Cybersecurity in safety‐critical systems. Issue 5 (May 2018)

• Record Type: Journal Article
• Authors: Walker, Alastair
• Other Names: Mashkoor Atif guestEditor.; Biró Miklós guestEditor.; Messnarz Richard guestEditor.; Colomo‐Palacios Ricardo guestEditor.
• Is Part Of: Journal of software. Volume 30:Issue 5(2018)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-05
• Subjects: cybersecurity -- risk model -- sabotage -- threat -- trojan circuits; Software engineering -- Periodicals; Computer software -- Development -- Periodicals; Software maintenance -- Periodicals; 005.1
• DOI: 10.1002/smr.1956
• Languages: English
• ISSNs: 2047-7473

Abstract

Abstract: 2016 saw cybersecurity standards appear in both automotive and medical device industries. Both standards are understandably based on processes that already exist in the respective industries. The automotive J30611 standard is very much focussed on existing categories for defining the cybersecurity threats, ie, systems, hardware and software. Cybersecurity is very much a multifaceted topic, and by restricting the scope to these 3 subject areas there is the risk that many significant threats could be overlooked, in particular the malicious acts of employees within an organisation. The medical cybersecurity report AAMI TIR 572 takes the approach based on ISO 149713 the medical device risk management standard, which encourages a more open‐minded approach to evaluating cybersecurity threats. Both of these documents, which are discussed in this paper, are short of practical examples or techniques for assessing and mitigating threats; the topic is handled in a more theoretical manner. Key issues such as trojan circuits in microcontrollers are not well represented in either document. Generally, software topics such as authentication and encryption are given good coverage in international standards; however, this not the case when reviewing hardware concerns. Both TIR 57 and J3061 are good starting documents for the topic of cybersecurity, but both could benefit from expansion to cover the wider topics affecting cybersecurity.