# Threat Analysis and Risk Assessment of a Driver Monitoring System
## 6 Risk Analysis
### Risk Categorization and Scenarios  
Threat analysis is structured according to the STRIDE framework, which includes Spoofing, Tampering, Repudiation, Information Disclosure, DoS, and Elevation of Privilege. The primary system components--processes, sensors, actuators, dataflows, and ports--are analyzed for specific damage scenarios, illustrating potential vulnerabilities and impacts.  
Processes encompass components that receive data, analyze it, and issue commands or results. In the proposed architecture, the processes include the Camera Activator, Calculation Unit, Vehicle Status Analyzer, and ECU. These are vulnerable to all STRIDE threat categories:  
1. Spoofing: An attacker impersonates a process, sending false data. For example, Spoofing the Camera Activator may continuously activate warning signals, distracting the driver;
2. Tampering: The attacker modifies transmitted data, disrupting the system and confusing the driver;
3. Repudiation: Signatures of processes are altered or erased, making the data untraceable and potentially causing erroneous activations;
4. Information Disclosure: Unauthorized access to process data may range from insignificant (e.g., seat belt status) to highly sensitive (e.g., driver images);
5. Denial of Service: Overloading processes can lead to crashes or slowdowns, disabling the system;
6. Elevation of Privilege: Attackers may execute unauthorized functions by gaining access to high-privilege operations.  
Figure 8: The chosen architecture, replicated in the Microsoft Threat Modeling Tool 2016.  
Sensors measure environmental factors and send results for processing. The architecture includes seat belt sensors, seat pressure sensors, and a camera sensor. These are vulnerable to the following:  
* Spoofing: Attackers simulate sensors, sending fake data such as repetitive images of a sleeping driver, which may distract the driver and drain energy;
* Repudiation: Signatures are altered, rendering data untraceable and potentially causing the system to reject valid sensor data. Actuators respond to process signals. In this architecture, warning devices alert the driver when necessary. They are vulnerable to the following:
* Spoofing: Attackers may impersonate warning devices, triggering constant alerts and distracting the driver;
* Repudiation: While technically possible, Repudiation does not significantly affect system functionality, given the limited role of actuators. Dataflows facilitate communication between components and are subject to the following:
* Tampering: Data modification disrupts the system, confusing the driver;
* Information Disclosure: Unauthorized data access varies in impact from trivial to severe, depending on the data's sensitivity;
* Denial of Service: Overloading dataflows may slow or crash the system entirely. Ports serve as entry and exit points for dataflows, requiring protection against the following:
* Tampering: Modified data at ports can disrupt alarms and confuse drivers;
* Information Disclosure: Access to port data may lead to privacy violations or misuse of sensitive information;
* Denial of Service: Overwhelmed ports can disable communications, leading to system shutdowns.