What we have done, and what came out of it.

Situation

A global technology company develops a vehicle operating system and software stack for autonomous driving, with many teams and its own development process under ISO/SAE 21434.

Approach

• Assessments of software work products along the entire V-model: risk analysis, requirements, architecture, design, code, tests and verification
• Confirmation reviews according to the customer’s development process
• Milestone assessments with interviews and interim reports for the development teams
• Findings with concrete guidance for the teams and proposals for the development process

Situation

New driving functions, a defined OEM process under ISO/SAE 21434 and many suppliers working in parallel.

Approach

• Threat analysis and risk assessment (TARA), security concepts and test specifications
• Delta analyses when interfaces and signals change
• A weekly guidance session for everyone involved in the project
• Coaching suppliers on SBOMs and vulnerability analyses

Situation

A European OEM sources systems from global tier-1 suppliers, including an automated-driving compute platform. Responsibilities for cybersecurity are agreed per component, before development starts rather than at release.

Approach

• Negotiated cybersecurity interface agreements (CIA) on behalf of the OEM with global tier-1 suppliers, including the supplier of an automated-driving compute platform
• Clear split of work products and responsibilities between OEM and supplier
• Onboarding of the supplier teams into the OEM’s security process
• Introduction to the OEM’s SBOM requirements

Situation

One of Germany’s largest automotive engineering service providers wanted to qualify its own specialists in automotive security, alongside their projects and close to practice.

Approach

• Modular curriculum from vehicle fundamentals to binary exploitation and fuzzing
• Classroom runs and live online runs
• Extension into an e-learning course with an exercise VM, integrated into the customer’s learning platform

Situation

Five months until the reporting obligations and a broad product portfolio to prepare.

Approach

• Product inventory and classification under the CRA product categories
• Pilot risk assessment under IEC 62443-4-1/-4-2 as a reusable template
• Role model with clear responsibilities in the product teams
• Concept for PSIRT, reporting chain and SBOM
• Roadmap planned backwards from the CRA deadlines

Situation

Connected devices used in operating theatres, with Bluetooth, CAN and USB interfaces, have to be demonstrably secure before every release.

Approach

• White-box penetration tests with source code and access to the hardware
• Review of architecture, security controls and threat model before testing
• Separate reports for the development team and as evidence for third parties
• Machine-readable findings (CSV/VEX) for vulnerability management