A Review of Threat Analysis and Risk Assessment Methods in the Automotive Context

  • Georg MacherEmail author
  • Eric Armengaud
  • Eugen Brenner
  • Christian Kreiner
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9922)


Consumer demands for advanced automotive assistant systems and connectivity of cars to the internet make cyber-security an important requirement for vehicle providers. As vehicle providers gear up for the cyber security challenges, they can leverage experiences from many other domains, but nevertheless, must face several unique challenges. Thus, several security standards are well established and do not need to be created from scratch. The recently released SAE J3061 guidebook for cyber-physical vehicle systems provides information and high-level principles for automotive organizations to identify and assess cyber-security threats and design cyber-security aware systems.

In the course of this document, a review of available threat analysis methods and the recommendations of the SAE J3061 guidebook regarding threat analysis and risk assessment method (TARA) is given. The aim of this work is to provide a position statement for the discussion of available analysis methods and their applicability for early development phases in context of ISO 26262 and SAE J3061.


TARA ISO 26262 SAE J3061 Automotive Security analysis 



This work is supported by the \(EMC^2\) project. The research leading to these results has received funding from the ARTEMIS Joint Undertaking under grant agreement nr 621429 (project \(EMC^2\)).


  1. 1.
    Ebert, C., Jones, C.: Embedded software: facts, figures, and future. IEEE Comput. Soc. 09, 42–52 (2009). ISSN: 0018–9162CrossRefGoogle Scholar
  2. 2.
    ISO - International Organization for Standardization. IEC 61508 functional safety of electrical/electronic/programmable electronic safety-related systemsGoogle Scholar
  3. 3.
    ISO - International Organization for Standardization. IEC 60812 analysis techniques for system reliability - procedure for failure mode and effects analysis (FMEA) (2006)Google Scholar
  4. 4.
    ISO - International Organization for Standardization. IEC 61025 fault tree analysis (FTA), December 2006Google Scholar
  5. 5.
    ISO - International Organization for Standardization. IEC 62443 - industrial communication networks. Network and system security (2009)Google Scholar
  6. 6.
    ISO - International Organization for Standardization. ISO 26262 road vehicles functional safety part 1–10 (2011)Google Scholar
  7. 7.
    Macher, G., Sporer, H., Berlach, R., Armengaud, E., Kreiner, C.: SAHARA: a security-aware hazard and risk analysis method. In: 2015 Design, Automation Test in Europe Conference Exhibition (DATE), pp. 621–624, March 2015Google Scholar
  8. 8.
    Microsoft Corporation. The STRIDE Threat Model (2005)Google Scholar
  9. 9.
    Miller, M.: The Internet of Things: How Smart TVs, Smart Cars, Smart Homes, and Smart Cities are Changing the World. Que, Indianapolis (2015)Google Scholar
  10. 10.
    National Highway Traffic Safety Administration. Characterization of Potential Security Threats in Modern Automobiles - A Composite Modeling Approach, October 2014Google Scholar
  11. 11.
    Petschnigg, C., Deutschmann, M., Osterhues, A., Steden, L., Botta, S., Krasikau, M., Tverdyshev, S., Diemer, J., Ahrendts, L., Thiele, D., Bernardeschi, C., Natale, M.D., Dini, G., Sun, Y.: D2.1 architecture models and patterns for safety and security (alpha). Report ICT-644080-D2.1, SAFURE Project Partners, February 2016Google Scholar
  12. 12.
    Sapiro, B.: Binary Risk Analysis. Creative Commons License. 1st ednGoogle Scholar
  13. 13.
    Schmittner, C., Gruber, T., Puschner, P., Schoitsch, E.: Security application of failure mode and effect analysis (FMEA). In: Bondavalli, A., Di Giandomenico, F. (eds.) SAFECOMP 2014. LNCS, vol. 8666, pp. 310–325. Springer, Heidelberg (2014)Google Scholar
  14. 14.
    Sentilles, S., Štěpán, P., Carlson, J., Crnković, I.: Integration of extra-functional properties in component models. In: Lewis, G.A., Poernomo, I., Hofmeister, C. (eds.) CBSE 2009. LNCS, vol. 5582, pp. 173–190. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  15. 15.
    Vehicle Electrical System Security Committee. SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive SystemsGoogle Scholar

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Georg Macher
    • 1
    Email author
  • Eric Armengaud
    • 1
  • Eugen Brenner
    • 2
  • Christian Kreiner
    • 2
  1. 1.AVL List GmbHGrazAustria
  2. 2.Institute for Technical InformaticsGraz University of TechnologyGrazAustria

Personalised recommendations