Security and safety are different in many ways. Most importantly, security is much more dynamic. In safety, a failure rate usually doesn’t change a lot. Security doesn’t have this comfort: Discovering a new vulnerability or facing an exploit is not the exception, it is the rule. Every incident has the potential to drastically change the risk landscape. As a consequence, risks require frequent re-evaluation throughout the whole product life cycle. Threat Analysis and Risk Assessment (TARA) is one of the key activities defined in the ISO/SAE 21434. It is not very similar to the Hazard and Risk Analysis (HARA) for safety-critical systems, since it embraces the moving nature of security. This chance for exploits and need for updates indeed make it a moving target.

Recently, updatable software systems have received a potentially life-threatening impact. Especially in the automotive industry. This responsibility requires manufacturers to follow security processes. For each decision, they are required to collect evidence of acting responsibly so that they can proof they responsible acting.  ISO/SAE 21434 and UNECE WP.29 are current efforts to standardize these processes and regulate them. With the Draft of ISO 21434 being available, it is time for manufacturers to understand what changes it demands regarding their processes. For example, what documents ought to be collected.