Methodology maps TARA goals to NAC rules for automotive and energy networks
Original title: A Cross-Domain TARA-to-NAC Rule Mapping Methodology: From Automotive OEM Networks to Energy Storage Systems
Six-step process translates threat analysis into enforceable network access control rules across critical infrastructure.
The paper introduces a methodology that maps cybersecurity goals from threat analysis and risk assessment to named network access control rules traceable to threat records. It applies the approach to an automotive OEM plant network and utility-scale battery energy storage systems. IEC 62443 and ISO/IEC 27001 serve as fixed substrates while domain-specific standards act as overlays. The automotive case covers 11 of 13 goals with 23 rules; the energy case produces six rules.
Unconfirmed: Methodology is desk-based and applied to examples without empirical testing on live systems.
- Automotive example yields 23 rules from 37 threats
- Energy storage example produces six rules
- Three derived rules lack equivalents in cited standards
- Organizations
- North American Electric Reliability Corporation
From the original article
1 min read at arxiv.orgThreat analysis and risk assessment under ISO/SAE 21434 ends with cybersecurity goals, but existing methods give little structured guidance for turning those goals into enforceable network access control rules. Compliance standards such as IEC 62443, ISO/SAE 21434, and ISO/IEC 27001 are usually applied as parallel efforts rather than as one enforcement architecture.
By Krishna Teja Medam · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.