# Threat Analysis and Risk Assessment of a Driver Monitoring System
Targeted attacks could interfere with sensors or introduce false alarms that distract the driver, increasing the risk of accidents even when the vehicle is not mechanically compromised. These vulnerabilities arise from the increasing use of interconnected technologies and artificial intelligence (AI) algorithms in vehicles, which expands the attack surface and introduces new risks. Given the critical role of DMSs in future autonomous and semi-autonomous vehicles, ensuring their cybersecurity has become a priority at both the academic and industrial levels. In this context, regulatory frameworks such as the International Organization for Standardization (ISO)/Society of Automotive Engineers (SAE) 21434 standard and threat modeling methodologies like STRIDE provide solid foundations for the structured identification, analysis, and mitigation of cybersecurity threats in automotive systems. However, the existing literature still lacks systematic studies that apply these frameworks rigorously to DMSs. Therefore, it is crucial to consider how possible cyberattacks could not only distract the driver but also inhibit the ability of a DMS to detect early signs of fatigue or distraction. In extreme scenarios, targeted attacks could even inhibit or manipulate warning systems, making the driver unaware of dangerous situations [3; 5]. Although such attacks do not necessarily alter the mechanical operation of the vehicle, their influence on the ability of the DMS to properly monitor the driver could lead to accidents with serious consequences. This is why it is crucial to conduct a thorough analysis of the security threats associated with DMSs, following the guidelines provided by the ISO/SAE 21434 standard, which establishes the basic requirements for cybersecurity in vehicles [6]. A comprehensive Threat Analysis and Risk Assessment (TARA) is necessary to identify threat scenarios and propose effective mitigation measures to ensure driver safety and reduce the risk of distraction or human error incidents. Given their critical role in enhancing road safety, it is imperative to ensure that DMSs are designed and implemented in accordance with established standards and security best practices. Regulatory frameworks such as ISO/SAE 21434 and structured threat modeling methodologies like STRIDE offer systematic approaches for identifying, analyzing, and mitigating risks in automotive systems. Despite their relevance, the current literature lacks targeted applications of these frameworks specifically tailored to DMSs. In this regard, this research aims to perform a TARA specifically for DMSs. This study is based on the framework established by the ISO/SAE 21434 standard, focusing on identified threats and attack scenarios that could compromise the security of these systems. Using a systematic methodology, the objective is to identify the most critical threats and propose effective mitigation measures to ensure the security of DMSs in modern vehicles. This study makes the following contributions to the field of automotive cybersecurity, specifically concerning Driver Monitoring Systems:* It provides a comprehensive Threat Analysis and Risk Assessment (TARA) tailored explicitly to a representative, modern DMS architecture, systematically applying the methodology outlined in the ISO/SAE 21434 standard;
* It identifies and categorizes a detailed set of 115 potential cybersecurity threats targeting various DMS components and dataflows, with a particular emphasis on analyzing risks related to the sensitive nature of driver biometric data and potential privacy violations (Information Disclosure);
* It proposes specific mitigation strategies designed to address the unique High- and Medium-risk vulnerabilities identified within the DMS, offering actionable insights to improve system security and driver privacy. The organization of this paper is designed to provide a comprehensive and structured exploration of the challenges and solutions in the domain of DMS security.