Examples of mitigation for human actions “Unintended ” Examples of mitigation to the threats which are related to human are listed in “Unintended actions” Table B4. Table B4 Examples of mitigation to the threats which are related to human “Unintended actions” Table 1 Threats relating to human “Unintended Ref Mitigation reference actions” 14.1 Misconfiguration of equipment by M17 Measures shall be implemented for defining and maintenance community or owner during controlling maintenance procedures installation/repair/use causing unintended consequences 14.2 Erroneous use or administration of devices and systems (inc. OTA updates) 15.1 Innocent victim (e.g. owner, operator or M18 Measures shall be implemented for defining and maintenance engineer) is tricked into taking controlling user roles and access privileges, an action to unintentionally load malware or based on the principle of least access privilege enable an attack 15.2 Defined security procedures are not M19 Organizations shall ensure security procedures followed are defined and followed Examples of mitigation for connectivity and connections “External ” Examples of mitigation to the threats which are related to connectivity and “external connections are listed in Table B5. ” Table B5 Examples of mitigation to the threats which are related to “external connectivity and connections” Table 1 Threats to “External connectivity” Ref Mitigation reference 16.1 Manipulation of functions designed to M20 Security controls shall be applied to systems remotely operate vehicle systems, such as that have remote access remote key, immobiliser, and charging pile 16.2 Manipulation of vehicle telematics (e.g. manipulate temperature measurement of sensitive goods, remotely unlock cargo doors)
Examples of mitigation for “Unintended human actions ” Examples of mitigation to the threats which are related to “Unintended human actions” are listed in Table B4. Table B4 Examples of mitigation to the threats which are related to “Unintended human actions” Table 1 reference Threats relating to “Unintended human actions” Ref Mitigation 14.1 Misconfiguration of equipment by maintenance community or owner during installation/repair/use causing unintended consequences M17 Measures shall be implemented for defining and controlling maintenance procedures 14.2 Erroneous use or administration of devices and systems (inc. OTA updates) 15.1 Innocent victim (e.g. owner, operator or maintenance engineer) is tricked into taking an action to unintentionally load malware or enable an attack M18 Measures shall be implemented for defining and controlling user roles and access privileges, based on the principle of least access privilege 15.2 Defined security procedures are not followed M19 Organizations shall ensure security procedures are defined and followed Examples of mitigation for “External connectivity and connections ” Examples of mitigation to the threats which are related to “external connectivity and connections ” are listed in Table B5. Table B5 Examples of mitigation to the threats which are related to “external connectivity and connections” Table 1 reference Threats to “External connectivity” Ref Mitigation 16.1 Manipulation of functions designed to remotely operate vehicle systems, such as remote key, immobiliser, and charging pile M20 Security controls shall be applied to systems that have remote access 16.2 Manipulation of vehicle telematics (e.g. manipulate temperature measurement of sensitive goods, remotely unlock cargo doors)
GRVA-01-17.docx