ISO 21434 and the Real Automotive Attack Surface

ISO 21434 gives the automotive industry a structured way to reason about cybersecurity risk across the vehicle lifecycle, and Threat Analysis and Risk Assessment work is now a standard deliverable for most ECU programs. The framework is sound. The quality of the analysis inside it varies enormously.

A common gap we see is TARA work performed entirely on paper, based on architecture diagrams and interface specifications, without any hands-on testing of the actual ECU, its CAN and SomeIP interfaces, or its diagnostic services. Documented assumptions about what an attacker can and cannot reach do not always hold once you are looking at real UDS responses on the bench.

The most useful TARA updates we contribute come after adversarial testing: confirming which diagnostic sessions are actually reachable without authentication, whether SecOC configuration matches what the specification assumes, and whether the OTA update chain enforces the rollback and signature checks the risk assessment credits it for.

Compliance and security are related but not identical goals. A TARA that satisfies an audit checklist and a threat model that reflects how the vehicle actually behaves under attack are both necessary, and closing the gap between them is where most of the real risk reduction happens.