サイバー攻撃に防衛隊を組織教育

# 工場を襲うサイバー攻撃に防衛隊を組織教育

https://researchmap.jp/blogs/blog_entries/view/100178/fb1984ed5118ab7aa6b10a591d4a4283

未来2018年1月号 月と鏡集　小川清 p.86 あられ（米菓）一部事後推敲編集済
あられにはチーズが合うと人気出る酒のつまみと三時のおやつ
米の菓子あられ、せんべい、おかき、もち製法特許抄録作製
Food Japan展示会来て議論する自動化機械動作と工夫
量産し市場に溢れりゃ値が下がる需要に見合う自動化必定
工場を襲うサイバー攻撃に防衛隊を組織教育
AIもIoTも略号だ意味full spelling気にせず話す
百均で商品見ると胃が痛む「食べて下さい」「自動化急げ」

# サイバー攻撃
2020年から平日は自動車関連ソフトに専念。
サイバー攻撃対応教育も自動車に絞っていることを仮定する。

## 1. ISO/SAE 21434:2021　Road vehicles — Cybersecurity engineering

https://www.iso.org/standard/70918.html

### 1.N Normative Reference　on ISO/SAE 21434
1.N1 ISO 26262-3:2018, Road vehiclesた — Functional safety — Part 3: Concept phase
https://www.iso.org/standard/68385.html

