Security assurance cases for road vehicles: An industry perspective

Citation
15th International Conference on Availability, Reliability and Security, ARES 2020
Contribution to Conference
15th International Conference on Availability, Reliability and Security, ARES 2020  
Publisher DOI
10.1145/3407023.3407033
Scopus ID
2-s2.0-85117541543
ArXiv ID
2003.14106
Publisher
The Association for Computing Machinery
ISBN
978-1-4503-8833-7
Assurance cases are structured arguments that are commonly used to reason about the safety of a product or service. Currently, there is an ongoing push towards using assurance cases also for cybersecurity, especially in safety critical domains, like automotive. While the industry is faced with the challenge of defining a sound methodology to build security assurance cases, the state of the art is rather immature. Therefore, we have conducted a thorough investigation of the (external) constraints and (internal) needs that security assurance cases have to satisfy when used in the automotive industry. This has been done with 28 participants and in the context of two large automotive companies located in Europe: Company A is a passenger car manufacturer, while Company B is a truck manufacturer. An extended version of this paper is available online at https://arxiv.org/abs/2003.14106.
Subjects
Assurance cases
Automotive
Security
DDC Class
004: Computer Sciences