During Cyber Security Awareness month, we will be exploring some cyber related terms and topics you may have heard of but may not fully understand. We hope to raise awareness and ultimately work to improve UK cyber security resilience. In this article, we will explore automotive cyber security. The automotive industry is undergoing a profound transformation. With the advent of connected cars, autonomous driving, and the integration of advanced technologies, vehicles are becoming increasingly more sophisticated. However, this technological evolution brings with it a significant challenge: cyber security. As vehicles become more connected and reliant on software, the risk of cyber threats escalates. This document explores the critical importance of cyber security in the automotive industry, the potential threats, and the strategies employed to mitigate these risks. The Rise of Connected Vehicles Modern motor vehicles are no longer just mechanical transport devices; they are evolving into complex interconnected IT and OT networks of computers on wheels. Connected vehicles can communicate with each other, infrastructure, and the Internet. This connectivity enables a range of features, from real-time traffic updates and remote diagnostics to entertainment systems and autonomous driving capabilities. Benefits of Connectivity Connectivity offers numerous benefits to consumers and manufacturers alike. It has almost become expected now for drivers to be able to connect their mobile phones to their vehicles infotainment systems in order to seamlessly access messages, calls, and listen to music whilst on the move. Vehicle maintenance now becomes more efficient with predictive diagnostics that alert owners to potential issues before they become serious problems. Additionally, over-the-air (OTA) updates allow manufacturers to improve vehicle performance and add new features without requiring a visit to the dealership. As autonomous vehicles (AV) improve and become more common, so too will connectivity such as vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) connectivity. V2V is an integral part of an automotive system that can increase safety for all road users. For instance, if a pedestrian is in the road but not seen by one autonomous vehicle, V2V communication may alert other vehicles to the pedestrian’s location so that the pedestrian is seen. V2I connectivity enables AVs to exchange data with roadside equipment such as traffic lights. Challenges and Risks Despite these advantages, the increased reliance on software and connectivity can expose vehicles to significant cyber threats. Hackers can potentially gain access to critical vehicle control systems, compromising both vehicle safety and privacy. The consequences of a cyber-attack on a connected vehicle can be severe, ranging from theft of personal data to control over crucial vehicle safety functions. Although cited as a benefit of connectivity, early OTA updates were not without vulnerabilities:
- In 2016, security researchers found a vulnerability in Tesla’s OTA update system that could be exploited if an attacker had access to the car’s network. However, Tesla’s strong security measures, such as encryption and digital signatures, made this a difficult attack to carry out in practice.
- In 2018, researchers discovered vulnerabilities in BMW’s ConnectedDrive, which allowed attackers to manipulate OTA updates and gain unauthorised access to vehicle functions. This was a case where flaws in the implementation of the security protocols left the system exposed.
Potential Cyber Threats in the Automotive Industry Several types of cyber threats pose risks to the automotive industry. Understanding these threats is essential for developing effective countermeasures.
- Remote Hacking involves gaining unauthorised access to a vehicle’s systems via wireless communication channels, such as Bluetooth, Wi-Fi, or cellular networks. Once inside, hackers can manipulate various functions, including braking, acceleration, and steering. This type of attack can have catastrophic consequences, endangering the lives of passengers and other road users.
- Malware and ransomware attacks can infect a vehicle’s infotainment system or other connected devices, locking users out or demanding a ransom to restore functionality. These attacks can disrupt the driver’s ownership experience and potentially lead to more severe security breaches if not addressed promptly.
- Data Breaches. Connected vehicles collect and transmit vast amounts of data, including personal information, driving habits, journey and location data. Cyber criminals can target this data, leading to privacy violations and identity theft. Protecting sensitive information is paramount to maintaining consumer trust and complying with data protection regulations.
- Supply Chain Vulnerabilities. The automotive supply chain is complex, often involving numerous international suppliers and third-party vendors. Each link in the chain represents a potential vulnerability. A single compromised component or software update can introduce malware into the vehicle, highlighting the need for rigorous security measures throughout the supply chain.
