ISO 21434: Cybersecurity terms

So far we've walked the whole cybersecurity lifecycle from a distance. Now let's zoom all the way in on the one clause where the risk actually gets sized up. In ISO S A E twenty-one four thirty-four, that job belongs to the threat analysis and risk assessment — everyone just calls it TARA — and it lives in clause fifteen. This is the engine room.

Part of the Critical Systems Analysis functional-safety series on ISO 21434.

In this episode:

• Let's put the subject on the table.
• Move one, name what can go wrong.
• Before we size anything, know where you're standing.
• Move two, and it's the heart of the whole thing.
• Take the first dial, impact.
• The second dial, attack feasibility — how realistic the attack is, rated from very low up to high.

Reference: Clause 15 of ISO/SAE 21434:2021 contains the TARA methods. The step sequence used here (asset identification, threat scenario identification, impact rating, attack path analysis, a

More in this series: IEC 62443 — Industrial Cybersecurity

Explore more from Critical Systems Analysis.

• Partner with us
• Follow on LinkedIn
• Visit our website
• Read our feature on Automate.org

All shows on Apple Podcasts: AI & ML Safety | Fault Tree Analysis | FS Assessment | Safety Analysis | IEC 61508 | IEC 62443 | ISO 10218 | ISO 12100 | ISO 13849 | ISO 26262 | ISO/PAS 8800 | ISO 26262-11 | V-Model | UL 4600.