Towards an information security framework for the automotive domain.

Abstract

Driven by increasing connectivity, complexity, and distribution of functions in vehicles, automotive security is steadily gaining attention. While in other domains there is a harmonized notion on security requirements and there are even broad information security management standards, in the automotive domain there is so far no common structured approach to achieve system security. At the same time, the automotive domain shows some special properties that differentiate it from other domains and prevent direct application of available approaches. In this work, we take a step towards an automotive information security framework. We provide an overview of existing system security and security development standards from related domains and provide motivation for harmonization on one hand and a sector-specific standard on the other. We outline core ideas and elements of a possible framework for automotive security engineering, illustrate them with examples, and put them in context with existing related information security standards.