Hands-On: Cybersecurity Policy Definition

#!/usr/bin/env python3
# ISO/SAE 21434 Clause 5: Cybersecurity Policy skeleton generator

policy = {
    "title": "Automotive Cybersecurity Policy",
    "version": "2.1",
    "approved_by": "CISO",
    "review_cycle": "Annual",

    "scope": "All ECUs, software components, and connectivity systems "
             "for vehicle model line X (VehicleProgram_2026)",

    "objectives": {
        "Confidentiality": "Protect PII (location history, personal preferences) "
                           "and cryptographic material from unauthorised disclosure",
        "Integrity":       "Ensure firmware, calibration data, and safety-critical CAN "
                           "messages cannot be modified without detection",
        "Availability":    "Maintain OTA update channel and remote diagnostics "
                           "availability; tolerate DoS attempts without safety impact",
    },

    "ciso_reporting": "CISO reports directly to CEO; security budget independent of IT",

    "minimum_training_hours": {
        "Security Architect":     40,   # hours per year
        "TARA Engineer":          32,
        "Penetration Tester":     40,
        "SW Developer":           16,
        "Project Manager":         8,
        "Quality/Safety Manager":  8,
    },

    "enforcement": "Non-compliance with this policy is a project gate blocker. "
                   "All deviations require CISO written approval.",
}

import json
print(json.dumps(policy, indent=2))

#!/usr/bin/env python3
# ISO/SAE 21434 Clause 9: Asset register for TARA item definition
# CIA importance scale: 1=low, 2=moderate, 3=high, 4=critical

assets = [
    {
        "id": "A-01", "description": "ECU firmware image",
        "category": "software",
        "associated_functions": ["OTA update", "vehicle control"],
        "confidentiality": 3,  # high: reverse-engineering would expose algorithms
        "integrity": 4,        # critical: modified firmware controls safety functions
        "availability": 3,     # high: unavailable firmware prevents OTA recovery
        "data_sensitivity": "functional_safety",
    },
    {
        "id": "A-07", "description": "V2X Certificate Private Key",
        "category": "cryptographic_key",
        "associated_functions": ["V2X signing", "BSM authentication"],
        "confidentiality": 4,  # critical: exposure allows V2X message spoofing
        "integrity": 4,        # critical: must not be modified
        "availability": 2,     # moderate: V2X degrades gracefully without key
        "data_sensitivity": "cryptographic_material",
    },
    {
        "id": "A-12", "description": "Stored GPS location history",
        "category": "data",
        "associated_functions": ["navigation history", "remote services"],
        "confidentiality": 3,  # high: PII / GDPR sensitive
        "integrity": 1,        # low: historical data tampering low risk
        "availability": 1,     # low: not safety-critical
        "data_sensitivity": "PII",
    },
]

print("Asset Register:")
for a in assets:
    overall_cs_level = max(a["confidentiality"], a["integrity"], a["availability"])
    print(f"  [{a['id']}] {a['description']}")
    print(f"    Category: {a['category']} | Sensitivity: {a['data_sensitivity']}")
    print(f"    C:{a['confidentiality']} I:{a['integrity']} A:{a['availability']} → Overall CS Level: {overall_cs_level}")
    print()

#!/usr/bin/env python3
# PSIRT vulnerability disclosure SLA tracker
from datetime import date, timedelta

TRIAGE_SLA_DAYS   =  5   # acknowledge within 5 business days
CLASSIFY_SLA_DAYS = 10   # CVSS classification within 10 days
EMBARGO_DAYS      = 90   # default coordinated disclosure embargo

def handle_new_report(reporter_email: str, report_date: str, description: str) -> dict:
    disc_date = date.fromisoformat(report_date)
    return {
        "received":          report_date,
        "acknowledge_by":    str(disc_date + timedelta(days=TRIAGE_SLA_DAYS)),
        "classify_by":       str(disc_date + timedelta(days=CLASSIFY_SLA_DAYS)),
        "embargo_expires":   str(disc_date + timedelta(days=EMBARGO_DAYS)),
        "reporter":          reporter_email,
        "description":       description,
        "status":            "new",
        "actions": [
            f"1. Send acknowledgement to {reporter_email} by {disc_date + timedelta(days=TRIAGE_SLA_DAYS)}",
            f"2. CVSS classify by {disc_date + timedelta(days=CLASSIFY_SLA_DAYS)}",
            f"3. Coordinate patch timeline with reporter",
            f"4. Public disclosure after {disc_date + timedelta(days=EMBARGO_DAYS)} (or earlier by agreement)",
        ]
    }

import json
report = handle_new_report(
    reporter_email="researcher@example.com",
    report_date="2026-03-01",
    description="Stack overflow in OTA client TLS parsing when receiving malformed certificate"
)
print(json.dumps(report, indent=2))

#!/usr/bin/env python3
# CIA (Cybersecurity Interface Agreement) template generator
# Per ISO/SAE 21434 Clause 7

cia = {
    "parties": {"OEM": "VehicleCo GmbH", "Supplier": "ECU_Supplier_AG"},
    "scope": "TCU_v4.0 firmware and hardware for VehicleProgram_2026",

    "supplier_csms_requirement":
        "Supplier shall maintain ISO/SAE 21434-aligned CSMS; "
        "provide certificate from accredited body before SOP-12 months",

    "cybersecurity_deliverables": [
        {"deliverable": "TARA excerpt (TCU-relevant threat scenarios)", "due": "SOP-18 months"},
        {"deliverable": "Security requirement specification",           "due": "SOP-15 months"},
        {"deliverable": "Security test report (unit + integration)",    "due": "SOP-6 months"},
        {"deliverable": "Software BOM (SPDX format)",                  "due": "SOP-3 months + updates"},
        {"deliverable": "Penetration test report",                     "due": "SOP-3 months"},
        {"deliverable": "Vulnerability disclosure notification",        "due": "Within 48h of discovery"},
    ],

    "vulnerability_notification":
        "Supplier must notify OEM security@oem.com within 48 hours of discovering "
        "any CVE affecting delivered component, with CVSS score and affected versions",

    "right_to_audit":
        "OEM may audit supplier cybersecurity activities with 30-day notice; "
        "critical incident may trigger 48h emergency audit",

    "liability": "Supplier liable for security defects attributable to non-compliance with TSRs; "
                 "OEM liable for integration-level vulnerabilities",
}

import json
print(json.dumps(cia, indent=2))