Automotive cyber security integrity levels

The increasing connectivity and automation of electronic and electrical systems in modern vehicles has led to the need for cyber security to be built in to the design of such systems from the early stages of development. Although formal international standards for automotive cyber security are still to be developed, the recently published SAE J3061TM recommended practice sets out a framework for organisations to develop their own cyber security engineering process based on some key principles. One of the recommendations of this framework is to carry out a threat analysis and risk assessment early in the product development, in order to identify the relevant threats and classify the risk associated with each threat. The risks are then analysed to determine whether they are at an acceptable level or if risk reduction measures need to be implemented. However the framework does not currently propose how any required risk reduction should be defined or quantified. A number of existing functional safety standards define variants of safety integrity levels, which specify the level of risk reduction required and approaches for achieving it, for example the ASIL in ISO 26262. A commonly accepted way of classifying the required level of security risk reduction is needed to allow subsequent development phases to design, implement, test and validate appropriate security measures which offer the necessary level of protection against malicious adversaries. In this paper we give a short overview of the automotive threat landscape, the typical vehicle attack surface and current standards and best practices. This is followed by a survey of safety integrity levels proposed in current functional safety standards, and the nearest equivalents to security levels found in the available security standards. Based on this we outline some requirements for and propose a set of automotive security integrity levels. The use of these levels is illustrated with a fictitious but realistic case study.