TARA: Threat Analysis and Risk Assessment
We perform and review Threat Analysis and Risk Assessments following ISO/SAE 21434 for automotive and embedded systems. Assets, damage and threat scenarios and attack paths are derived from the real interfaces, buses and software components, and each risk is rated for impact and attack feasibility, producing a documented TARA traceable from asset to cybersecurity requirement.
- Assets
- Define the item boundary and the assets with their cybersecurity properties.
- Threats
- Identify damage scenarios, threat scenarios and attack paths.
- Feasibility
- Rate impact and attack feasibility for each path.
- Risk
- Determine risk and derive cybersecurity goals for treatment.
Scope
New or retrofit TARA for an item or ECU
Review of an existing TARA
Repeatable TARA method and templates
Starting information
Item definition, architecture and interface descriptions, operational environment and any earlier risk assessments.
Applicable framework
The analysis follows the TARA methods of ISO/SAE 21434:2021. Where a product also falls under the Cyber Resilience Act, the risk assessment can inform its technical documentation, but the two obligations are assessed separately.
Discuss your product
Tell us about the product, its current stage and the decision you need to make.
Discuss your product