A vehicle security network design device may comprise: a level assigning unit for assigning an automobile safety integrity level (ASIL) which provides a risk management standard for each of a plurality of functional elements in a vehicle that is at least temporarily implemented by a processor; a calculation unit for calculating device's controllability with respect to each of the plurality of functional elements on the basis of a connection structure between the plurality of functional elements and a difference value of the ASIL; and a management unit for generating a risk analysis model of a plurality of functional elements.