Cybersecurity in safety‐critical systems

Abstract

Abstract2016 saw cybersecurity standards appear in both automotive and medical device industries. Both standards are understandably based on processes that already exist in the respective industries. The automotive J3061 standard is very much focussed on existing categories for defining the cybersecurity threats, ie, systems, hardware and software. Cybersecurity is very much a multifaceted topic, and by restricting the scope to these 3 subject areas there is the risk that many significant threats could be overlooked, in particular the malicious acts of employees within an organisation.The medical cybersecurity report AAMI TIR 57 takes the approach based on ISO 14971 the medical device risk management standard, which encourages a more open‐minded approach to evaluating cybersecurity threats. Both of these documents, which are discussed in this paper, are short of practical examples or techniques for assessing and mitigating threats; the topic is handled in a more theoretical manner.Key issues such as trojan circuits in microcontrollers are not well represented in either document. Generally, software topics such as authentication and encryption are given good coverage in international standards; however, this not the case when reviewing hardware concerns. Both TIR 57 and J3061 are good starting documents for the topic of cybersecurity, but both could benefit from expansion to cover the wider topics affecting cybersecurity.