Security assurance cases for road vehicles

Application of an Automotive Assurance Case Approach to Autonomous Marine Vessel Security

“…And even though the standard does not actually identify a specific method to build the case it has a clear objective by conveying that it shall be created to provide the argument for the cybersecurity of the item or component, supported by work products, and that it can be created by combining customer supplier cybersecurity cases but most also support post-development. The standard has a clause focused on operations and maintenance, in this section the relation of prerequisites for post development are relevant, and how it must be used in the instant of delivering updates [26] [27]. Section 6 specifically mentions the need of a cybersecurity case while Section 9 details the concept phase, by (1) defining the operational environment, (2) specifying the cybersecurity goals and claims and (3) specifying the cybersecurity requirements.…”

Security assurance cases—state of the art of an emerging approach

“…In particular, we are interested in whether there are statements that go beyond the intuitive rationale of using SAC "for security assurance". For instance, our initial research (Mohamad et al 2020) indicated that compliance with security standards and regulations is also an important driver. As shown in Table 1, to answer this research question we analyze the surveyed papers and extract two characteristics: assess security level of product or service, obtain certification, .…”

“…Without having an in-depth knowledge of the specific regulation or standard, it is hard to determine whether SACs are explicitly required, or rather just recommended as a way to create a structured argument for security. Incidentally, in our own previous work we have tried to demystify this issue in the context of automotive systems (Mohamad et al 2020). Furthermore, some studies suggest that SACs can be used for evaluating the level of security of a system by assigning measurements to the elements of the cases, e.g., the evidence.…”

“…An obvious question to ask is: why are SACs not more widely adopted in industry even though there are so many motivations and usage scenarios for them in literature? It has already been shown that adopting SACs is nontrivial (Mohamad et al 2020). It requires a substantial amount of effort and time, which grows as the systems become more complex.…”

“…Furthermore, there is a lack of studies covering what comes after the creation of SAC. In particular, for SAC to be useful, they have to be updated and maintained throughout the life-cycles of the products and systems they target, otherwise, they become obsolete (Mohamad et al 2020). Particularly, there need to be traceable links between the created SACs and the artefacts of these products and systems.…”