Refine Your Search

Topic

Search Results

Technical Paper

Cybersecurity Testing and Validation

2017-03-28
2017-01-1655
We also consider the necessary scope and depth of cybersecurity testing and suggest examples of how this can be related to cybersecurity requirements, goals and integrity levels, as determined by the threat analysis and risk assessment. ...An essential part of an effective cybersecurity engineering process is testing the implementation of a system for vulnerabilities and validating the effectiveness of countermeasures. ...The SAE J3061 Cybersecurity Guidebook for Cyber-Physical Vehicle Systems provides a recommended framework which organizations can use to implement a cybersecurity engineering process, which includes activities such as integration and testing, penetration testing and verification/validation of cybersecurity requirements at the hardware, software and system levels.
Research Report

Unsettled Topics Concerning Airworthiness Cyber-Security Regulation

2020-08-21
EPR2020013
The "Dreamliner," the first true "flying data center," could no longer be certified for airworthiness ignoring "sabotage," like the classic safety regulation for commercial passenger aircraft – as its extensive application of data networks, including enhanced external digital communication, forced the Federal Aviation Administration (FAA), for the first time, to set "Special Conditions" for cyber-security. In the 15 years that followed, airworthiness regulation followed suit, and all key rule-making, regulation-making, and standard-making organizations weighed in to establish a new airworthiness cyber-security superset of legislation, regulation, and standardization. ...In the 15 years that followed, airworthiness regulation followed suit, and all key rule-making, regulation-making, and standard-making organizations weighed in to establish a new airworthiness cyber-security superset of legislation, regulation, and standardization. The resulting International Civil Aviation Organization (ICAO) resolutions, U.S. and European Union (EU) legislation, FAA and European Aviation Safety Agency (EASA) regulation and the DO-326/ED-202 set of standards are about to become the new standards for legislation, regulation, and best practices as soon as 2020, and in fact – some of them are already in effect.
Training / Education

Keys to Creating a Cybersecurity Process from the J3061 Process Framework

This allows an organization to develop an internal cybersecurity process consistent with its other processes in order to build cybersecurity robustness into their cyber- physical systems. ...This seminar will define key concepts in cybersecurity and discuss what a cybersecurity process consists of and why one is needed for the development of cyber-physical vehicle systems.
Training / Education

DO-326A and ED-202A An Introduction to the New and Mandatory Aviation Cyber-Security Essentials

2020-09-14
The international standards D-326A (U.S.) and ED-202A (Europe) titled "Airworthiness Security Process Specification" are the cornerstones of the "DO-326/ED-202 Set" and they are the only Acceptable Means of Compliance (AMC) by FAA & EASA for aviation cyber-security airworthiness certification, as of 2019. The "DO-326/ED-202 Set" also includes companion documents DO-356A/ED-203A: "Airworthiness Security Methods and Considerations" & DO-355/ED-204: "Information Security Guidance for Continuing Airworthiness" (U.S. & Europe) and ED-201: "Aeronautical Information System Security (AISS) Framework Guidance" & ED-205: "Process Standard for Security Certification / Declaration of Air Traffic Management / Air Navigation Services (ATM/ANS) Ground Systems“ (Europe only).
Training / Education

Introduction to Automated Vehicle Safety Multi-Agent, Functional, SOTIF, and Cybersecurity

You’ll learn the main attributes of safety as applied to automated vehicles, including the four types of safety: Functional Safety, Safety of the Intended Functionality (SOTIF), Multi-agent safety, and safety involved in cybersecurity attacks. The discussion will enable participants to conceive of the various applicable design aspects of safety, clarify the role of SOTIF, multi-agent safety, and cybersecurity safety and address the development of multi-agent safety using a probabilistic and stochastic framework.
Journal Article

