ISO_SAE_DIS_21434_(E)_ISOSAEDIS21434资源-CSDN下载

需积分: 50 45 浏览量 2022-03-22 10:09:14 上传评论 1 收藏 4.64MB PDF 举报

ISO/SAE DIS 21434 是一个标准草案，专注于道路车辆的网络安全工程，由国际标准化组织（ISO）和美国汽车工程师学会（SAE）联合制定。这个标准属于工业、技术、商业和用户领域的重要参考，同时也可能被考虑用于国家法规的引用标准。草案在2020年2月12日开始投票，至2020年5月6日结束，目前正处于评论和批准阶段，因此其内容可能会有所变更，直至正式发布为国际标准。标准的全称是“Road vehicles — Cybersecurity engineering”，它旨在为汽车行业提供一套全面的框架，以确保车辆在设计、开发、制造、运行和服务过程中的网络安全。随着汽车行业的快速发展，尤其是智能网联汽车的普及，网络安全成为了不可或缺的一环。该标准的目的是减少车辆及其相关系统因网络攻击而引发的风险，保护乘客的安全和隐私。 ISO/SAE DIS 21434 涵盖了多个关键知识点： 1. **风险管理**：标准强调在整个车辆生命周期内进行持续的网络安全风险评估，包括识别潜在威胁、分析脆弱性、评估风险，并采取相应的缓解措施。 2. **安全设计**：要求在汽车系统的架构设计阶段就考虑到网络安全，采用安全设计原则，如最小权限原则、安全性隔离、冗余和多样性等。 3. **安全开发**：推广使用安全开发流程，例如威胁建模、代码审查、安全测试以及漏洞管理，确保软件和硬件组件在开发过程中就具有抵御网络攻击的能力。 4. **供应链安全**：规定供应商应遵守一定的网络安全标准，确保零部件和软件的安全性，同时建立供应链的透明度和可追溯性。 5. **事件响应和应急计划**：要求建立有效的网络安全事件响应机制，包括事件检测、报告、分析和恢复，以便快速应对网络安全事件。 6. **隐私保护**：考虑个人数据的保护，要求设计和实施策略以防止数据泄露，符合相关数据保护法规。 7. **持续监控和更新**：标准指出，车辆应具备持续监控网络安全状态的能力，并能够接收和应用安全更新，以修复新发现的漏洞。 8. **合规性评估**：提出对车辆及其系统进行定期的网络安全合规性评估，确保持续符合标准要求。 9. **知识产权与专利**：注意到标准可能涉及到的专利问题，鼓励收到草案的各方在提交评论时，一并提供相关专利信息和证明材料。 10. **国际合作**：由于网络安全是全球性问题，该标准的实施需要国际间的协调和合作，以确保全球市场的兼容性和一致性。 ISO/SAE DIS 21434 是一个针对道路车辆网络安全的关键标准，它为汽车行业提供了一套全面的方法论，旨在通过系统化的方法提高汽车的网络安全水平，减少潜在风险，并保护用户的隐私和安全。随着智能交通系统的不断发展，这个标准将对汽车行业的未来发展起到至关重要的指导作用。

资源推荐

资源详情

资源评论

ISO/SAE International 2020

Road vehicles — Cybersecurity engineering

ICS: 43.040.15

Reference number

ISO/SAE DIS 21434:2020(E)

DRAFT INTERNATIONAL STANDARD

ISO/SAE DIS 21434

ISO/TC 22/SC 32 Secretariat: JISC

Voting begins on: Voting terminates on:

2020-02-12 2020-05-06

THIS DOCUMENT IS A DRAFT CIRCULATED

FOR COMMENT AND APPROVAL. IT IS

THEREFORE SUBJECT TO CHANGE AND MAY

NOT BE REFERRED TO AS AN INTERNATIONAL

STANDARD UNTIL PUBLISHED AS SUCH.

IN ADDITION TO THEIR EVALUATION AS

BEING ACCEPTABLE FOR INDUSTRIAL,

TECHNOLOGICAL, COMMERCIAL AND

USER PURPOSES, DRAFT INTERNATIONAL

STANDARDS MAY ON OCCASION HAVE TO

BE CONSIDERED IN THE LIGHT OF THEIR

POTENTIAL TO BECOME STANDARDS TO

WHICH REFERENCE MAY BE MADE IN

NATIONAL REGULATIONS.

