Residual Risk Evaluation – Necessary Iteration

Posted: September 5, 2024

In this article

Jiannan Wang

The cybersecurity standard ISO/SAE 21434 illustrates the development workflow in the Automotive concept phase. Cybersecurity requirements are derived from goals based on the mitigations of TARA (Threat Analysis and Risk Assessment) processes. It does however not refer to how to evaluate the effectiveness and adequacy of the successful implementation of those requirements. To handle such cases, re-evaluation of risks with consideration of implemented requirements becomes a necessity.

SystemWeaver’s cybersecurity module provides not only the initial evaluation of risks but also a second evaluation after the definition of cybersecurity requirements. This offers a way for residual risk evaluation in the early concept phase, as a confirmation of the adequacy of deployed controls, rather than pushing it to verification and validation.

 

You may also be interested in

  • White Paper: Model-Based Systems Engineering

    Download this White Paper as a PDF Unmanaged Complexity is the Real Bottleneck for Innovation System complexity has exploded. The industries that build the world's most complex, safety-critical products have undergone a fundamental shift over the past decade: products have become software-defined. The challenge now is maintaining consistency and quality while hundreds [...]

  • Subsystems and meta models

    White Paper: Subsystems, Meta-Models and Architecture

    Download this White Paper as a PDF Executive summary The meta-model supports the architecture without defining it. Clear, cohesive subsystems with explicit interfaces are what make model-based systems engineering usable at scale. This white paper distills ten practical insights drawn directly from SystemWeaver experts and practitioners, both at SystemWeaver and customers to SystemWeaver. [...]

  • Marcus and Anders interview

    5 Realities of AI in Modern Cybersecurity

    Every vendor in security claims AI changes everything. Ask the engineers actually building these systems and a different story comes up: a context gap. The AI returns a threat analysis that reads well and sounds confident but has little connection to the product.  That is where a recent conversation with Anders Hallgren and Marcus [...]