TARA in practice with the Nine2Five TARA Navigator

A risk analysis is a procedure in which findings are checked and related to each other in a structured and step-by-step manner. The Nine2Five TARA Navigator includes nine steps and five targets. 

In this video we will explain this procedure to you. Think of the TARA procedure like a string of pearls: Like another pearl, we always add another analysis or identification step to the previous, from the very left to the right of the string. With each step you only must think about one topic.

Before you can start with your TARA, you must define your item first. This is a sub-system or a set of sub-systems, for example a function on vehicle level or a control unit. Describe the environment of this system, its functions, interactions, and what interfaces there are. 

An asset belongs to your item – and it is worth protecting! It defines a property crucial for a stakeholder. Take for example the internet communication channel – hardly any electronic system is conceivable without this asset. Encryption keys or safety goals are further examples.

However, the asset is very interesting for two parties: for your stakeholder, who thus gets the required functionality, as well as for an attacker to compromise your system.

Therefore, the primary task is to enumerate all your assets.  

What can go wrong? Systematically question each of the assets in terms of confidentiality, integrity, and availability as well as non-repudiation, authenticity, and authorization. The ISO/SAE 21434 standard describes these attributes as cybersecurity properties.

Cybersecurity properties

• Confidentiality
• Integrity
• Availability

We recommend to include three additional cybersecurity properties with your investigation. 

• Non-repudiation
• Authenticity
• Authorization?

You identify now the damage scenarios by evaluation what can happen if cybersecurity properties or assets are compromised in terms of the cybersecurity properties.

This was the asset identification in short.

Here we evaluate the damage scenarios according to what consequences they may have for your stakeholders. This includes functional safety, finance, operations, and privacy. Tables help to determine the severity of the damage. The catch here is that not every stakeholder is equally affected by every damage scenario.

By the way, we have also achieved our first target: we’ve rated the impact of damage.

In the first step we have spoken about the potential damage for example caused by a compromised cybersecurity property. Now we look at the selected assets again and ask what threat scenario may arise. To make this clear we take a compromised switch as an example. This damage scenario results in a possible threat scenario, namely caused by spoofing or flooding the CAN bus.

In practice, not every attack can be conducted. Maybe encryption makes it unlikely. Therefore, we now look at the actual attack potential. There are five key parameters for your evaluation: elapsed time, the required expertise and product know-how as well as equipment and the window of opportunity. 

Once we know whether an attacker can conduct an attack successfully, we have achieved target number two: Rating of the feasibility of an attack.

This is also called Ease of attack.

For this step we combine the results of both targets – impact rating (1. target) and attack feasibility rating (2. target).

We therefore have two ratings that determine the risk value:

• the impact of the associated damage scenario and
• the attack feasibility of the attack paths.

Risk value = Impact x Attack feasibilty

However, we usually have different stakeholders. Some of them assess the risks very differently. That makes things tricky – we may have to apply a different risk value for each stakeholder.

In any case, we have achieved the third target: we know the risk value.

Once the risks are on the table, the question is how to deal with them.

There are basically a set of options for dealing with risks:

1. avoidance
2. reduction 
3. sharing or transfer to third parties
4. acceptance

A proper mode for risk reduction is the specification of a security control (technical or organizational) or the introduction of redundancy. Third parties interested in risk transfers are insurance companies. Now decide, how you want to manage the risk.

Please keep in mind: It is very tricky to judge how effective a cybersecurity control is. However, this is where every risk assessment stands and falls.

The cybersecurity goals and claims are derived from

• the results of the TARA and
• your decisions on how the risks should ultimately be dealt with.

If you decide that you want to avoid a risk, then you go back to square one – you may consider an alternative technical solution.

The cybersecurity goals form the fourth target of the TARA. 

Well, that takes us through all the nine steps I recommend performing. You have seen that all steps build on each other. Like a string of pearls, the next step usually refers to its predecessor and evaluates it or develops it further. 

Define your item or your system before you start preparing the TARA.