Strategies for Enhancing Cyber Security To address these threats, the automotive industry needs to adopt a comprehensive approach to cyber security. This involves implementing robust security measures at every stage of the vehicle’s lifecycle, from design and manufacturing to maintenance and updates.
- Secure Design and Development Cyber security should be a fundamental consideration during the design and development of vehicles. This includes adopting secure coding practices, conducting thorough security testing, and implementing encryption and authentication protocols to protect data and communications. Manufacturers must also ensure that hardware components meet stringent security standards. UN Regulation No. 155, also known as the Cybersecurity Management Systems (CSMS) regulation, mandates that vehicle manufacturers implement comprehensive cyber security measures to manage and mitigate cyber risks throughout the vehicle’s lifecycle. This has been mandated for all new vehicles by July 2024. Similarly, UN Regulation No. 156, known as the Software Update Management Systems (SUMS) regulation, requires manufacturers to establish robust processes for managing software updates, ensuring that vehicles remain secure and up-to-date with the latest security patches.These regulations were introduced by the United Nations Economic Commission for Europe (UNECE) to enhance the cyber security and software integrity of modern vehicles, thereby protecting them from cyber threats and ensuring the safety and privacy of vehicle users.
- Continuous Monitoring and Threat Detection Once a vehicle is on the road, continuous monitoring and threat detection are essential to identify and respond to cyber threats in real-time. This can involve deploying intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor network traffic and detect anomalies. Additionally, manufacturers should collaborate with threat intelligence and security risk researchers to participate in information-sharing initiatives to stay ahead of emerging threats
- Regular Software Updates Regular software updates are crucial for maintaining vehicle security. Over-the-air (OTA) updates allow manufacturers to address vulnerabilities and improve security features without requiring physical access to the vehicle. Consumers should be encouraged to keep their vehicle’s software up to date to benefit from the latest security enhancements.
- Supply Chain Security Ensuring the security of the automotive supply chain is vital. Manufacturers must conduct thorough security assessments of their suppliers and require them to adhere to strict security standards. This includes regular audits, vulnerability assessments, and the implementation of secure update mechanisms to prevent the introduction of malicious code.
- Consumer Awareness and Education Educating consumers about the importance of cyber security is essential. Drivers should be aware of the potential risks and take steps to protect their vehicles, such as using strong passwords, avoiding insecure public Wi-Fi networks, and regularly updating their vehicle’s software. Manufacturers can play a role in raising awareness through educational campaigns and providing clear instructions on cyber security best practices.
The Role of Regulation and Standards Governments and regulatory bodies have a crucial role to play in enhancing cyber security in the automotive industry. Establishing clear guidelines and standards can help ensure that manufacturers adopt best practices and maintain a high level of security.
- International Standards such as ISO/SAE 21434 Road vehicles — Cybersecurity engineering, ISO 26262:2018 – Road Vehicles Functional Safety, ISO 15118 – Road Vehicles – Vehicle to Grid Communication Interface, and ISO 21448:2022 – Safety of the Intended Functionality (SOTIF), provide a framework for managing cyber security risks throughout the vehicle’s lifecycle. These standards outline requirements for safety, secure development, testing, and maintenance, helping manufacturers implement robust security measures.
- Regulatory Initiatives such as the European Union’s General Data Protection Regulation (GDPR), UN Regulation No. 155 and UN Regulation No. 156 set forth requirements for data protection and vehicle cyber security. Compliance with these regulations is essential for manufacturers to avoid penalties and maintain consumer trust.
Conclusion As the automotive industry continues to evolve, cyber security must remain a top priority. The integration of advanced technologies and connectivity offers numerous benefits, but also introduces significant risks. By adopting a comprehensive approach to cyber security, including secure by design principles, continuous monitoring, regular updates, and supply chain security, the industry can protect vehicles and their occupants from cyber threats. Collaboration between manufacturers, regulators, and consumers is essential to creating a secure and resilient automotive ecosystem. Ultimately, ensuring the cyber security of connected vehicles is critical to the future of transportation, safeguarding both innovation and safety on the road. Get in touch to find out how we can use our expertise to help secure your business.