Software Security- Improvement Scheme of Security Development Capability for Automobile Industry

Strategies and realization of the improvement of security development capability in the new four modernizations of auto industry.

Challenges

Policies

Domestic and international standards and regulations (ISO/SAE 21434, 26262, R155, R156) are being issued so rapidly that enterprises are tired of coping with them.

Modes

The development mode is gradually transforming from traditional V-model to DevOps, so software security and compliance need to keep up with the change of development.

Security

A lot of work has been done in security protection such as IPS, IDS and security gateway, but development security capability is still very weak.

Introduction of Solutions

Evaluation of Developmnet Security Capability

• Analyzes the current gap between enterprises in development security capabilities based on the requirements of industry standards and regulations.
• Make improvement plans according to business objectives, such as 26262 grade certification , CSMS, VTA and ASPICE grade certification.

Development of Development Security Capability

For the improvement plan, we provide including but not limited to the following contents:

• Formulation or interpretation of OEM safety requirements
• TARA
• ASPICE Process Construction
• Coding specification landing
• Fuzzy test and dynamic test
• Safe and compliant use of open source components

Third-party Safety Test for Evaluation

Safety testing from a third-party perspective can be provided to assist enterprises to evaluate the effectiveness of safety construction. And we provide including but not limited to the following contents:

• Permeability test
• Fuzz testing
• Et cetera

Advantages

Industry Experts’ Experience

• ASPICE appraiser
• First-hand experience in safety construction of international big factories
• MISRA standard judge member

Mature Tool Chain

• Complete development security tool chain to help customers meet compliance needs
• Assists customers throughout the use of tools
• CI/CD seamless, both accurate and efficient