RECIPIENTS OF THIS DRAFT ARE INVITED

TO SUBMIT, WITH THEIR COMMENTS,

NOTIFICATION OF ANY RELEVANT PATENT

RIGHTS OF WHICH THEY ARE AWARE AND TO

PROVIDE SUPPORTING DOCUMENTATION.

This document is circulated as received from the committee secretariat.

ISO/SAE DIS 21434:2020(E)

               

may be reproduced, or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or





 

CP 401 • Ch. de Blandonnet 8 400 Commonwealth Dr.

CH-1214 Vernier, Geneva Warrendale, PA, USA 15096

Phone: +41 22 749 01 11 Phone: 877-606-7323 (inside USA and Canada)

 

 

Website: www.iso.org Email: CustomerServ[email protected]

Website: www.sae.org

Published in Switzerland by ISO, published in the USA by SAE International

ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 2 of 108

CONTENTS

1. SCOPE .................................................................................................................................................. 10

2. NORMATIVE REFERENCES ............................................................................................................... 10

3. TERMS AND ABBREVIATIONS ........................................................................................................... 10

3.1 Terms and Definitions ........................................................................................................................... 10

3.2 Abbreviated Terms ................................................................................................................................ 14

4. GENERAL CONSIDERATIONS ........................................................................................................... 14

5. OVERALL CYBERSECURITY MANAGEMENT ................................................................................... 16

5.1 General.................................................................................................................................................. 16

5.2 Objectives ............................................................................................................................................. 16

5.3 Inputs..................................................................................................................................................... 17

5.3.1 Prerequisites ......................................................................................................................................... 17

5.3.2 Further Supporting Information ............................................................................................................. 17

5.4 Requirements and Recommendations .................................................................................................. 17

5.4.1 Cybersecurity Governance ................................................................................................................... 17

5.4.2 Cybersecurity Culture ............................................................................................................................ 18

5.4.3 Cybersecurity Risk Management .......................................................................................................... 19

5.4.4 Organizational Cybersecurity Audit ....................................................................................................... 19

5.4.5 Information Sharing ............................................................................................................................... 20

5.4.6 Management Systems .......................................................................................................................... 20

5.4.7 Tool Management ................................................................................................................................. 21

5.4.8 Information Security Management ........................................................................................................ 21

5.5 Work Products ....................................................................................................................................... 21

6. PROJECT DEPENDENT CYBERSECURITY MANAGEMENT ........................................................... 22

6.1 General.................................................................................................................................................. 22

6.2 Objectives ............................................................................................................................................. 22

6.3 Inputs..................................................................................................................................................... 23

6.3.1 Prerequisites ......................................................................................................................................... 23

6.3.2 Further Supporting Information ............................................................................................................. 23

6.4 Requirements and Recommendations .................................................................................................. 23

6.4.1 Cybersecurity Responsibilities and Their Assignment .......................................................................... 23

6.4.2 Cybersecurity Planning ......................................................................................................................... 23

6.4.3 Tailoring of the Cybersecurity Activities ................................................................................................ 24

6.4.4 Reuse .................................................................................................................................................... 25

6.4.5 Component Out of Context ................................................................................................................... 26

6.4.6 Off-the-Shelf Component ...................................................................................................................... 26

6.4.7 Cybersecurity Case ............................................................................................................................... 26

6.4.8 Cybersecurity Assessment.................................................................................................................... 26

6.4.9 Release for Post-Development ............................................................................................................. 28

6.5 Work Products ....................................................................................................................................... 29

7. CONTINUOUS CYBERSECURITY ACTIVITIES ................................................................................. 29

7.1 General.................................................................................................................................................. 29

7.2 Objectives ............................................................................................................................................. 29

7.3 Cybersecurity Monitoring ...................................................................................................................... 29

7.3.1 Inputs..................................................................................................................................................... 29

7.3.2 Requirements and Recommendations .................................................................................................. 30

7.3.3 Work Products ....................................................................................................................................... 30