＜個人感想：どこの業界でもあるある。自分の業界の規格を参照するだけ。分野が違おうとあまりこだわっていないのか。サイバー攻撃の規格またはサイバー攻撃の技術基盤となる通信関連規格をNormative Referenceにするとよい。＞
### 1.B Bibliography on ISO/SAE 21434
[1]	ISO 26262-1:2018, Road vehicles — Functional safety — Part 1: Vocabulary
[2]	ISO 9000:2015, Quality management systems — Fundamentals and vocabulary
[3]	ISO 31000:2018, Risk management — Guidelines
[4]	ISO/IEC/IEEE 15288:2015, Systems and software engineering — System life cycle processes
[5]	ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary
[6]	ISO/TR 4804, Road vehicles — Safety and cybersecurity for automated driving systems — Design, verification and validation
[7]	IATF 16949, Quality management system requirements for automotive production and relevant service parts organizations
[8]	ISO 9001, Quality management systems — Requirements
[9]	ISO 10007, Quality management — Guidelines for configuration management
[10]	ISO/IEC 33001, Information technology — Process assessment — Concepts and terminology
[11]	ISO/IEC/IEEE 15288, Systems and software engineering — System life cycle processes
[12]	ISO/IEC/IEEE 12207, Systems and software engineering — Software life cycle processes
[13]	VDA QMC WORKING GROUP 13 / AUTOMOTIVE SIG. Automotive SPICE Process Assessment / Reference Model, Version 3.1 [online]. Berlin: VDA QMC, November 2017. Available at: http://www.automotivespice.com/fileadmin/software-download/AutomotiveSPICE_PAM_31.pdf
[14]	ISO 29147, Information technology — Security techniques — Vulnerability disclosure
[15]	IEC 62443-2-1, Industrial communication networks — Network and system security — Part 2-1: Establishing an industrial automation and control system security program
[16]	ISO 26262 (all parts), Road vehicles — Functional safety
[17]	MISRA C, 2012, Guidelines for the use of the C language in critical systems, 3rd Edition, 1st Revision. Nuneaton, England: HORIBA MIRA, February 2019. ISBN (print/electronic): 978-1-906400-21-7 / 978-1-906400-22-4.
[18]	SEI CERT, C Coding Standard – Rules for developing safe, reliable and secure systems [online]. Pittsburgh, Pennsylvania: Software Engineering Institue, Carnegie Mellon University, 2016 [viewed 2021-02-12]. Available at: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=454220
[19]	ROSS, Ron, et al. (2018), Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-160, Vol. 1. Updated March 2018 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-160v1
[20]	E-SAFETY VEHICLE INTRUSION PROTECTED APPLICATIONS (EVITA), Deliverable D2.3: Security requirements for automotive on-board networks based on dark-side scenarios [online]. Edited by A. Ruddle et al. December 2009 [viewed 2021-01-17]. Available at: https://doi.org/10.5281/zenodo.1188418
[21]	ETSI TS 102 165-1, CYBER; Methods and protocols; Part 1: Method and pro forma for Threat, Vulnerability, Risk Analysis (TVRA), Version 5.2.3 [online]. October 2017 [viewed 2021-01-19]. Available at: https://www.etsi.org/deliver/etsi_ts/102100_102199/10216501/05.02.03_60/ts_10216501v050203p.pdf
[22]	UcedaVélez, Tony and Morana, Marco M. Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis. Hoboken, New Jersey: Wiley, May 2015. ISBN: 978-1-118-98835-0.
[23]	ISO/IEC 18045, Information technology — Security techniques — Methodology for IT security evaluation
[24]	FORUM OF INCIDENT RESPONSE AND SECURITY TEAMS (FIRST). Common Vulnerability Scoring System (CVSS), Common Vulnerability Scoring System v3.1: Specification Document, [online]. Available at: https://www.first.org/cvss/v3.1/specification-document
[25]	ISO/IEC 29100, Information technology — Security techniques — Privacy framework
[26]	Automotive ISAC, Automotive Cybersecurity Best Practices [online]. Available at: https://www.automotiveisac.com/best-practices/
[27]	FORUM OF INCIDENT RESPONSE AND SECURITY TEAMS (FIRST). Traffic Light Protocol (TLP), FIRST Standards Definitions and Usage Guidance - Version 1.0, [online]. Available at: https://www.first.org/tlp/
[28]	ISO/IEC 23822, Information technology — Vocabulary
[29]	ISO/IEC 15408 (all parts), Information technology — Security techniques — Evaluation criteria for IT security
[30]	ISO/IEC 27001, Information technology — Security techniques — Information security management systems — Requirements
[31]	ISO/IEC 27010, Information technology — Security techniques — Information security management for inter-sector and inter-organizational communications
[32]	ISO/IEC/IEEE 26511, Systems and software engineering — Requirements for managers of information for users of systems, software, and services
[33]	IEC 31010, Risk management — Risk assessment techniques
[34]	IEC 61508-7, Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 7: Overview of techniques and measures
[35]	JOHNSON, Christopher, et al. (2016) Guide to Cyber Threat Information Sharing [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-150, October 2016 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-150
[36]	JOINT TASK FORCE TRANSFORMATION INITIATIVE, 2012), Guide for Conducting Risk Assessments [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1. September 2012 [viewed 2021-02-16]. Available at: http://dx.doi.org/10.6028/NIST.SP.800-30r1
[37]	SAE J3061, Cybersecurity Guidebook for Cyber-Physical Vehicle Systems
[38]	SCARFONE, Karen, et al. (2008), Technical Guide to Information Security Testing and Assessment [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-115. September 2008 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-115
[39]	TAKANEN, Ari et al. Fuzzing for Software Security and Quality Assurance, Second Edition. Boston, Massachusetts/London: Artech House, January 2018. ISBN: 978-1-60807-850-9.


### 1.N1 ISO 26262-3:2018, Road vehicles — Functional safety — Part 3: Concept phase
https://www.iso.org/standard/68385.html

#### 1.N1N Normative Reference ISO 26262-3

ISO 26262-1, Road Vehicles — Functional Safety — Part 1: Vocabulary
ISO 26262-2:2018, Road Vehicles — Functional Safety — Part 2: Management of functional safety
ISO 26262-4:2018, Road vehicles — Functional safety — Part 4: Product development at the system level
ISO 26262-8:2018, Road vehicles — Functional safety — Part 8: Supporting processes
ISO 26262-9:2018, Road vehicles — Functional safety — Part 9: Automotive Safety Integrity Level (ASIL)-oriented and safety-oriented analyses

