ISO/SAE FDIS 21434-2021：道路车辆网络安全标准详解

版权申诉

5星 · 超过95%的资源 111 浏览量更新于2024-07-18 2 收藏 6.32MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

ISO-SAE-FDIS 21434-2021是国际标准化组织（ISO）和美国汽车工程师学会（SAE）联合发布的一份关于道路车辆网络安全工程的标准草案，旨在规范汽车行业在设计、开发、生产和维护过程中如何确保车辆系统的网络安全。《道路车辆－网络安全工程》这份标准主要涵盖了以下几个核心知识点： 1. **网络安全管理体系**：该标准强调了建立全面的网络安全管理体系的重要性，包括定义网络安全政策、设立专门的网络安全团队、制定风险管理流程以及持续监控和改进机制。 2. **风险评估与管理**：ISO-SAE 21434要求制造商进行系统性的网络安全风险评估，识别潜在的威胁和脆弱性，并采取适当的缓解措施。这涉及到对车辆生命周期中的所有阶段进行风险分析，包括设计、制造、运行和报废等。 3. **供应链安全**：标准指出，供应商和合作伙伴的网络安全也是整体车辆网络安全的一部分。因此，汽车制造商需要确保所有供应链中的组件和软件都符合安全标准，并进行相应的审核和认证。 4. **隐私保护**：考虑到车辆可能收集和传输大量的个人数据，标准要求在设计阶段就考虑隐私保护，采用数据保护机制，防止数据泄露或被不当使用。 5. **安全设计与实施**：在设计阶段，需要采用安全设计原则，如安全功能隔离、最小权限原则、安全更新机制等。在实施阶段，强调采用安全编码实践，减少漏洞引入的可能性。 6. **测试与验证**：ISO-SAE 21434建议进行网络安全测试，包括黑盒测试、白盒测试和灰盒测试，以验证系统的安全性能。同时，需要定期进行渗透测试和漏洞扫描，确保系统在不断变化的威胁环境中保持安全。 7. **事件响应与应急计划**：标准规定了应对网络安全事件的策略和程序，包括预防、检测、响应和恢复机制，以降低网络安全事件对车辆用户和整个交通系统的潜在影响。 8. **法规遵从性**：由于标准可能被用作国家法规的参考，汽车制造商需要确保其产品符合全球各地的相关法规要求，如欧洲的《通用数据保护条例》(GDPR) 和美国的《加州消费者隐私法》(CCPA)。 9. **持续改进与更新**：随着技术的发展和威胁环境的变化，标准强调了持续改进网络安全策略和技术的重要性。制造商应定期审查并更新其网络安全实践，以适应新的威胁和挑战。 10. **知识产权声明**：标准提醒接收者在提交评论时，如果注意到任何相关的专利权，应予以通知并提供支持文档。这确保了标准的实施不会侵犯到任何知识产权。 ISO/SAE FDIS 21434-2021的发布，对于汽车行业来说，标志着一个全新的网络安全时代，它不仅要求制造商关注产品的功能性和可靠性，还要求他们在设计和生产过程中充分考虑网络安全，以保护消费者的数据安全和行车安全。

资源详情

资源推荐

ISO/SAE

FDIS

21434:2021(E)

3.1.38

vulnerability

weakness

(

3.1.40

)

that

can

exploited

part

attack

path

(

3.1.4

)

[SOURCE:

ISO/IEC

27000:2018

㈤

，

3.77,

modified

—

The

phrase

"of

asset

control"

has

been

omitted;

the

phrase

“

one

threats

has

been

replaced

“

part

attack

path

”

3.1.39

vulnerability

analysis

systematic

identification

and

evaluation

vulnerabilities

(

3.1.38

)

3.1.40

weakness

defect

characteristic

that

can

lead

undesirable

behaviour

EXAMPLE

Missing

requirement

specification.

EXAMPLE

Architectural

design

flaw,

including

incorrect

design

security

protocol.

EXAMPLE

Implementation

weakness,

including

hardware

and

software

defect,

incorrect

implementation

security

protocol.

EXAMPLE

Flaw

the

operational

process

procedure,

including

misuse

and

inadequate

user

training.

EXAMPLE

Use

outdated

deprecated

function,

including

cryptographic

algorithms.

3.2

Abbreviated

terms

CAL

cybersecurity

assurance

level

CVSS

common

vulnerability

scoring

system

E/E

electrical

and

electronic

ECU

electronic

control

unit

OBD

on-board

diagnostic

OEM

original

equipment

manufacturer

permission

recommendation

requirement

RASIC

responsible,

accountable,

supporting,

informed,

consulted

TARA

threat

analysis

and

risk

assessment

work

product

General

considerations

item

comprises

all

electronic

equipment

and

software

(i.e.

its

components)

vehicle,

that

involved

the

realization

ofa

specific

functionality

vehicle

level,

e.g.

braking.

item

component

interacts

with

its

operational

environment.

