Project

1. Purpose and Scope

The purpose of the document is to detail the guidelines for threat analysis and risk assessment for the Assert of a Headlamp system of car. The scope of this guideline is applicable for all the cybersecurity relevant projects with Threat analysis and Risk Assessment in project scope.

2. Process Flow

3. Item definition

A headlamp is a lamp attached to the front of a vehicle to illuminate the road ahead. Headlamps are also often called headlights, but in the most precise usage, headlamp is the term for the device itself and headlight is the term for the beam of light produced and distributed by the device. Daytime Running Lights decrease the chance of a front-end collision and significantly reduce accidents during the day. When the engine is running, these lights stay on throughout the day and at night. These lights are faint and are located in the front bumper of the car or integrated inside the headlights.

BCM Unit: Meet Body Control Module (BCM), the brain behind Automotive Electronics. It manages the inter-ECU Communication between Power windows, Wipers, Automatic door lock, HVAC, Headlamps & Rear-Lamps (Automotive Lighting) & a host of other body electronics features.

Modern Headlamp accelerates the development of intelligent headlamps by validating control law behavior and testing potential edge cases early in design. Easily assess innovative and smart light beams with real-time optical simulation in a virtual driving environment. Increase your final product quality and strongly reduce the risk of finding issues late in the development process.

4. 4. Asset Identification

[As.1] There is a CAN message for lamp ON/OFF request, in such as case CAN frame will be an asset

[As.2] Power distribution box provide power to the headlamp, so PDB is one of the asset for car headlamp

[As.3] Genivi – a standard for Linux based systems used for in-car infotainment systems. for example, a cable would run from the battery to a switch and on to the headlights.

5. Threat Scenarios identification

Name of Threat scenario: spoofing on CAN Bus

Cause of compromise: TC.1: spoofing

Acts on: CAN Bus

Compromises: Confidentiality, I: Integrity

Threatens: +

Attack Tree: AS.1

Realizes: DS.1: Headlamp turns off unexpectedly

DS.2: Headlamp turns on unexpectedly

Damped by: A.1

Name of Threat scenario: Tampering on CAN Message

Cause of compromise: TC.2: Tampering

Acts on: CAN Bus

Compromises: Confidentiality, I: Integrity

Threatens: +

Attack Tree: AS.2

Realizes: DS.1: Headlamp brightness increases suddenly

DS.2: Headlamp changes its focus randomly

Damped by: A.2

6. Impact Analysis

The damage scenarios shall be assessed for their impact on the stakeholders. Impact shall be analyzed for the impact categories below for the road users.

1. Safety
2. Financial
3. Operational
4. Privacy

Additional impact categories apart from S, F, O, P can be identified depending on the stakeholders The impact rating of the damage scenario shall be determined to be one of the following: - Severe; - Major; - Moderate; or - Negligible Safety related impacts shall be derived from ISO 26262-3:2018, 6.4.3 Classification of hazardous events.

Name of Threat scenario: spoofing on CAN Bus [TS.1]

Impact Analysis for spoofing on CAN Bus

Impact Rating	Criteria for Safety Impact Rating
Major	S2: Severe and life-threatening injuries (survival probable)

Table 1: Safety impact rating criteria

Moderate	The financial damage leads to inconvenient consequences which the affected stakeholder will be able to overcome with limited resources.

Table 2: Financial impact rating criteria

Impact Rating	Criteria for Operational Impact Rating
Moderate	The operational damage leads to partial degradation of a vehicle function or performance.

Table 3: Operational impact rating criteria

Impact Rating	Criteria for Privacy Impact Rating
Negligible	Privacy damage leads to no effect or can create few inconveniences to the road user. In this case, the information regarding the road user is not sensitive and difficult to link to a PII principal

Table 4: Privacy impact rating criteria

Table 5: Computation of impact rating value

	Safety impact rating criteria	Financial impact rating criteria	Operational impact rating criteria	Computation of impact ratting
Impact
Negligible	0	0	0	0
moderate	10	1	1	1
major	100	10	10	10
severe	1000	100	100	100

Name of Threat scenario: Tampering on CAN Message

Impact Analysis for Tampering on CAN Message [TS.2]

Impact Rating	Criteria for Safety Impact Rating
Major	S2: Severe and life-threatening injuries (survival probable)

Table 1: Safety impact rating criteria

Moderate	The financial damage leads to inconvenient consequences which the affected stakeholder will be able to overcome with limited resources.

Table 2: Financial impact rating criteria

Impact Rating	Criteria for Operational Impact Rating
Moderate	The operational damage leads to partial degradation of a vehicle function or performance.

Table 3: Operational impact rating criteria

Impact Rating	Criteria for Privacy Impact Rating
Negligible	Privacy damage leads to no effect or can create few inconveniences to the road user. In this case, the information regarding the road user is not sensitive and difficult to link to a PII principal

Table 4: Privacy impact rating criteria

Table 5: Computation of impact rating value

	Safety impact rating criteria	Financial impact rating criteria	Operational impact rating criteria	Computation of impact ratting
Impact
Negligible	0	0	0	0
moderate	10	1	1	1
major	100	10	10	10
severe	1000	100	100	100

7.Attack paths analysis

• Via the on-board diagnostics (OBD) cable. You can find the OBD connector below the dashboard and see the 16-pin connector. By connecting this to the ECU or to any laptop, you can start sniffing all the CAN messages.

• Find the CAN bus in the car itself. The CAN bus is a twisted pair cable: CAN high and CAN low. Along with this, there is a ground connection as well. Hook these three wires onto the ECU and then you can start sniffing all the CAN messages

8. Attack paths feasibility

Attack vector-based approach

If an attack vector-based approach is used, it should evaluate the predominant attack vector (cf. CVSS) of the attack path. Attack feasibility rating will be higher the more remote (logically and physically) an attacker can be to exploit the attack path. The assumption is that the number of potential attackers who can exploit a vulnerability using the internet is larger than the number of potential attackers that can exploit an attack path requiring physical access to the item or component.

spoofing on CAN Bus

Attack Feasibility Rating	Determination Criteria
Very low	Physical: Threat agents require physical access to realize the attack path.

Tampering on CAN Bus

Attack Feasibility Rating	Determination Criteria
Very low	Physical: Threat agents require physical access to realize the attack path.

9.Risk Value Determination

Value [Risk] = Impact x Feasibility [Attack path]

10. Risk treatment decision

R1: Denial of Service on Gateway ECU, Whitelist of CAN Messages | none | treated via AV: Avoidance | rationale considered impossible

R2: Spoofing of CAN Bus | 1 | treated via R:Reduction | rationale mitigated by controls

R3:Tampering on Gateway Ecu,Whitelist of CAN messages | none | treated via R:Reduction | rationale Dumped by assumption