Pain points of automotive cybersecurity: keeping TARA alive in Excel.
Source Reddit Cybersecurity
Discussion
This content discusses challenges in managing Threat Analysis and Risk Assessment (TARA) processes for automotive cybersecurity using Excel spreadsheets. It highlights issues such as traceability breaks, inconsistent risk ratings, coverage gaps, and difficulties maintaining up-to-date assessments as designs change. The discussion is a call for input on these pain points rather than reporting a specific vulnerability or exploit.
r/cybersecurity (opens in a new tab)u/Useful_Budget70010 points0 comments
I’m doing a short case study on a pain point I keep hearing about in automotive cybersecurity: keeping TARA alive in Excel.
Under ISO/SAE 21434 and UN R155/R156, the TARA is the backbone of the whole compliance story. Assets, damage scenarios, threat scenarios, attack paths, risk ratings, treatments. And for most teams it still lives in a spreadsheet.
The recurring difficulties I keep hearing:
Traceability breaks. The chain from asset to threat to risk to treatment to requirement is fragile in a spreadsheet, and an assessor wants to follow it both ways.
Ratings drift between analysts. The same threat gets scored differently by different people, and nobody catches it until review.
Annex 5 coverage gaps. A category quietly ends up with zero threats, and there’s no “not applicable because…” recorded anywhere.
The TARA rots when the design changes. A new ECU or interface lands and the spreadsheet silently goes stale.
No cheap way to sanity check before an assessment. You’re either confident, or you’re guessing.
I want to pressure test whether these are the real problems or just the loud ones. If you run TARAs day to day, I’d love your take:
What costs you the most time: the ongoing maintenance, the review prep, or policing consistency across the team?
How do you currently know your TARA will hold up before an assessor sees it?
And is there a difficulty here I’ve completely missed?
Genuinely after honest input. Comment below or DM me.
#ISO21434 #UNR155 #TARA #AutomotiveCybersecurity #ProductSecurity