Recent advancements in the automotive field have significantly increased the level of complexity and connectivity of modern vehicles. In this context, the topic of cybersecurity becomes extremely relevant, as a successful attack can have an impact in terms of safety on the car navigation, potentially leading to harmful behavior. Risk assessment is typically performed using discrete input and output scales, which can often lead to an identical output in terms of risk evaluation despite the inputs presenting non-negligible differences. This work presents a novel fuzzy-logic-based methodology to assess cybersecurity risks which takes attack feasibility and safety impact as input factors. This technique allows us explicitly model the uncertainty and ambiguousness of input data, which is typical of the risk assessment process, providing an output on a more detailed scale. The fuzzy inference engine is based on a set of control rules expressed in natural language, which is crucial to maintaining the interpretability and traceability of the risk calculation. The proposed framework was applied to a case study extracted from ISO/SAE 21434. The obtained results are in line with the traditional methodology, with the added benefit of also providing the scatter around the calculated value, indicating the risk trend. The proposed method is general and can be applied in the industry independently from the specific case study.

Automated vehicles are characterized by intelligent functions (many developed using AI-based solutions), autonomy, and high connectivity with the external environment. The high connectivity of AV opens relevant cybersecurity issues due to many potential attack surfaces. Cybersecurity attacks' effects on AV may also determine severe risks in terms of functional safety due to vehicles' high automation and autonomy. Functional safety assurance of AV cannot be disjoint from the analysis and treatment of cybersecurity concerns. In this paper, we define a methodology called ISCA (Integrated Safety and Cybersecurity Assurance) aimed at integrating, in a systematic manner, cybersecurity concerns into the functional safety assurance process of AI-based functions of AV. The ISCA methodology focuses on the emerging scenario-based approach for testing AI-based vehicle functions and is based on creating variants of the scenarios used for functional safety testing. The variants are derived from the original scenarios modified by the effects of highly risky cyberattacks that can occur during the scenario execution. The risk assessment of cyberattacks is based on the fuzzy logic mechanism. ISCA represents a possible way to strengthen the scenario-based functional safety assurance of AI-based vehicle functions by integrating cybersecurity concerns.

Over the last decade, there has been an exponential increase in software-driven functions embedded in vehicles. In such a scenario, demands and needs regarding Functional Safety assurance have grown in criticality and complexity. As new-generation vehicles are characterized by high connectivity and autonomy, Functional Safety concerns can no longer be disjointed from Cybersecurity implications. To face such a situation, the automotive community has made enormous efforts to define methodologies, set up technologies, and enforce its culture. This paper presents the outcomes of an empirical study performed with the aim of identifying the current Functional Safety and Cybersecurity improvement areas in automotive software-intensive systems development. The study, conducted through an online questionnaire on a selected sample of automotive players, provided some interesting indications on which areas need to be improved the most. The results of the study show that the main improvement needs are related to methodologies deployed, tools in use, skills, and organizational structure for Cybersecurity and Integrated Functional Safety and Cybersecurity practices. In particular, the improvement need is higher for management aspects than engineering ones. We observed also that the need for improvement is markedly higher for small/medium companies than large ones.