＜個人感想：どこの業界でもあるある。自分の規格しかNormative Referenceにあげていない。軍事産業、航空宇宙産業でも、民生品の規格を参照しようと努力中とお聞きした。自動車業界が民生（民主）化するのはいつのことだろう。＞


#### 1.N1B Bibliography ISO 26262-3
Bibliography

[1]	ISO 26262-12:2018, Road Vehicles — Functional Safety — Part 12: Adaptation of ISO 26262 for motorcycles
[2]	IEC 61508 (all parts), Functional safety of electrical/electronic/programmable electronic safety-related systems
[3]	Abbreviated injury scale; Association of the advancement of Automotive medicine; Barrington, IL, USA Information is also available at www.aaam.org
[4]	Code of Practice for the design and evaluation of ADAS, EU Project RESPONSE 3: Oct. 2006; https://www.acea.be/publications/article/code-of-practice-for-the-design-and-evaluation-of-adas
[5]	Baker S.P., O’Neill, B., Haddon, W., Long, W.B., The injury severity score: a method for describing patients with multiple injuries and evaluating emergency care. The Journal of Trauma, Vol. 14, No. 3, 1974
[6]	Balogh Z., Offner P.J., Moore E.E., Biffl W.L., NISS predicts post injury multiple organ failure better than ISS, The Journal of Trauma, Vol. 48, No. 4, 2000





