Requirements for a Cybersecurity Case Approach for the Assurance of Future Connected and Automated Vehicles

Cybersecurity is an issue of increasing concern for emerging connected vehicles. Ensuring public trust in future connected and automated vehicles will require very high levels of confidence in their dependability, which will include cybersecurity assurance. In functional safety engineering, the safety case has become a widely used approach to describing and documenting safety assurance arguments and their supporting evidence. The use of a similar security case can also be considered in cybersecurity engineering, but there are significant differences between safety and cybersecurity. Cybersecurity impacts include, but are not limited to, possible safety issues. Furthermore, the cybersecurity threats arise from the ingenuity of human attackers, and available technology, with the result that they are constantly evolving. This paper proposes the use of an assurance case approach for cybersecurity and outlines the particular requirements that are considered to be necessary for the development of such a cybersecurity case.