What is TARA (Threat Analysis and Risk Assessment)?

TARA stands for Threat Analysis and Risk Assessment. It is a systematic cybersecurity methodology that identifies potential cyber threats to a system early on, assesses their likelihood, and prioritizes their impact on security. Rather than relying on assumptions, TARA is the central mechanism for deriving security requirements (cybersecurity goals) in a structured way.

Unlike traditional risk management, TARA focuses specifically on cyber threats. Rather than addressing hardware failures, it focuses on malicious external attacks. The goal is to balance security costs with actual risk exposure.

The process (often aligned with ISO/SAE 21434) follows a logical sequence:

1. Item Definition – Define Scope

What are we protecting (architecture), what is relevant (relevance), and what is out of scope? To define the object of analysis:

• Involve relevant stakeholders,
• Define system boundaries (entry/exit points, external interfaces, dependencies, etc.),
• Document scope and boundary decisions in a transparent and traceable way.

UML diagrams can be helpful here.

2. Asset Identification – Evaluate Critical Elements

Which assets need protection? Examples include hardware, software, personnel, user data, and control commands. Assets are not protected arbitrarily; they are evaluated based on the CIA triad: Confidentiality, integrity, and availability. The goal is to strategically prioritize assets to enable targeted protection measures, not just list them.

3. Threat Analysis

What threats exist? The steps in a threat analysis are:

• Identify threat actors, or internal and external attackers.
• Develop threat scenarios to better understand potential risks.
• Continuously update results to reflect emerging threats.

ISO/SAE 21434 Annex 5 provides a comprehensive threat catalog for the automotive sector.

4. Impact Rating – Assess Consequences

In the event of a security incident, how would the identified assets be affected? How severe would the resulting damage be in terms of security, finances, operations, and privacy? Damage scenarios are analyzed. In the automotive sector, the SFOPP model is used for this purpose. This model makes the assessment objective and multidimensional. The model stands for:

• S for Safety: Risk of injury,
• F for Financial: Monetary losses,
• O for Operational: Functional limitations,
• P for Privacy: Loss of sensititve data,
• P for Perception: Loss of trust.

5. Attack Feasibility – Assess Likelihood of Attack Execution

How easy is the attack to carry out, and how realistic is it? Rather than making an estimate, an event tree is often used to calculate the AFR (attack feasibility rating). It is typically divided into the following levels:

• Threat Scenario (Top Event),
• Attack Paths (Attack Paths),
• Individual Steps (Attack Steps).

For each step in the event tree, the effort required by the attacker is assessed. Ultimately, this results in the total AFR.

6. Risk Determination – Risk Classification

The overall risk is calculated based on impact and feasibility. For this purpose, a risk matrix is often created. Risks are entered into the matrix based on the AFR and SFOPP assessments, typically on a scale from 1 (low) to 5 (high).

7. Risk Treatment – Risk Mitigation

What measures should be taken to address the identified risks? Possible strategies include avoiding, mitigating, accepting, or transferring risks and sharing responsibility. Depending on the strategy chosen, the result is either active measures (cybersecurity goals) or documented risk acceptance (cybersecurity claims).

In practice, the terms „threat“ and „vulnerability“ are often used interchangeably. However, for a precise TARA analysis in accordance with ISO/SAE 21434, it is essential to distinguish between the two:

• Threat: A potential event that could compromise a cybersecurity property (CIA), such as „manipulation of control data.“
• Vulnerability: A specific weakness in the design or implementation that makes a threat feasible (e.g., „lack of authentication on the CAN bus“).

A well-founded TARA uses the results of the vulnerability analysis to objectively assess the probability of occurrence. Only those who understand their vulnerabilities can accurately evaluate the attack paths in the event tree and establish effective cybersecurity goals.

Many project teams wonder if an existing FMEA can replace a TARA. The answer is no. While the FMEA focuses on safety, the TARA addresses security. Here is a brief comparison:

TARA is not a niche product; it is a requirement in regulated industries:

• Automotive: According to the ISO/SAE 21434 standard, TARA is mandatory for modern, connected vehicles (software-defined vehicles).
• Medical Technology: It protects patient data and ensures device functionality against hacker attacks.
• Industry 4.0 (OT): Securing production facilities and critical infrastructure (KRITIS).
• Aerospace: Protecting avionics against unauthorized access.

With objectiF RPM , you can integrate TARA directly into your requirements engineering process. Identified threats lead immediately to new security requirements, which are visible to all developers.

Traceability is built right into objectiF RPM. The entire chain is fully traceable, from the asset to the threat, through the technical implementation and the test case.

Cybersecurity built in your Requirements Engineering

Discover how objectiF RPM helps you create TARAs and ensures compliance with ISO/SAE 21434.