Chip lifecycle / Vehicle cybersecurity lifecycle / Implementation & Integration Verification

Implementation & Integration Verification

Building the security functions and the code around them under secure design and coding rules, checking them with reviews, static analysis, unit and integration testing, interface and fuzz testing, and analysing the development for weaknesses, so that each cybersecurity requirement is shown to be met before the item is validated.

Where this stage sits

This stage with its neighbours. Each row is a discipline active here, shaded by how mature its work is by the end of each stage.

Stage

^A05 Cybersecurity Specification & Design

^D06 Implementation & Integration VerificationYou are here

^A07 Cybersecurity Validation & Penetration Testing

Organisation, approval and support milestones

Cybersecurity engineering milestones

CCCybersecurity concept approved DACybersecurity design approved IVIntegration verified VCCybersecurity validation complete ACCybersecurity assessment complete

Cybersecurity management and governance^A

0.5

0.8

Supplier and interface management^A

0.5

0.8

Item definition, concept and architecture^A

0.8

1.0

Threat analysis and risk assessment^A

0.8

1.0

Hardware security and chip suppliers^A

0.5^A

0.8^D

1.0

Integration verification and testing^A

0.5

0.8^A

1.0

Validation and penetration testing^A

0.5

0.8

1.0

Type approval and homologation^A

0.5

0.8

Production security^A

0.3

0.5

0.8

Software update management^A

0.5

0.8

Monitoring and vulnerability management^O

0.0

Key0.0Planned0.3Outlined0.5Analysed0.8Feature complete1.0CompleteFreezeFrozenFaded block: still at the step shown before it, Held below Complete or Maintained under change control once complete or frozenFreeze or sign-off pointMilestone for one item; the rest of the work carries onMilestone gateYou are here: Implementation & Integration VerificationAI impactDisruption (red)Augmentation (blue)Opportunity (green)How AI is changing the workWhat the steps mean What the codes mean

Show this chart as a list

Stages

Organisation, approval and support milestones

Cybersecurity engineering milestones

Disciplines

Cybersecurity management and governance^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Concept and specification reviews held; the plan, tailoring and records are current and the evidence the cybersecurity case needs is mapped to its sources.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Verification and validation results reviewed against the plan; the evidence for the cybersecurity case is complete in draft and the independent assessment is arranged.
- Cybersecurity Validation & Penetration Testing: maturity 0.8, Feature complete. Verification and validation results reviewed against the plan; the evidence for the cybersecurity case is complete in draft and the independent assessment is arranged.
Supplier and interface management^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Supplier responsibilities checked against the TARA and the concept, and the supplier cybersecurity requirements flowed down from the specification and accepted by each supplier.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Supplier deliveries arriving and their evidence reviewed against the requirements; gaps tracked with each supplier.
- Cybersecurity Validation & Penetration Testing: maturity 0.8, Feature complete. Supplier deliveries arriving and their evidence reviewed against the requirements; gaps tracked with each supplier.
Item definition, concept and architecture^A
- Cybersecurity Specification & Design: maturity 0.8, Feature complete. Cybersecurity specification and architecture complete and verified against the concept, with requirements allocated to hardware, software, production and suppliers; changes from implementation still come in.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Cybersecurity specification and architecture complete and verified against the concept, with requirements allocated to hardware, software, production and suppliers; changes from implementation still come in.
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. Specification confirmed by integration verification and the goals and claims confirmed by validation; the concept and specification are the baseline for the cybersecurity case.
Threat analysis and risk assessment^A
- Cybersecurity Specification & Design: maturity 0.8, Feature complete. TARA refined for the design: new assets, interfaces and attack paths from the specifications analysed, with every new risk treated.
- Implementation & Integration Verification: maturity 0.8, Feature complete. TARA refined for the design: new assets, interfaces and attack paths from the specifications analysed, with every new risk treated.
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. TARA confirmed by verification and penetration testing and the residual risk accepted; afterwards it is updated for every change and every field finding.
Hardware security and chip suppliers^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Hardware security specification and key management concept approved against the cybersecurity specification; the build has not started.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Hardware security functions built and verified at integration and the chip security manual released; findings from penetration testing still being fixed.
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. Hardware security confirmed by validation and penetration testing on the item; the lock configuration is prepared for production.
Software security^D
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Software security and secure communication specifications approved against the cybersecurity specification; implementation has not started.^A
- Implementation & Integration Verification: maturity 0.8, Feature complete. Security software implemented under secure coding rules, reviewed, analysed and verified at integration; fixes from verification and penetration testing continue.^D
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. Security software confirmed by validation and penetration testing, with no open weakness above the agreed level.
Integration verification and testing^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Verification plan agreed for every cybersecurity requirement, with test cases, fuzz targets and benches specified from the specifications.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Requirement tests, fuzzing and vulnerability scans run on the integrated item; integration verified with findings dispositioned, and fixes from penetration testing still being re-verified.^A
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. Every cybersecurity requirement verified on the validated item, and the security regression suite in place for updates.
Validation and penetration testing^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Validation plan and penetration test scope agreed against the goals, claims and attack paths, with rules of engagement and the test environment specified.
- Implementation & Integration Verification: maturity 0.8, Feature complete. Test environment ready and penetration testing started on integration builds; early findings fed back to design and verification.
- Cybersecurity Validation & Penetration Testing: maturity 1.0, Complete. Cybersecurity goals shown to be achieved, penetration testing complete with findings dispositioned and residual risk accepted; the cybersecurity case is assembled from the evidence.
Type approval and homologation^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Evidence map agreed: each regulatory requirement linked to the work product and the stage that will provide it.
- Implementation & Integration Verification: maturity 0.5, Analysed. Evidence map agreed: each regulatory requirement linked to the work product and the stage that will provide it.
- Cybersecurity Validation & Penetration Testing: maturity 0.8, Feature complete. Type approval documentation complete in draft, waiting for the validation results, the cybersecurity case and the assessment.
Production security^A
- Cybersecurity Specification & Design: maturity 0.3, Outlined. Production security needs outlined from the design: key and certificate provisioning, end-of-line configuration, debug locking and protection of production data.
- Implementation & Integration Verification: maturity 0.5, Analysed. Production cybersecurity control plan drafted and the provisioning process specified against the TARA.
- Cybersecurity Validation & Penetration Testing: maturity 0.8, Feature complete. Provisioning, end-of-line configuration and locking set up and trialled on production samples.
Software update management^A
- Cybersecurity Specification & Design: maturity 0.5, Analysed. Secure update concept agreed: signing, verification, installation and recovery, with software identification for type approval.
- Implementation & Integration Verification: maturity 0.5, Analysed. Secure update concept agreed: signing, verification, installation and recovery, with software identification for type approval.
- Cybersecurity Validation & Penetration Testing: maturity 0.8, Feature complete. Update path built and tested end to end on integrated items, and the SUMS processes written for the vehicle type.
Monitoring and vulnerability management^O
- Cybersecurity Validation & Penetration Testing: maturity 0.0, Planned. Monitoring lead named and the item added to the organisation's monitoring scope, with the team and effort estimated; no monitoring approach yet.

Register or sign in to read on

The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.