[1]	ISO 26262-1:2018, Road vehicles — Functional safety — Part 1: Vocabulary
[2]	ISO 9000:2015, Quality management systems — Fundamentals and vocabulary
[3]	ISO 31000:2018, Risk management — Guidelines
[4]	ISO/IEC/IEEE 15288:2015, Systems and software engineering — System life cycle processes
[5]	ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary
[6]	ISO/TR 4804, Road vehicles — Safety and cybersecurity for automated driving systems — Design, verification and validation
[7]	IATF 16949, Quality management system requirements for automotive production and relevant service parts organizations
[8]	ISO 9001, Quality management systems — Requirements
[9]	ISO 10007, Quality management — Guidelines for configuration management
[10]	ISO/IEC 33001, Information technology — Process assessment — Concepts and terminology
[11]	ISO/IEC/IEEE 15288, Systems and software engineering — System life cycle processes
[12]	ISO/IEC/IEEE 12207, Systems and software engineering — Software life cycle processes
[13]	VDA QMC WORKING GROUP 13 / AUTOMOTIVE SIG. Automotive SPICE Process Assessment / Reference Model, Version 3.1 [online]. Berlin: VDA QMC, November 2017. Available at: http://www.automotivespice.com/fileadmin/software-download/AutomotiveSPICE_PAM_31.pdf
[14]	ISO 29147, Information technology — Security techniques — Vulnerability disclosure
[15]	IEC 62443-2-1, Industrial communication networks — Network and system security — Part 2-1: Establishing an industrial automation and control system security program
[16]	ISO 26262 (all parts), Road vehicles — Functional safety
[17]	MISRA C, 2012, Guidelines for the use of the C language in critical systems, 3rd Edition, 1st Revision. Nuneaton, England: HORIBA MIRA, February 2019. ISBN (print/electronic): 978-1-906400-21-7 / 978-1-906400-22-4.
[18]	SEI CERT, C Coding Standard – Rules for developing safe, reliable and secure systems [online]. Pittsburgh, Pennsylvania: Software Engineering Institue, Carnegie Mellon University, 2016 [viewed 2021-02-12]. Available at: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=454220
[19]	ROSS, Ron, et al. (2018), Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-160, Vol. 1. Updated March 2018 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-160v1
[20]	E-SAFETY VEHICLE INTRUSION PROTECTED APPLICATIONS (EVITA), Deliverable D2.3: Security requirements for automotive on-board networks based on dark-side scenarios [online]. Edited by A. Ruddle et al. December 2009 [viewed 2021-01-17]. Available at: https://doi.org/10.5281/zenodo.1188418
[21]	ETSI TS 102 165-1, CYBER; Methods and protocols; Part 1: Method and pro forma for Threat, Vulnerability, Risk Analysis (TVRA), Version 5.2.3 [online]. October 2017 [viewed 2021-01-19]. Available at: https://www.etsi.org/deliver/etsi_ts/102100_102199/10216501/05.02.03_60/ts_10216501v050203p.pdf
[22]	UcedaVélez, Tony and Morana, Marco M. Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis. Hoboken, New Jersey: Wiley, May 2015. ISBN: 978-1-118-98835-0.
[23]	ISO/IEC 18045, Information technology — Security techniques — Methodology for IT security evaluation
[24]	FORUM OF INCIDENT RESPONSE AND SECURITY TEAMS (FIRST). Common Vulnerability Scoring System (CVSS), Common Vulnerability Scoring System v3.1: Specification Document, [online]. Available at: https://www.first.org/cvss/v3.1/specification-document
[25]	ISO/IEC 29100, Information technology — Security techniques — Privacy framework
[26]	Automotive ISAC, Automotive Cybersecurity Best Practices [online]. Available at: https://www.automotiveisac.com/best-practices/
[27]	FORUM OF INCIDENT RESPONSE AND SECURITY TEAMS (FIRST). Traffic Light Protocol (TLP), FIRST Standards Definitions and Usage Guidance - Version 1.0, [online]. Available at: https://www.first.org/tlp/
[28]	ISO/IEC 23822, Information technology — Vocabulary
[29]	ISO/IEC 15408 (all parts), Information technology — Security techniques — Evaluation criteria for IT security
[30]	ISO/IEC 27001, Information technology — Security techniques — Information security management systems — Requirements
[31]	ISO/IEC 27010, Information technology — Security techniques — Information security management for inter-sector and inter-organizational communications
[32]	ISO/IEC/IEEE 26511, Systems and software engineering — Requirements for managers of information for users of systems, software, and services
[33]	IEC 31010, Risk management — Risk assessment techniques
[34]	IEC 61508-7, Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 7: Overview of techniques and measures
[35]	JOHNSON, Christopher, et al. (2016) Guide to Cyber Threat Information Sharing [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-150, October 2016 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-150
[36]	JOINT TASK FORCE TRANSFORMATION INITIATIVE, 2012), Guide for Conducting Risk Assessments [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1. September 2012 [viewed 2021-02-16]. Available at: http://dx.doi.org/10.6028/NIST.SP.800-30r1
[37]	SAE J3061, Cybersecurity Guidebook for Cyber-Physical Vehicle Systems
[38]	SCARFONE, Karen, et al. (2008), Technical Guide to Information Security Testing and Assessment [online]. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-115. September 2008 [viewed 2021-02-16]. Available at: https://doi.org/10.6028/NIST.SP.800-115
[39]	TAKANEN, Ari et al. Fuzzing for Software Security and Quality Assurance, Second Edition. Boston, Massachusetts/London: Artech House, January 2018. ISBN: 978-1-60807-850-9.



### Bibliography ISO 26262-12


#### [1]	ISO 26262-12:2018, Road Vehicles — Functional Safety — Part 12: Adaptation of ISO 26262 for motorcycles
https://www.iso.org/standard/69605.html