Cybersecurity Considerations for Heavy Vehicle Event Data Recorders

2018-12-14
Abstract Trust in the digital data from heavy vehicle event data recorders (HVEDRs) is paramount to using the data in legal contests. Ensuring the trust in the HVEDR data requires an examination of the ways the digital information can be attacked, both purposefully and inadvertently. The goal or objective of an attack on HVEDR data will be to have the data omitted in a case. To this end, we developed an attack tree and establish a model for violating the trust needed for HVEDR data. The attack tree provides context for mitigations and also for functional requirements. A trust model is introduced as well as a discussion on what constitutes forensically sound data. The main contribution of this article is an attack tree-based model of both malicious and accidental events contributing to compromised event data recorder (EDR) data. A comprehensive list of mitigations for HVEDR systems results from this analysis.
Magazine

Automotive Engineering: August 2017

2017-08-03
Is automotive ready for the inevitable? Cybersecurity experts talk defense strategies. Active Aero takes flight Reconfigurable "smart" aerodynamic aids are stretching performance-car envelopes in every direction.
Journal Article

Threat Analysis and Risk Assessment in Automotive Cyber Security

2013-04-08
2013-01-1415
The process of hazard analysis and risk assessment (H&R or HARA) is well-established in standards and methods for functional safety, such as the automotive functional safety standard ISO 26262. Considering the parallel discipline of cyber security, it is necessary to establish an analogous process of threat analysis and risk assessment (T&R) in order to identify potential security attacks and the risk associated with these attacks if they were successful. While functional safety H&R processes could be used for threat analysis, these methods need extension and adaptation to the cyber security domain. This paper describes how such a method has been developed based on the approach described in ISO 26262 and the related MISRA Safety Analysis Guidelines. In particular key differences are described in the understanding of the severity of a security attack, and the factors that contribute to the probability of a successful attack.
Standard

Electron Beam Powder Bed Fusion Process

2020-07-01
CURRENT
AMS7007
This specification establishes process controls for the repeatable production of aerospace parts by Electron Beam Powder Bed Fusion (EB-PBF). It is intended to be used for aerospace parts manufactured using additive manufacturing (AM) metal alloys, but usage is not limited to such applications.
Book

The Car Hacker's Handbook: A Guide for the Penetration Tester

2016-03-01
Modern cars are more computerized than ever, with the aim to make driving more convenient. But vehicle technologies haven’t kept pace with today’s more hostile security environment, leaving millions vulnerable to attack. This handbook will give you a deeper understanding of the computer systems and embedded software in modern vehicles. It begins by examining vulnerabilities and providing detailed explanations of communications over the CAN bus and between devices and systems. With an understanding of a vehicle’s communication network, you’ll learn how to intercept data and perform specific hacks to track vehicles, unlock doors, glitch engines, flood communication, and more.
Journal Article

Enhancement of Automotive Penetration Testing with Threat Analyses Results

2018-11-02
Abstract In this work, we present an approach to support penetration tests by combining safety and security analyses to enhance automotive security testing. Our approach includes a new way to combine safety and threat analyses to derive possible test cases. We reuse outcomes of a performed safety analysis as the input for a threat analysis. We show systematically how to derive test cases, and we present the applicability of our approach by deriving and performing test cases for a penetration test of an automotive electronic control unit (ECU). Therefore, we selected an airbag control unit due to its safety-critical functionality. During the penetration test, the selected control unit was installed on a test bench, and we were able to successfully exploit a discovered vulnerability, causing the detonation of airbags.
Standard

Requirements for a COTS Assembly Management Plan

2020-08-03
CURRENT
EIA933C
This document applies to the development of Plans for integrating and managing COTS assemblies in electronic equipment and Systems for the commercial, military, and space markets; as well as other ADHP markets that wish to use this document. For purposes of this document, COTS assemblies are viewed as electronic assemblies such as printed wiring assemblies, relays, disk drives, LCD matrices, VME circuit cards, servers, printers, laptop computers, etc. There are many ways to categorize COTS assemblies1, including the following spectrum: At one end of the spectrum are COTS assemblies whose design, internal parts2, materials, configuration control, traceability, reliability, and qualification methods are at least partially controlled, or influenced, by ADHP customers (either individually or collectively). An example at this end of the spectrum is a VME circuit card assembly.
SAE MOBILUS Subscription

