MISRA and ISO 26262: Compliance Is Key to Security
Table of Contents
Easter vacation is just around the corner, and everyone around me is dreaming about vacation. Are you? Let’s play a little game:
How will you plan your trip? How will you arrange your travels? Rent a car? Buy airplane or train tickets? Reserve the coolest accommodation?
If you answered “Online” to any of the above questions: congratulations! Like all of us, you are deeply embedded in the Internet of Things. What many of us don’t realize is that beyond the aspects of reservations and online reviews, all our transportation: planes, trains, and automobiles – is also deeply embedded with software.
We know that the space and defense industries have been at the forefront of technology since the middle of the previous century. What we need to understand is that air and land transportation is catching up. Every form of travel today involves thousands and thousands of lines of complex code for navigation, entertainment, communication, and everything else that will help us get from point A to point B as quickly and safely as possible.
Drive safe: Is security up to speed?
While planes, trains, and automobiles continue to wow the world with new enhancements and capabilities, developers and manufacturers need to make sure that reliability doesn’t take a back seat: hackers have already caught up with the swift development of smart car engineering, and now more than ever, safety and cyber security are issues need to be addressed at every stage of product development. The need to keep up with best practices and industry standards must remain a priority.
Related: Open Source License Compliance
Compliance is key: MISRA and ISO 26262
Two standards that are commonly practiced in these industries are MISRA and ISO 26262. While most engineers are familiar with the names, many of them don’t know exactly what they require. The standards are important for upholding the safety and security of the software. Following the guidelines will help identify and avoid security vulnerabilities in the system.
MISRA
MISRA is a set of coding guidelines and standards for C/C++, released in 1998 by the Motor Industry Software Reliability Association. The standards provide a subset of the C and C++ languages for use in safety-critical applications. The guidelines include over 140 rules for MISRA–C and over 220 rules for MISRA–C++, that cover code safety, portability, and reliability issues that haunt embedded systems developers. Again, it has been widely adopted for safety-critical development in industries outside of automotive, such as telecom, aerospace, defense, railroad and medical.
ISO 26262
Another highly adopted standard is a Functional Safety standard titled “Road vehicles – Functional safety”, or: ISO 26262. It applies to passenger vehicles up to 3500 kilograms (7716 pounds) and addresses potential safety vulnerabilities in electronic and electrical systems, like anti-lock brakes, advanced driver assistance systems (ADAS), engine control units, and digital instrument clusters. The standard is an adaptation of the higher-level IEC 61508 standard, which sets out requirements for ensuring that systems are designed, implemented, operated, and maintained to provide the required safety integrity level (SIL).
While MIRSA guidelines focus on coding standards, ISO 26262 also requires use of better development processes, to ensure that development lifecycle processes and tools avoid or control safety and security vulnerabilities. Measures like Automotive Safety Integrity Levels (ASIL) and artifacts like Hazard Analysis and Rish Assessments are put in place to ensure the required level of safety.
Avoid bumps in the road: Automate risk assessment and remediation
As the partnerships between software communities and the transportation, aerospace, and railway industries continue to raise levels of innovation higher and higher, it’s important to uphold security and be vigilant from the very start of the development process. Each stage – from planning to production must include security measures and precautions to locate and eliminate any safety or security vulnerabilities as soon as possible. As always – an early fix will save you valuable resources down the road. Automated tools put in place in the earliest phases of development will assist in ensuring that quality standards are maintained and any vulnerability is remediated swiftly.
