Automotive cybersecurityfrom TARA to type approval.
We engineer the automotive cybersecurity case end to end: threat analysis and risk assessment, cybersecurity requirements and architecture, verification and ECU penetration testing, and the CSMS and SUMS evidence UNECE R155 / R156 type approval depends on. Led by Adrian Valea, Automotive Cybersecurity certified (TÜV NORD).
What we cover
The full ISO/SAE 21434 lifecycle, plus the UNECE R155 / R156 evidence a type-approval programme needs. We scope from the threat model and keep every work product traceable from asset to security goal to verification.
Concept & risk, ISO/SAE 21434 Clause 15 (TARA)
- Item definition & assetscybersecurity scope, asset identification with C/I/A properties, interfaces, attack surface.
- TARAdamage scenarios, threat scenarios, attack-path analysis, attack-feasibility rating, risk determination and risk-treatment decisions (Clause 15.3, 15.9).
- Cybersecurity goals & claimsderived from the TARA and allocated to architecture.
- Cybersecurity Assurance Level (CAL)graded rigour across the cybersecurity activities.
Secure development, Clauses 10, 13
- Cybersecurity requirements at concept, system, hardware and software level, traced to the TARA.
- Architectural mitigationssecure boot, SecOC message authentication, key management and HSM/SHE integration, secure storage, secure diagnostics (UDS SecurityAccess 0x27 / Authentication 0x29 per ISO 14229-1:2020), secure flashing and anti-downgrade.
- Verification & validationsecurity testingECU penetration testingvulnerability analysis, with reproducible evidence.
CSMS & operations, Clauses 5, 8
- Cyber Security Management Systemthe UNECE R155 type-approval prerequisite: process, roles, evidence catalogue, supplier interface agreements.
- MonitoringCVE / threat-intelligence feeds mapped to your components; a defined trigger from a new vulnerability to a re-assessed TARA.
- Incident response & vulnerability managementtriage, disclosure handling (ISO/IEC 29147 / 30111), and a path to a fielded fix.
Software updates, UNECE R156 (SUMS)
- Software Update Management SystemOTA campaign integrity, rollback safety, and tying every update back to its RXSWIN so the vehicle on the road still matches its approved type.
Type-approval support
We assemble the R155 / R156 evidence file, prepare you for the approval-authority and technical-service review, and keep the CSMS credible between audits, the part that quietly decays after the certificate is granted.
Why STS
We build the secure-diagnostic, secure-boot and HSM stacks we secure and test, on production automotive MCUs, so our cybersecurity work points to root cause and fix, not just findings. Led by Adrian Valea (Automotive Cybersecurity, TÜV NORD), with 25 years of automotive embedded engineering and a delivery footprint across Germany, Romania, India and China.