Automotive Cybersecurity Threat Analysis and Risk Assessment Part 2

Welcome dear Networkseclearners to this new tutorial which is the Part 2 of Threat Analysis and Risk Assessment! I hope you liked part 1 and are looking forward to this part 2. If you haven’t read Automotive Cybersecurity Threat Analysis and Risk Assessment Part 1 yet, I strongly recommend you to read it before continuing. 🤲

As a reminder, in Part 1, we explored the most important concepts about the Threat Analysis and Risk Assessment (TARA) as outlined in the ISO/SAE 21434 standard. We covered the process essential steps involved in identifying and analyzing potential threats to automotive electronic systems and of course in assessing the associated risks.

Now, in Part 2, we’ll transition from theory to practice to provide you with a concrete example of how the TARA process is applied to a real world automotive system. I didn’t want to reuse the HeadLamp System example from the standard and preferred to choose an automtotive electronic system whose functionality speaks to everybody, is very easy to understand and which is critical so that we can easily understand the impact of cybersecurity on it. So, I selected the System called Brake By Wire since braking is common to everybody and is a critical feature of vehicles. Indeed, the Brake By Wire system is an innovative system that replaces traditional hydraulic braking with electronic control and offers enhanced performance and safety but also presents new cybersecurity challenges.

In this tutorial, we will walk through each step of the TARA process, demonstrating how to identify potential threats, assess their impact, and determine the appropriate risk mitigation strategies. But before, I will try to explain the concepts of Brake By Wire system to you.

By the end of this tutorial, you will have a better understanding on how to apply TARA in practice to protect automotive systems from cybersecurity threats, ensuring both safety and compliance with industry standards.

So, let’s get started! 😊

1. what is it Brake By Wire (BBW) System ? 🤔🤔

I am sure you have been looking forward to know what is this brake system we are talking about. Now, it is high time I told what it is. Indeed, Brake by Wire (BBW) System is an advanced braking system in modern cars that uses electronic signals instead of traditional mechanical or hydraulic links to control the brakes. With the BBW, the brakes are now controlled by electronics unlike the traditional hydraulic or mechanical control. In order to illustrate how this system works and the components it is composed of, I made an extremely simplified schematic. I want to insist in the fact that this schematic is extemely simplified and some details were abstracted in order to keep it simple and easy to understand. The main purpose of this schematic is to help you understand how the system operates. if you need to know all the details, I recommend you check these internet ressources :

Are you ready now for my schematic? Ding, ding, here it is 😉😉:

Now, I propose that we walk through all the components and describe them. Let’s start with what we are all familiar which is the Brake Pedal. I hope so :

• Brake Pedal : This is the pedal you press with your foot when you want to slow down or stop the vehicle. In a BBW system, pressing the brake pedal doesn’t directly activate the brakes mechanically. Instead, it will initiate an electronic process.

• Brake Sensors : These sensors are responsible for detecting how much pressure you’re applying to the brake pedal. They measure the force at which you press the pedal. This physical information is converted into electrical signal which is then sent to the Brake By Wire Electronic Control Unit (BBW ECU).

• BBW ECU (Brake By Wire Electronic Control Unit) : This is the central computer and also the brain of the entire system that manages the entire braking process. It receives data from the brake sensors and calculates the exact amount of braking force required at each wheel. After its processing, the ECU sends electronic commands to the actuators controlers telling them how much much to brake. The BBW ECU incorporates redundancy and fault tolerance to ensure safety and reliability.

• Actuator Controllers : These controllers act as the middlemen between the BBW ECU and the actuators. Each wheel has its own controller which takes the instructions from the BBW ECU and tells the actuators how much braking force to apply. This ensures that each wheel brakes properly.

• Actuators : These are the devices that physically apply the brakes to the wheels. Instead of using hydraulic fluid like traditional systems, the actuators in a BBW system operate electronically. They receive signals from the actuator controllers and apply the necessary braking force to slow down or stop the vehicle.

2. Application of TARA on The Brake By Wire System

I know you have been waiting for this part. We will not lose time anymore and will jump into the topic. I would like to recommend you to check again Automotive Cybersecurity Threat Analysis and Risk Assessment Part 1 if you need any information about all steps of the TARA process. Let’s get started with the item definition. 😊

2.1 Item Definition

In this section, in order to illustrate the item boundary and the preliminary architecture, I created a simplified context diagram of the Brake By Wire system. Some details were abstracted for the seek of simplicity. Take it again as a way to manage the complexity in a simple manner. Also, I would like to remind you that I am not an expert of Brake By Wire. If you are an expert of BBW reading this article, please, don’t hesitate to comment to correct eventually some mistakes or propose some improvements.

