on Computer Network Security Automatic Evaluation

Quantitative Risk Assessment of Threats on SCADA Systems Using Attack Countermeasure Tree

Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

Quantitative Risk Assessment Approach for Host Software System Based on Network Scanning

Research On Technology For It System Security Assessment Based On Markov Chain

A Quantitative Method for Evaluating Network Security Based on Attack Graph.

A markov game theory-based risk assessment model for network information system

Quantitative Hierarchical Threat Evaluation Model for Network Security

A Quantitative Risk Assessment Approach for Host System Security

RFID system security assessment methodology based on attack graph model

A Novel Threat and Risk Assessment Mechanism for Security Controls in Service Management

An Attack-And-Defence Game for Security Assessment in Vehicular Ad Hoc Networks

A New Method of Network Risk Assessment Based on Bayesian Model

Information Security Architecture Design for Cyber-Physical Integration System of Air Traffic Management

Extended Abstract: Access Graph Based Risk Analysis for Network Information System

Network Threat Assessment Based on Alert Verification

Securing Cloud-Assisted Connected and Autonomous Vehicles: An In-Depth Threat Analysis and Risk Assessment

A Stochastic Model for Quantitative Security Analyses of Networked Systems.