secure. AUTOMOTIVE. INDUSTRIES

Current State

With the increase of interconnectedness, complexity, and automation of vehicles, the risk of cyber-attacks is rising.
Particularly relevant in this context are

• functions such as connection to cloud services
• applications
• wireless updates of vehicle electronics
• data exchange between vehicles and their environment

Cybersecurity is becoming a core requirement for vehicles and their components and legislators have started to respond to this. Regulations and standards such as UNECE and ISO 21434 are obligating manufacturers, tier 1&2 suppliers, as well as other partners in the eco-system to take digital security into account. At the same time, companies and their internal IT structures and production environments are under immense pressure with regard to cyber-attacks. This means that all market participants are facing several major challenges simultaneously.

Smart & secure solutions and joint efforts are of the essence!

What is secure. AUTOMOTIVE. INDUSTRIES?

• secure.AUTOMOTIVE.INDUSTRIES (SAI) is a thematic platform with the goal of securing the digital automotive future through collaborative and interactive efforts.
• SAI brings together representatives from different areas within the automotive world to work on challenges and projects.
• SAI acts together with partners and contributors in various activities such as SAI events, participation in trade shows & conventions (e.g. with bayme vbm at Automatica 2022), and R&D projects.
• SAI bundles experience, skills, and capacities in joint projects to deliver smart solutions to companies – from medium-sized businesses to large corporations. #AutomotiveCyberSecurity

Summary

Starting in May of 2022, COM|CODE began following the rapid development of the automotive industry and its security implications. The automotive industry has an intricate network of supply chains, numerous companies operating on a global scale, and myriad components being developed at a flat-out pace. This growth has resulted in the modern connected vehicle and its surrounding ecosystem. As vehicles are developed with advanced capabilities including Wi-Fi hotspots, over-the-air updates, mobile application controls, and mid-tier automated driving systems (for example, assisted parking functionality, and lane change assistance), drivers are more connected than ever before. Along with this explosion of connectivity comes increased security concerns—and having to deal with the fallout of inevitable cyber-attacks. Automotive cybersecurity and automotive digital forensics are more examples of our transition into an increasingly digital world, and with it, the need to protect people from the threats that follow. Billions of people stand to be impacted by advents in vehicle technology, especially with the introduction of internet access to cars and remote management features.

Automotive Cybersecurity

Back in May 2022, COM|CODE continued researching relevant automotive cybersecurity standards and regulations to determine their impact on relevant parties such as OEMs and suppliers, such as the early scope of UNR-155 (See Figure 2). It quickly became clear that automotive cybersecurity is forever changing the automotive industry, forcing all players to re-evaluate their methods, responsibilities within the supply chain, and outcomes following cyberattacks (See Figure 3). COM|CODE developed a visual of the connected automotive ecosystem (See Figure 1): Mapping out many of the interconnects between vehicle components and exterior assets such as the cloud, mobile phones, charging stations, etc. With this vast body of research, COM|CODE seeks to inform the ever-growing crowd of those who are impacted by the need for automotive cybersecurity.

Since the beginning of ComCode's automotive cybersecurity resesarch, UN Regulation No. 155 and No. 156 came into effect, changing how our automotive industry operates all the way down to the design and development phase of the vehicle lifecycle. Recent news articles have highlighted how certain vehicle models are being discontinued for various reasons, one of which often includes the new cybersecurity regulations, citing that the cost of implementing proper cyber controls outweighs the benefit of continued production. This comes alongside a vehicle market that is slowing the production of electric and autonomous systems, despite a sharp increase in connected technologies.

Automotive Digital Forensics

Automotive digital forensics is still in its infancy—the limited information available to the public makes it difficult for companies and individuals to determine what they can do should they face cyberattacks on their part of the automotive ecosystem. The information currently available suggests that automotive digital forensics is heading in the same direction as automotive cybersecurity, meaning that it will face significant growth in the coming years. With the rate of vehicle and connected vehicle service hacks on the rise, demand for forensic services will also increase dramatically. The breadth of scope in this field is truly awe-inspiring: every company and individual that relies on automobiles either directly (ex. Fleet services) or indirectly (such as shipping dependencies) is impacted by automotive digital forensics—should a database, application, or component be compromised, whether it be via a supply chain attack, direct vehicle compromise, or connected service hack, millions of people are inevitably impacted—and therefore potentially benefit from automotive digital forensics. Currently, automotive digital forensics is especially utilized in criminal investigations, but there are countless other applications throughout the automotive industry, especially in areas of development, production, fleet use, and rentals. Of utmost importance to COM|CODE is understanding exactly who falls under the scope of automotive digital forensics. It’s also important to ask what use cases they might have. For example, how might they be impacted by future regulatory requirements? How would they best respond to a cyberattack? This field is emerging and therefore companies need to be proactive in understanding how automotive digital forensics will affect their business. If people are caught unprepared without knowledge of the developing automotive ecosystem and associated forensic technologies, an unnecessary number of resources may be spent on disaster recovery.

Automotive Data Privacy

Starting in the Fall of 2023, COM|CODE chose to augment the existing automotive cybersecurity initiative, and shifted focus to the realm of data privacy. Automotive cybersecurity and digital forensics represents a proactive and reactive perspective for attacks on the vehicle ecosystem, however, it became important to assess what will have the greatest impact on consumers in the near term, and better understand the consumer perspective on connected vehicles. The connected vehicle ecosystem is a data rich environment and it's exceptionally vulnerable to data breaches, identity theft concerns, and loss of privacy as a whole.

Throughout the course of our research, it quickly became clear that there are a multitude of fundamental issues within the industry that worsen the problem, namely that vehicle functions and connected servcies are not designed with "privacy by default" and "privacy by design" in mind. The OEMs and third-party providers stand to benefit from the unregulated collection and resale of user data, and this all too often happens unannounced to the owner, or at least with a great deal of confusion after reading through the necessary paperwork to purchase a modern vehicle.