Here it is 😉 :

The Brake-by-Wire (BBW) system controls the braking of the vehicle based on driver input through the brake pedal. When the driver presses the brake pedal, the BBW system processes this input electronically and determines the appropriate amount of braking force to be applied to each wheel. The system is capable of adjusting the braking force in real-time to maintain vehicle stability and optimize stopping performance. Additionally, the BBW system can integrate with advanced safety features such as Anti-lock Braking System (ABS) and Electronic Stability Control (ESC) to prevent wheel lockup and maintain vehicle control during emergency braking.

The functionality of the Brake-by-Wire system does not depend on the Telematics ECU, Gateway ECU, or other vehicle systems for its core braking functions. However, it does interface with these systems to receive and send information, particularly for diagnostics, vehicle network communication, and certain safety features.

The item (Brake-by-Wire system) is connected with the gateway ECU, and the gateway ECU is connected with the telematics ECU by data communication. The Telematics ECU has external communication interfaces which Bluetooth and Cellular. This allows the vehicle to communicate with the external world.

Gateway ECU has external communication interfaces which are OBD connector and CAN, LIN, and FlexRay bus connections.

2.2 Assets and Damage Scenario Identification

In this section, I decided to combine the Steps 2 and 3 which are respectively Assets Identification and Damage Scenario Identification. In these 2 steps, if you still remember part 1, the goal is to identify all assets for which the compromission of one cybersecurity property can lead to a damage scenario. For the seek of simplicity the CIA triad is used exactly like in the standard. So, we will take here into account only the Confidentiality, Integrity and Availability properties. I invite you if you can to consider all properties from the CIANA Pentagon as homework 😉😉. You will see in below table the result all assets I identified with the properties and associated damage scenario.

For the first Asset data communication (brake command), the asset ID is A1, the cybersecurity properties that can be compromised are Integrity and Availability. As an example, I identified the damage scenarios when the Integrity property is compromised which resulted in :

DS1 : Vehicle fails to stop when the brake pedal is pressed, leading to a collision.

DS2 : Vehicle experiences unintended braking, causing abrupt stops and potential rear-end collisions.

DS1 and DS2 are of course the ID of the Damage scenarios.

2.3 Threat Scenario Identification

In this section, we will focus on Step 4 of the TARA process: Threat Scenario Identification. The purpose of this step is to identify potential ways in which the cybersecurity properties of the identified assets can be compromised, leading to the realization of the associated damage scenarios. For this activity, I used the STRIDE methodology, which is one of the methods proposed by the standard. The threats are categorized into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service (DoS), and Elevation of Privilege.

In the table below, you will find the identified threat scenarios, each corresponding to a specific damage scenario and the related cybersecurity property.

For example, for the asset data communication (brake command), the threat scenario identified is : Spoofing of CAN messages leads to loss of integrity of the brake command signals to the actuators, potentially causing the vehicle not to stop as expected. Therefore, this threat scenario directly impacts the Integrity property of the asset, which could lead to the damage scenarios DS1 and DS2 identified earlier.

2.5 Impact Rating of the Damage Scenario

In this section, we will focus on Step 5 of the TARA process namely the Impact Rating. The objective of this step is to evaluate the severity of the damage scenarios identified in the previous step, considering various impact categories such as Safety, Financial, Operational, and Privacy. By assigning an impact rating to each damage scenario, we can assess how critical the consequences would be if the attack is successfully performed.

The ISO/SAE 21434 standard provides guidance on how to rate these impacts, with the overall impact rating being categorized as Severe, Major, Moderate, or Negligible.

In the table below, we have assessed the impact of each damage scenario for each impact category. For instance, the impact rating for DS1 where the vehicle fails to stop when the brake pedal is pressed, leading to a collision is rated as Severe for Safety, Moderate for Financial, Major for Operational, and Negligible for Privacy with an overall impact rating of Severe.

If you don’t agree with my ratings, please, feel free to share yours in the comment section in order to provide another perspective for our networseclearning community! 🤲

2.6 Attack Path Analysis

In this section, we will focus on Step 6 of the TARA process which is the Attack Path Analysis. The goal of this step is to identify and analyze the different paths an attacker might take to exploit the vulnerabilities. Thanks to this, we can assess how an attacker could progress from the initial compromise to achieving their objectives, such as compromising the integrity of critical automotive systems.

In the table below, we analyze the attack paths for four selected threat scenarios namely TS1, TS5, TS14 and TS15 considering the different routes an attacker might take to achieve their goals. For example, in TS1, an attacker could exploit vulnerabilities in the telematics ECU via cellular network access, allowing him to send spoofed brake command signals through the gateway ECU to the BBW ECU which will lead to brake failure.

Don’t hesitate to propose your attack paths in the comments section! 🤲

2.7 Attack Feasibility Rating

In this section, we will address Step 7 of the TARA process namely the Attack Feasibility Rating. This step involves evaluating how feasible it is for an attacker to exploit the identified attack paths for each threat scenario.

