In this work, we present an approach to support penetration tests by combining safety and security analyses to enhance automotive security testing. Our approach includes a new way to combine safety and threat analyses to derive possible test cases. We reuse outcomes of a performed safety analysis as the input for a threat analysis. We show systematically how to derive test cases, and we present the applicability of our approach by deriving and performing test cases for a penetration test of an automotive electronic control unit (ECU). Therefore, we selected an airbag control unit due to its safety-critical functionality. During the penetration test, the selected control unit was installed on a test bench, and we were able to successfully exploit a discovered vulnerability, causing the detonation of airbags.
Enhancement of Automotive Penetration Testing with Threat Analyses Results
Sae Int. J. Transp. Cyber. and Privacy
02.11.2018
22 pages
Aufsatz (Konferenz)
Englisch
Enhanced Penetration Testing for Automotive Cybersecurity
British Library Conference Proceedings | 2022
|Enhanced Penetration Testing for Automotive Cybersecurity
SAE Technical Papers | 2022
|Automotive Information Security: A threat with an end?
British Library Conference Proceedings | 2007
|