Wiley Cyber Security Collection Add-On

2018-03-23
As an annual subscription, the Wiley Cyber Security Collection Add-On is available for purchase along with one or both of the following: Wiley Aerospace Collection Wiley Automotive Collection The titles from the Wiley Cyber Security Collection are included in the SAE MOBILUS® eBook Package. Titles: Network Forensics Penetration Testing Essentials Security in Fixed and Wireless Networks, 2nd Edition The Network Security Test Lab: A Step-by-Step Guide Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis Applied Cryptography: Protocols, Algorithms and Source Code in C, 20th Anniversary Edition Computer Security Handbook, Set, 6th Edition Threat Modeling: Designing for Security Other available Wiley collections: Wiley SAE MOBILUS eBook Package Wiley Aerospace Collection Wiley Automotive Collection Wiley Computer Systems Collection Add-On (purchasable with the Wiley Aerospace Collection and/or the Wiley Automotive Collection)
Technical Paper

Investigation of Vehicular Networks and its Main Security Issues

2014-04-01
2014-01-0336
Vehicular Network is an emerging and developing technology to improve traffic management and safety issues, and enable a wide range of value-added services such as collision warning/avoidance. Many applications have been designed to provide safety and comfort for passengers. This technology is a prolific area for attackers who will attempt to challenge the network with their malicious or rational attacks. In this paper we elaborate what a vehicular network is, different kinds of communication in this field, main mechanism and related parts and how vehicular networks work then we introduce some of its applications. After primary familiarity with this system we investigate to different type of attacker, more important security issues, How to secure vehicular networks (security requirements and some tools and methods to achieve secure vehicular networks), difficulties and providing viable security solutions, and at the end briefly explanation of related standards.
Technical Paper

Securing the Secret Key

2019-01-16
2019-01-0097
Recent advances in automotive technologies have paved way to a new era of connectivity. Advanced Driver Assistance Systems are getting deployed in automobiles; many companies are developing driverless cars; connected cars are no more a work of mere research. [1] Vehicle manufacturers are developing ways to interface mobile devices with vehicles. However, all these advances in technology has introduced security risks. Unlike traditional computing systems, the security risk of an automobile can be fatal and can result in loss of lives [2]. The in-vehicle network of an automobile was originally designed to operate in a closed environment and hence network security was not considered during its design [3]. Several studies have already shown that an in-vehicle network can be easily compromised and an intruder can take full control of the vehicle. Researchers are working on various ways to solve this problem. Securing the in-vehicle communication by encrypting the messages is one such way.
Research Report

Unsettled Legal Issues Facing Automated Vehicles

2020-02-28
EPR2020005
This SAE EDGE Research Report explores the many legal issues raised by the advent of automated vehicles. While promised to bring major changes to our lives, there are significant legal challenges that have to be overcome before they can see widespread use. A century’s worth of law and regulation were written with only human drivers in mind, meaning they have to be amended before machines can take the wheel. Everything from key federal safety regulations down to local parking laws will have to shift in the face of AVs. This report undertakes an examination of the AV laws of Nevada, California, Michigan, and Arizona, along with two failed federal AV bills, to better understand how lawmakers have approached the technology. States have traditionally regulated a great deal of what happens on the road, but does that still make sense in a world with AVs? Would the nascent AV industry be able to survive in a world with fifty potential sets of rules?
Standard

Model Based Functional Safety

2018-05-17
WIP
SAE1005
Provides standard guidance on major tasks and activities and how to implement and manage Functional Safety and software system safety aspects of Model Based System Engineering (MBSE). Process focus is on safety-critical functions (SCF) of complex software intensive systems being modeled and depicted graphically as part of MBSE and software engineering to ensure safety engineering aspects are tracked and captured as part of models to enhance safety documentation and produce objective safety evidence.
X