7.4 Cybersecurity Event Assessment ......................................................................................................... 30

7.4.1 Inputs..................................................................................................................................................... 30

7.4.2 Requirements and Recommendations .................................................................................................. 31

7.4.3 Work Products ....................................................................................................................................... 31

ISO/SAE DIS 21434:2020(E)

ISO/SAE INTERNATIONAL ISO/SAE 21434 DRAFT Page 3 of 108

7.5 Vulnerability Analysis ............................................................................................................................ 31

7.5.1 Inputs..................................................................................................................................................... 31

7.5.2 Requirements and Recommendations .................................................................................................. 31

7.5.3 Work Products ....................................................................................................................................... 32

7.6 Vulnerability Management .................................................................................................................... 32

7.6.1 Inputs..................................................................................................................................................... 32

7.6.2 Requirements and Recommendations .................................................................................................. 32

7.6.3 Work Products ....................................................................................................................................... 33

8. RISK ASSESSMENT METHODS ......................................................................................................... 33

8.1 General.................................................................................................................................................. 33

8.2 Objectives ............................................................................................................................................. 34

8.3 Asset Identification ................................................................................................................................ 34

8.3.1 Inputs..................................................................................................................................................... 34

8.3.2 Requirements and Recommendations .................................................................................................. 34

8.3.3 Work Products ....................................................................................................................................... 35

8.4 Threat Scenario Identification ............................................................................................................... 35

8.4.1 Inputs..................................................................................................................................................... 35

8.4.2 Requirements and Recommendations .................................................................................................. 35

8.4.3 Work Products ....................................................................................................................................... 36

8.5 Impact Rating ........................................................................................................................................ 36

8.5.1 Inputs..................................................................................................................................................... 36

8.5.2 Requirements and Recommendations .................................................................................................. 36

8.5.3 Work Products ....................................................................................................................................... 37

8.6 Attack Path Analysis ............................................................................................................................. 37

8.6.1 Inputs..................................................................................................................................................... 37

8.6.2 Requirements and Recommendations .................................................................................................. 37

8.6.3 Work Products ....................................................................................................................................... 38

8.7 Attack Feasibility Rating ........................................................................................................................ 39

8.7.1 Inputs..................................................................................................................................................... 39

8.7.2 Requirements and Recommendations .................................................................................................. 39

8.7.3 Work Products ....................................................................................................................................... 40

8.8 Risk Determination ................................................................................................................................ 40

8.8.1 Inputs..................................................................................................................................................... 40

8.8.2 Requirements and Recommendations .................................................................................................. 40

8.8.3 Work Products ....................................................................................................................................... 40

8.9 Risk Treatment Decision ....................................................................................................................... 40

8.9.1 Inputs..................................................................................................................................................... 40

8.9.2 Requirements and Recommendations .................................................................................................. 41

8.9.3 Work Products ....................................................................................................................................... 41

9. CONCEPT PHASE ............................................................................................................................... 41

9.1 General.................................................................................................................................................. 41

9.2 Objectives ............................................................................................................................................. 42

9.3 Item Definition ....................................................................................................................................... 42

9.3.1 Inputs..................................................................................................................................................... 42

9.3.2 Requirements and Recommendations .................................................................................................. 42

9.3.3 Work Products ....................................................................................................................................... 43

9.4 Cybersecurity Goals .............................................................................................................................. 43

9.4.1 Inputs..................................................................................................................................................... 43

9.4.2 Requirements and Recommendations .................................................................................................. 44

9.4.3 Work Products ....................................................................................................................................... 45

9.5 Cybersecurity Concept .......................................................................................................................... 45

9.5.1 Inputs..................................................................................................................................................... 45

9.5.2 Requirements and Recommendations .................................................................................................. 46

9.5.3 Work Products ....................................................................................................................................... 46

10. PRODUCT DEVELOPMENT ................................................................................................................ 46

10.1 General.................................................................................................................................................. 46

10.2 Objectives ............................................................................................................................................. 49

10.3 Inputs..................................................................................................................................................... 49

10.3.1 Prerequisites ......................................................................................................................................... 49

10.3.2 Further Supporting Information ............................................................................................................. 50

ISO/SAE DIS 21434:2020(E)