on the principle of least 3.5 Access control and authentication access privilege M19 Organizations ensure 3.1 Security policies security procedures are 3.2 Organizational security defined and followed 3.3 Human resource security and security awareness is a security programme defining procedures  Establish security development and maintenance process including at  review, cross-check and approval gateways/ stages Specific cyber awareness and security training needs are identified for  roles, especially those in the design and engineering functions, and then implemented M20 Security controls shall be 3.5 Access control Access control rights established and implemented for remote systems to a applied to systems that  vehicle have remote access 3.8 Monitoring System monitoring for unexpected messages/behaviour  3.9 System design Apply message and device authentication techniques  Only allow a safe set of instructions to be passed to a vehicle  Use of techniques for message integrity checking, such as hashing, secure  protocols and packet filtering Use of techniques for protecting against replay attacks, such as  timestamping or use of a freshness value Network segregation applied  3.10 Software security Software and hardware testing to reduce vulnerabilities  3.12 Security incident management 3.13 Information exchange M21 Software shall be security 3.8 Monitoring assessed, authenticated and 3.9 System design integrity protected 3.10 Software security 3.13 Information exchange M22 Security controls shall be 3.8 Monitoring applied to external System monitoring for unexpected messages/ behaviour  interfaces 3.9 System design Apply message and device authentication techniques  Only allow a safe set of instructions to be passed to a vehicle  Enforce boundary defences and access control between external interfaces  and other vehicle systems Systems are hardened to limit access  3.10 Software security 3.12 Security incident management 3.13 Information exchange M23 Cybersecurity best 3.2 Organisational security is an active programme in place to identify critical vulnerabilities practices for software and  Organizations plan for how to maintain security over the lifetime of their hardware development  systems be followed 3.6 Cryptographic security 3.7 Physical and environmental security
on the principle of least access privilege 3.5 Access control and authentication M19 Organizations ensure security procedures are defined and followed 3.1 Security policies 3.2 Organizational security 3.3 Human resource security and security awareness  is a security programme defining procedures  Establish security development and maintenance process including at review, cross-check and approval gateways/ stages  Specific cyber awareness and security training needs are identified for roles, especially those in the design and engineering functions, and then implemented M20 Security controls shall be applied to systems that have remote access 3.5 Access control  Access control rights established and implemented for remote systems to a vehicle 3.8 Monitoring  System monitoring for unexpected messages/behaviour 3.9 System design  Apply message and device authentication techniques  Only allow a safe set of instructions to be passed to a vehicle  Use of techniques for message integrity checking, such as hashing, secure protocols and packet filtering  Use of techniques for protecting against replay attacks, such as timestamping or use of a freshness value  Network segregation applied 3.10 Software security  Software and hardware testing to reduce vulnerabilities 3.12 Security incident management 3.13 Information exchange M21 Software shall be security assessed, authenticated and integrity protected 3.8 Monitoring 3.9 System design 3.10 Software security 3.13 Information exchange M22 Security controls shall be applied to external interfaces 3.8 Monitoring  System monitoring for unexpected messages/ behaviour 3.9 System design  Apply message and device authentication techniques  Only allow a safe set of instructions to be passed to a vehicle  Enforce boundary defences and access control between external interfaces and other vehicle systems  Systems are hardened to limit access 3.10 Software security 3.12 Security incident management 3.13 Information exchange M23 Cybersecurity best practices for software and hardware development be followed 3.2 Organisational security  is an active programme in place to identify critical vulnerabilities  Organizations plan for how to maintain security over the lifetime of their systems 3.6 Cryptographic security 3.7 Physical and environmental security
ECE-TRANS-WP29-GRVA-2019-02e.docx