Quantitative Cybersecurity Risk Management for Autonomous Vehicle Systems

Today, autonomous vehicles are driving themselves in cities from Munich to San Francisco. The failure of the security controls of these vehicles could cause a danger to public safety and shake public confidence in the technology. The ability to assess the security of autonomous vehicle systems and provide assurances that they are safe to operate is critical for their implementation to be successful and accepted. This thesis explores the potential for risk management frameworks to quantitatively measure the security of autonomous vehicle systems and select the appropriate security controls for a system. The introduction begins with a short history of autonomous vehicles and a high-level overview of modern autonomous vehicles. Next is an overview of successful attacks against vehicles and an introduction to information security, risk management, and risk assessments. The methods section describes an adaptation of the National Institute of Standards and Technology (NIST) risk assessment process using quantitative methods instead of qualitative methods and an optimization algorithm for prioritizing security controls for an autonomous vehicle system. This framework provides the ability to perform both discrete calculations and Monte Carlo simulations. The results and discussion sections demonstrate the ability of quantitative risk management frameworks to model the risks present in an autonomous vehicle system and the cost-effectiveness of various security controls. As others have previously noted, we find that quantitative risk assessment methods can provide more value than qualitative methods, but often require more data (National Institute of Standards and Technology, 2012). While this thesis focuses on security risk management for autonomous vehicle systems, the same techniques can be used in supporting decisions in other areas of transportation including safety, economic/environmental modeling, and traffic management.     «

Today, autonomous vehicles are driving themselves in cities from Munich to San Francisco. The failure of the security controls of these vehicles could cause a danger to public safety and shake public confidence in the technology. The ability to assess the security of autonomous vehicle systems and provide assurances that they are safe to operate is critical for their implementation to be successful and accepted. This thesis explores the potential for risk management frameworks to quantitatively...     »