Much like many other risk assessment methods, the TARA method begins with asset identification. The analyst will need to determine the security properties of each asset, and determine damage scenarios along with their impacts. Assets are categorized by the standard confidentiality, integrity, and availability (C, I, A) ratings. Impact is measured from negligible to severe and separated into four categories: safety, financial, operational, and privacy (S, F, O, P). It’s important to consider that all these impacts must be calculated from the road user perspective, not the corporate perspective. Once the impacts of the damage scenarios have been compiled, it’s time to identify threats against them.
Threats or vulnerabilities are identified by common definitions such as “man-in-the-middle” or “buffer overflow” and rated in multiple categories that affect the road vehicle and ultimately the user. Time, expertise, knowledge, window of opportunity, and equipment are important threat categories to include. Establishing the proficiency and duration of an attack might include definitions around the use of bespoke tooling, insider knowledge, and opportunity windows of attack. In addition, equipment and window of opportunity may require definitions around specialized unlocking mechanisms, and proximity-based vs. long-range communications.