  We propose a holistic methodology for designing automotivesystems that
consider security a central concern at every design stage.During the concept
design, we model the system architecture and definethe security attributes of
its components. We perform threat analysis onthe system model to identify
structural security issues. From that analysis,we derive attack trees that
define recipes describing steps to successfullyattack the system's assets and
propose threat prevention measures.The attack tree allows us to derive a
verification and validation (V&V)plan, which prioritizes the testing effort. In
particular, we advocate usinglearning for testing approaches for the black-box
components. It consistsof inferring a finite state model of the black-box
component from its executiontraces. This model can then be used to generate new
relevanttests, model check it against requirements, and compare two
differentimplementations of the same protocol. We illustrate the
methodologywith an automotive infotainment system example. Using the advocated
approach, we could also document unexpected and potentially criticalbehavior in
our example systems.