##### Normative Reference òn ISO 26262-12
ISO 26262-1, Road vehicles — Functional safety — Part 1: Vocabulary
ISO 26262-2:2018, Road vehicles — Functional safety — Part 2: Management of functional safety
ISO 26262-3:2018, Road vehicles — Functional safety — Part 3: Concept phase
ISO 26262-4:2018, Road vehicles — Functional safety — Part 4: Product development at the system level
ISO 26262-5:2018, Road vehicles — Functional safety — Part 5: Product development at the hardware level
ISO 26262-6:2018, Road vehicles — Functional safety — Part 6: Product development at the software level
ISO 26262-7:2018, Road vehicles — Functional safety — Part 7: Production, operation, service and decommissioning
ISO 26262-8:2018, Road vehicles — Functional safety — Part 8: Supporting processes
ISO 26262-9:2018, Road vehicles — Functional safety — Part 9: Automotive Safety Integrity Level (ASIL)-oriented and safety-oriented analyses
##### Bibliography ISO 26262-12
[1]	Abbreviated injury scale; Association of the advancement of Automotive medicine; Barrington, IL, USA Information is also available at www.aaam.org [viewed 2018-12-11]
[2]	Baker S.P., O'Neill B., Haddon W., Long W.B., The injury severity score: a method for describing patients with multiple injuries and evaluating emergency care, The Journal of Trauma, Vol. 14, No. 3, 1974
[3]	Balogh Z., Offner P.J., Moore E.E., Biffl W.L., NISS predicts post injury multiple organ failure better than ISS, The Journal of Trauma, Vol. 48, No. 4, 2000
[4]	ISO 11451 (all parts), Road vehicles — Vehicle test methods for electrical disturbances from narrowband radiated electromagnetic energy
[5]	IEC 61000-6-1, Electromagnetic compatibility (EMC) — Part 6-1: Generic standards — Immunity for residential, commercial and light-industrial environments

#### [2]	IEC 61508 (all parts), Functional safety of electrical/electronic/programmable electronic safety-related systems

#### IEC 61508-1:2010  Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 1: General requirements (see Functional Safety and IEC 61508)
https://webstore.iec.ch/publication/5515
##### Normative Reference on IEC 61508-1

IEC 61508-2:2010, Functional safety of electrical/electronic/programmable electronic safety- related systems – Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems
IEC 61508-3:2010, Functional safety of electrical/electronic/programmable electronic safety- related systems – Part 3: Software requirements
IEC 61508-4:2010 Functional safety of electrical/electronic/programmable electronic safety- related systems – Part 4: Definitions and abbreviations
IEC Guide 104:1997, The preparation of safety publications and the use of basic safety publications and group safety publications
ISO/IEC Guide 51:1999, Safety aspects – Guidelines for their inclusion in standards

ISO 26262は、IEC62508をBibliographyに入れている。Normative Referenceではないだから、ISO/IEC Guide 51をNormative Referenceにしていないのはおかしいかも。
IEC Guide 104はBibliographyでいいかも。

##### Bibliography IEC 62508-1
未確認

#### [3]	Abbreviated injury scale; Association of the advancement of Automotive medicine; Barrington, IL, USA Information is also available at www.aaam.org

#### [4]	Code of Practice for the design and evaluation of ADAS, EU Project RESPONSE 3: Oct. 2006; https://www.acea.be/publications/article/code-of-practice-for-the-design-and-evaluation-of-adas

##### Annex H References
[ResD2 04]: Becker, S. et al.;Response 2 Del. 2: “Risk Benefit Analysis”; Project Report 2004
[ResD42 99]: Becker, S; Kopf, M. et al.; Response Del. 4.2: “Checklist for theoretical Assessment of Advanced Driver Assis- tance Systems: Methods, Results and Assessment of Applicabil- ity”, Project report 1999
[IP_D4 06]: PReVENT IP public deliverable IP D4 on Functional Requirements
[Schw 04]: Schwarz, J. (2004). RESPONSE II. WP3: Methodolo- gies for Risk-Benefit Analysis.
[Red 97]: Redmill, F ; Rajan, J: Human factors in safety critical systems; Butterworth-Heinemann 1997, p. 49

#### [5]	Baker S.P., O’Neill, B., Haddon, W., Long, W.B., The injury severity score: a method for describing patients with multiple injuries and evaluating emergency care. The Journal of Trauma, Vol. 14, No. 3, 1974

#### [6]	Balogh Z., Offner P.J., Moore E.E., Biffl W.L., NISS predicts post injury multiple organ failure better than ISS, The Journal of Trauma, Vol. 48, No. 4, 2000

# 文書履歴(document history)
ver. 0.01 初稿 20230930 
### 最後までおよみいただきありがとうございました。

いいね　💚、フォローをお願いします。
#### Thank you very much for reading to the last sentence.

Please press the like icon 💚　and follow me for your happy life.