The attack feasibility rating considers various factors such as the time needed to execute the attack, the expertise required, the knowledge of the system, the opportunity window available, and the equipment necessary. The ISO/SAE 21434 standard offers multiple approaches for this assessment, including the attack potential-based approach and the attack vector-based approach that we are going to use.

In the table below, we present the attack feasibility ratings for the selected threat scenarios TS1, TS5, TS14 and TS15 based on the complexity and likelihood of successfully executing the identified attack paths. For instance, in TS1, the high attack feasibility rating reflects the ease with which an attacker could exploit cellular network vulnerabilities to compromise the telematics ECU and cause brake failure.

• Rating using the Attack Vector-Based Approach

• Rating using the Attack Potential-Based Approach

• ET: Elapsed Time
• SE: Specialist Expertise
• KoIC: Knowledge of the Item or Component
• WoO: Window of Opportunity
• Eq: Equipment

2.8 Risk Value Determination

In this section, we will address Step 8 of the TARA process which is the Risk Value Determination. This step involves calculating the overall risk value for each identified threat scenario by combining the impact rating with the attack feasibility rating.

The risk value is typically determined using a risk matrix that links the impact rating (ranging from Negligible to Severe) with the attack feasibility rating (ranging from Very Low to High). The resulting risk value ranges from 1 (minimal risk) to 5 (maximum risk).

The table below shows the risk value determination for the selected threat scenarios. We have used the attack feasibility rating obtained from the attack potential-based approach to ensure a more representative assessment.

• Here is the Risk Matrix Example we are going to use 😉

This matrix can be used to determine the risk value by cross-referencing the impact rating with the attack feasibility rating as done in below table with our selected Threat Scenarios.

• Risk Value Determination for Selected Threat Scenarios

The risk value provides a clear indication of which threats require higher attention and which can be managed with lower-priority measures. This prioritization is crucial for effective cybersecurity risk management, as it ensures that resources are allocated to mitigate the most significant risks first.

In the next section, we will proceed to the final step of the TARA process, which involves determining the appropriate risk treatment decisions based on these risk values.

2.9 Risk Treatment Decision

In this section, we will address finally the last Step 9 of the TARA process which is of course Risk Treatment Decision, youpi!! 😀This step involves selecting the most appropriate risk treatment strategy for each identified threat scenario based on the determined risk values. The goal is to either eliminate the risk, reduce it to an acceptable level, share it with another party, or accept it if the risk is within acceptable limits.

The ISO/SAE 21434 standard outlines four primary risk treatment options:

• Avoiding the Risk : Eliminating the risk entirely by removing the risk source or discontinuing the activity that generates the risk.

• Reducing the Risk : Implementing measures to lower the risk to an acceptable level through controls or design changes.

• Sharing the Risk : Transferring the risk to another party, such as through contracts or insurance.

• Retaining the Risk : Accepting the risk as it is, often when mitigation is impractical or the cost of mitigation exceeds the benefit.

The table below outlines the risk treatment decisions for the selected threat scenarios :

Given the high and medium risk values associated with these threat scenarios, the recommended risk treatment strategy is to reduce the risk by implementing additional cybersecurity controls. These can include enhancing authentication mechanisms, improving system redundancy, or applying stricter access controls to prevent unauthorized actions.

CONCLUSION

Thank you for joining me on this journey through the Threat Analysis and Risk Assessment (TARA) process as applied to the Brake By Wire (BBW) system. I hope you found this practical tutorial informative. I hope by now, you have a solid understanding of how to identify assets, assess threats, evaluate risks, and determine the appropriate risk treatment strategies to protect critical automotive systems. 🤲

Remember, cybersecurity in the automotive industry is about ensuring the safety, security, and trust of everyone who gets behind the wheel. As vehicles become more connected, the importance of robust cybersecurity measures will only continue to grow. 😊

If you found this tutorial helpful, feel free to share it with others who might benefit from it. And if you have any questions, suggestions, or just want to share your thoughts, don’t hesitate to leave a comment. Let’s keep the conversation going and continue learning together within our community of networkseclearners! 😊

Until next time, stay curious and keep exploring the world of automotive cybersecurity! 🚗🔒

References :

1. ISO/SAE 21434:2021 – Road Vehicles Cybersecurity Engineering. This standard outlines the framework for managing cybersecurity risks in the automotive industry, including the TARA process.

2. UNECE WP.29 – World Forum for Harmonization of Vehicle Regulations. This regulation includes cybersecurity requirements under Regulation No. 155, focusing on vehicle type approvals concerning cybersecurity.

3. Brake-by-Wire Systems: Benefits and Challenges – An overview of Brake-by-Wire technology. Available at https://cecas.clemson.edu/cvel/auto/AuE835_Projects_2011/Ramesh_project.html

4. STRIDE Threat Model – Developed by Microsoft, this framework is widely used in threat scenario identification, particularly in the context of cybersecurity for automotive systems.