The

application

this

document

limited

cybersecurity-relevant

items

and

components

series

production

road

vehicle

(i.e.

not

prototype)

including

aftermarket

and

service

parts.

Systems

external

ISO/SAE

International

2021

All

rights

reserved

ISO/SAE

FDIS

21434:2021(E)

Figure

—

Relationship

between

item,

function,

component

and

terms

Clause

describes

modular

methods

for

assessment

cybersecurity

risk

that

are

invoked

cybersecurity

activities

described

other

clauses.

Analysis

activities

the

context

cybersecurity

engineering

identify

and

explore

potential

actions

performed

abstract

adversarial

actors

with

malicious

intent

and

the

damage

that

can

arise

from

the

compromise

cybersecurity

the

vehicle

E/E

systems.

Coordination

between

cybersecurity

engineering

and

expertise

from

other

disciplines

can

support

the

in-depth

analysis

and

mitigation

some

threat

scenarios

(cf.

ISO/TR

4804

的).

Cybersecurity

monitoring,

remediation

and

incident

response

activities

complement

concept

and

product

development

activities

reactive

approach

acknowledging

the

changing

conditions

the

environment

(e.g.

new

attack

technologies)

and

the

ongoing

need

identify

and

manage

weaknesses

and

vulnerabilities

road

vehicle

E/E

systems.

defence-in-depth

approach

can

used

mitigate

cybersecurity

risk.

The

defence-in-depth

approach

utilizes

layers

cybersecurity

controls

improve

the

cybersecurity

the

vehicle.

attack

able

penetrate

bypass

one

layer,

another

layer

can

help

contain

the

attack

and

maintain

protection

the

assets.

Organizational

cybersecurity

management

5.1

General

enable

cybersecurity

engineering,

the

organization

institutes

and

maintains

cybersecurity

governance

and

cybersecurity

culture,

including

cybersecurity

awareness

inanagerneril,

cunipelence

management

and

continuous

improvement.

This

involves

specifying

organization-specific

rules

and

processes

that

are

independently

audited

against

the

objectives

this

document.

support

cybersecurity

engineering,

the

organization

implements

management

systems

for

cybersecurity

including

managing

tools

and

applying

quality

management

system.

5.2

Objectives

The

objectives

this

clause

are

to:

define

cybersecurity

policy

and

the

organization-specific

rules

and

processes

for

cybersecurity;

assign

the

responsibilities

and

corresponding

authorities

that

are

required

perform

cybersecurity

activities;

support

the

implementation

cybersecurity,

including

the

provision

resources

and

the

management

the

interactions

between

cybersecurity

processes

and

processes;

ISO/SAE

International

2021

All

rights

reserved

ISO/SAE

FDIS

21434:2021(E)

institute

and

maintain

cybersecurity

culture,

including

competence

management,

awareness

management

and

continuous

improvement;

manage

the

cybersecurity

risk;

perform

organizational

cybersecurity

audit;

support

and

manage

the

sharing

cybersecurity

information;

institute

and

maintain

management

systems

that

support

the

maintenance

cybersecurity;

and

provide

evidence

that

the

use

tools

does

not

adversely

affect

cybersecurity.

5.3

Inputs

5.3.1

Prerequisites

None.

5.3.2

Further

supporting

information

The

following

information

can

considered:

—

existing

evidence

conformity

with

standards

that

support

quality

management.

EXAMPLE

IATF

16949

⑵

也

conjunction

with

ISO

9001

囲

，

ISO

10007

倒

，

Automotive

SPICE®

)

the

ISO/IEC

33001

series

ISO/IEC/IEEE

15288

and

ISO/IEC/IEEE

12207

【

起

】

Automotive

SPICE®

【

或]

example

suitable

products

available

commercially.

This

information

given

for

the

convenience

users

this

document

and

does

not

constitute

endorsement

ISO

these

products.

5.4

Requirements

and

recommendations

5.4.1

Cybersecurity

governance

[RQ-05-01]

The

organization

shall

define

cybersecurity

policy

that

includes:

acknowledgement

road

vehicle

cybersecurity

risks;

and

the

executive

management's

commitment

manage

the

corresponding

cybersecurity

risks.

NOTE

The

cybersecurity

policy

can

include

links

the

organization's

objectives

and

other

policies.

NOTE

The

cybersecurity

policy

can

include

statement

regarding

the

risk

treatment

generic

threat

scenarios

with

respect

the

organization^

products

services

portfolio,

considering

the

context,

either

external

internal.

[RQ-05-02]

The

organization

shall

establish

and

maintain

rules

and

processes

to:

enable

the

implementation

the

requirements

this

document;

and

support

the

execution

the

corresponding

activities.

EXAMPLE

Process

definitions,

technical

rules,

guidelines,

methods

and

templates.

NOTE

Cybersecurity

risk

management

can

include

effort-benefit

considerations

activities.

