With the increasing presence of electronics and autonomous systems in modern automobiles, cybersecurity has become a critical concern. Automotive manufacturers and other stakeholders are actively seeking ways to ensure reliable protection against cyber attacks. One approach involves the utilization of ISO 21434, a standard designed to enhance cybersecurity in the automotive industry. This research article investigates the ISO 21434 standard and its application in the field of automotive production, specifically in software development under the A-SPICE standard. The publication describes the methods and concepts used to enhance cybersecurity in the automotive industry and establishes the role of ISO 21434 within the A-SPICE model. The study's findings are valuable for companies and professionals involved in the development and implementation of cybersecurity measures in the automotive sector. Implementing the ISO 21434 standard can mitigate the risk of cyber attacks and improve the quality and reliability of automobiles, thus making the automotive industry safer and more trustworthy for consumers. The article provides an overview of key cybersecurity standards in the automotive industry. ISO 26262 sets out processes and requirements for functional safety in automotive systems, including cybersecurity considerations. SAE J3061 focuses on cybersecurity management in electronic systems of vehicles and is widely used in the industry. ISO/SAE 21434, introduced in 2020, replaces the previous ISO 26262 standard and specifies cybersecurity requirements in the automotive industry. These standards are closely related as they aim to ensure the safety and security of automotive products. Furthermore, the Automotive SPICE (Software Process Improvement and Capability Determination) framework is widely employed for evaluating and enhancing software development processes in the automotive sector. A-SPICE, a specific variant of Automotive SPICE, provides a framework for improving software development processes in automotive organizations. ISO 21434 guides cybersecurity activities within the A-SPICE framework, emphasizing the importance of a systematic and standardized approach to cybersecurity. To effectively implement cybersecurity in automotive products developed under A-SPICE, compliance with the ISO 21434 standard is crucial. However, mere adherence to the standard may be insufficient for achieving a high level of cybersecurity. Additional tools such as risk analysis methodologies and cybersecurity management can be employed to ensure robust cybersecurity measures. Risk analysis results can help identify vulnerabilities in the security system, enabling the development of effective mitigation measures. Cybersecurity management ensures compliance with the standard throughout the product development lifecycle. ISO 21434 can be applied at various stages of the V-model software development process, including requirements definition, design, and testing. During requirements definition, cybersecurity requirements are identified and incorporated into the system or software specifications. In the design phase, architectures are developed considering the cybersecurity requirements outlined in the standard. The testing phase addresses the fulfillment of cybersecurity requirements and evaluates the effectiveness of cybersecurity measures. In conclusion, the inclusion of ISO 21434 criteria in the development process of automotive software significantly impacts the quality and safety of products. The research demonstrates that applying ISO 21434 criteria allows for a systematic and structured approach to software development, ensuring the reliability, safety, and compliance of software products with regulatory requirements in the automotive industry. The article presents an analysis of standards, methods, and approaches used in the automotive industry and highlights the influence of ISO 21434 on the A-SPICE framework, defining its position within the model. Ultimately, this publication contributes to the advancement of knowledge in automotive cybersecurity.
Read full abstract