Automotive SPICE® for Cybersecurity at a glance

Cybersecurity is the practice of protecting systems, networks and program from digital attacks. Its purpose is to defend the assets (system, network and program) against all threat actors throughout the entire life cycle of a cyber attack. It has a focus on protecting the systems, networks, data from unauthorized exploitation.

Systems, networks, and data which are available and connected digitally are vulnerable to cyberattacks. A cracker (clever hacker) might gain the access from backdoor and create chaos before you even know it. To reduce this incident from happening your development processes should consider all the aspects of cybersecurity and this is where we come into the picture, helping you in systematically and methodically improve the development and testing processes to ensure all the vulnerabilities and threats identified and detected and will be taken care without having any impact on the final product.

Cybersecurity began in the year 1972 with a research project on ARPANET, a predecessor of the internet. There was first draft of ISO 21434 published in February 2020 which is for "Road vehicles - cybersecurity engineering" ISO/SAE DIS 21434 describes the security engineering process in the automotive environment. Due to the trend towards ever greater networking of vehicles and the focus on embedded platforms, attack scenarios are emerging that were previously more familiar from the classic IT environment.

Based on ISO/ SAE 21434 VDA QMC has released Automotive SPICE® for Cybersecurity which gives the process reference and assessment model for cybersecurity engineering along the rating guidelines for cybersecurity engineering Automotive SPICE® for Cybersecurity is the extension for Automotive SPICE® V3.1 for the cybersecurity measures and best practices which are to be followed during the development of the product. Automotive SPICE® for Cybersecurity consists of best practices that address development activities applied to products. It addresses practices that cover the product's lifecycle from conception through development and testing. The emphasis is on the work necessary to develop the product.

Automotive SPICE® for Cybersecurity contains practices that cover Supplier request and selection, risk management, requirement elicitation, cybersecurity implementation, risk treatment verification and validation, and then for project management, process management, systems engineering, software engineering, and other supporting processes can be taken from Automotive SPICE® V 3.1 (PAM and PRM)

Use professional judgment and common sense to interpret the model for your organization. That is, although the process areas described in this model depict behaviours considered best practices for most users, process areas and practices should be interpreted using an in-depth knowledge of cybersecurity, your organizational constraints, and your business environment.

Automotive SPICE® for Cybersecurity does not specify that a project or organization must follow a particular process flow or that a certain number of products be developed per day or specific performance targets be achieved. The model does specify that a project or organization should have processes that address development related practices. To determine whether these processes are in place, a project or organization maps its processes to the process areas in this model.

Automotive SPICE® and Automotive SPICE® for Cybersecurity process reference model - Overview

TARA - Threat Analysis and Risk Assessment Overview

These 3-lifecycle process categories has been further segregated into process groups

• 1. Primary Lifecycle Processes

• a) Acquisition process group

ACQ.2 Supplier Request and Selection
ACQ.3 Contract Agreement
ACQ.4 Supplier Monitoring
ACQ.11 Technical Requirements
ACQ.12 Legal and Administrative Requirements
ACQ.13 Project Requirements
ACQ.14 Request for Proposals
ACQ.15 Supplier Qualification

• b) Supply process group

SPL.1 Supplier Tendering
SPL.2 Product Release

• c) System engineering process group

SYS.1 Requirements Elicitation
SYS.2 System Requirements Analysis
SYS.3 System Architectural Design
SYS.4 System Integration & Integration Test
SYS.5 System Qualification Test

• d) Software engineering process group

SWE.1 Software Requirements Analysis
SWE.2 Software Architectural Design
SWE.3 Software Detailed Design & Unit Construction
SWE.4 Software Unit Verification
SWE.5 Software Integration & Integration Test
SWE.6 Software Qualification Test

• e) Security engineering process group

SEC.1 Cybersecurity Requirements Elicitation
SEC.2 Cybersecurity implementation
SEC.3 Risk Treatment Verification
SEC.4 Risk Treatment Validation

• 2. Supporting Lifecycle Processes

• a) Supporting process group

SUP.1 Quality Assurance
SUP.2 Verification
SUP.4 Joint Review
SUP.7 Documentation
SUP.8 Configuration Management
SUP.9 Problem Resolution Management
SUP.10 Change Request Management

• 3. Organizational Lifecycle Processes

• a) Management process group

MAN.3 Project Management
MAN.5 Risk Management
MAN.6 Measurement
MAN.7 Cybersecurity Risk Management

• b) Process improvement process group

PIM.3 Process Improvement

• c) Reuse process group

REU.2 Reuse Program Management