NOTE

Rules

and

processes

cover

concept,

product

development,

production,

operation,

maintenance,

and

decommissioning,

including

TARA

methods,

information

sharing,

cybersecurity

monitoring,

cybersecurity

incident

response,

and

triggers.

NOTE

Rules

and

processes

regarding

vulnerability

disclosure,

for

example

part

information

sharing,

can

specified

accordance

with

ISO

29147

ISO/SAE

International

2021

All

rights

reserved

ISO/SAE

FDIS

21434:2021(E)

NOTE

gure

outlines

the

relationship

between

overarching

cybersecurity

policy

(see

[RQ-05-01]),

and

organization-specific

cybersecurity

rules

and

processes

(see

[RQ-05-02]),

responsibilities

(see

[RQ-05-03])

and

resources

(see

[RQ-05-04]).

Figure

—

Cybersecurity

governance

[RQ-05-03]

The

organization

shall

assign

and

communicate

the

responsibilities

and

corresponding

organizational

authority

achieve

and

maintain

cybersecurity.

NOTE

This

relates

organizational

well

project-dependent

activities.

[RQ-05-04]

The

organization

shall

provide

the

resources

address

cybersecurity.

NOTE

Resources

include

the

persons

responsible

for

cybersecurity

risk

management,

development,

and

incident

management.

EXAMPLE

Skilled

personnel

and

suitable

tools

perform

cybersecurity

activities.

[RQ-05-05]

The

organization

shall

identify

disciplines

to,

interacting

with,

cybersecurity

and

establish

and

maintain

communication

channels

between

those

disciplines

order

to:

determine

and

how

cybersecurity

will

integrated

into

existing

processes;

and

coordinate

the

exchange

relevant

information.

NOTE

Disciplines

include

information

technology

security,

functional

safety,

and

privacy.

EXAMPLE

Interdisciplinary

exchange

of:

—

threat

scenarios

and

hazard

(cf.

ISO

26262-1:2018

⑴

，

3.75)

information;

—

cybersecurity

goals

and

safety

goals

(cf.

ISO

26262-1:2018

⑴

，

3.139);

and/or

—

cybersecurity

requirements

conflicting

competing

with

functional

safety

requirements

(cf.

ISO

26262-

1:2018

⑴

3.69).

NOTE

Coordination

can

include

sharing

processes

and

using

strategies

and

tools

between

disciplines.

5.4.2

Cybersecurity

culture

[RQ-05-06]

The

organization

shall

foster

and

maintain

strong

cybersecurity

culture.

NOTE

See

Annex

for

examples.

[RQ-05-07]

The

organization

shall

ensure

that

persons

which

cybersecurity

roles

and

responsibilities

are

assigned

have

the

competences

and

awareness

fulfil

these.

NOTE

competence,

awareness

and

training

program

can

include:

—

organizational-specific

rules

and

processes

regarding

cybersecurity,

including

cybersecurity

risk

management;

—

organizational

rules

and

processes

regarding

disciplines

cybersecurity,

such

functional

safety

and

privacy;

ISO/SAE

International

2021

All

rights

reserved

剩余91页未读，继续阅读

thgj0006

粉丝: 568
资源: 444

ISO/SAE FDIS 21434-2021：道路车辆网络安全标准详解

ISO SAE FDIS 21434-2021.pdf

ISO-SAE-FDIS 21434-2021 Road vehicles -Cybersecurity engineering

sfr_iso_fdis

patton_copula_toolbox/fdis_cdf.m

transformer基于像素级的变化检测

基于纯transformer的遥感影像变化检测

基于springboot大学生智能消费记账系统的设计与实现.docx

基于Mnist数据集生成用于(多)目标检测的小型数据集.zip

8051Proteus仿真c源码步进电机C版本

国内人气最高的Java人工智能算法框架 它可以Maven一键丝滑引入我们的Java项目，无需任何额外的环境配置与依赖，做到开箱即

QGraphicsView+QGraphicsScene+Item,实现加载背景图片（放大、缩小，右键移动）绘制线、矩形、多边形

数字电子技术实验报告+

多层感知机的从零开始实现与pytorch简洁实现（pycharm版）

java某百货店POS积分管理系统-积分点更新生成以及通票回收处理(源代码+lw).zip

基于改进YOLOv7算法的车辆目标检测系统。.zip

我的毕业设计（高校后勤管理系统）_wuaoya.zip

基于Spring Boot框架的博客管理系统.zip

C#-WPF-MVVM大屏看板3D立体可视化大屏监控源码 1，WPF编程设计； 2，自定义工业控件设计； 3，数据库设计； 4

病虫害识别，对于专一一种病虫害的识别.zip

8051Proteus仿真c源码独立式键盘的按键功能扩展:以一当四

最新资源

国内人气最高的Java人工智能算法框架它可以Maven一键丝滑引入我们的Java项目，无需任何额外的环境配置与依赖，做到开箱即