Cars in the crosshairs: Automakers, regulators tackle cybersecurity

These days, if something is connected to an information stream, it's vulnerable to cyberattacks. And since modern cars are essentially data centers on wheels, it's easy to understand why they have piqued the interest of hackers.

Cars connect over a number of different interfaces -- including USB, CAN bus, WiFi, Bluetooth, cellular, and automotive ethernet.

This doesn't just give cybercriminals a veritable smorgasbord of attack options, it's a nightmare for a company's engineering and testing teams to secure.

But regulators aren't waving a white flag. In fact, they have outlined a blueprint to fight back.

The big picture

The World Forum for Harmonization of Vehicle Regulations, UNECE WP.29, is a wide-ranging strategic initiative to bring automakers into lockstep on a variety of vehicle regulations.

In June 2020, WP.29 adopted a new framework that resulted in a pair of regulations -- instructing automakers to implement measures to:

• Manage vehicle cybersecurity risks
• Secure vehicles by design to mitigate risks along the supply chain
• Detect and respond to security incidents across the vehicle fleet.

The forcing function

The chief regulation to come out of WP.29's cybersecurity framework, UN R155, mandates that automakers build cybersecurity into the full life cycle of their vehicle engineering processes.

In layman's terms, it boils down to two key details:

1. Automakers must establish and implement a cybersecurity management system (CSMS) that implements risk-driven engineering processes for vehicular components, subsystems, and assemblies.
2. Automakers must demonstrate compliance within their CSMS to secure "type approval" from the UN. Without approval, a vehicle won't be allowed to operate on public roads.

Key to compliance

If you imagine UN R155 as a lock, then ISO/SAE 21434 is the key.

Whereas UN R155 mandates the deployment of a CSMS, ISO/SAE 21434 explains how to actually implement one.

“Security” is a constantly moving target. You only need to test functional safety once per component. But with new threats, exploits and vulnerabilities emerging every day, cybersecurity testing is anything but a "one-and-done" proposition.
 
That is where a CSMS comes in. A good CSMS requires applicable threats to be evaluated extensively -- which is accomplished via a Threat Analysis and Risk Assessment (TARA).

Following a TARA, automakers can identify, implement and verify mitigations, before pushing them out to components and systems via software update.

With an efficient CSMS, automakers can re-evaluate and mitigate emerging threats in a timely manner -- all while ensuring their fixes don't inadvertently expose other components or systems to attack.

How can automakers fight back against cybercriminals?

It all comes down to thinking like the enemy.

Where a cybercriminal would seek to exploit system and component vulnerabilities, automakers can perform controlled cyberattacks to accurately test vehicular security in accordance with their CSMS.

Sometimes referred to as automotive penetration testing, this practice encompasses multiple test types -- including functional cybersecurity testing, fuzz testing, and vulnerability testing.

Not only do these tests need to cover a comprehensive suite of potential threat vectors, but they also need to account for the various points of ingress an attacker can take. That means testing across all the interfaces a modern car uses.

But that's only half the battle. Software updates -- the preferred method to mitigate vulnerabilities across automotive components and systems -- require extensive reverification.

This process is painstakingly iterative, and automation is key to making this a reality.

At the end of the day, compliance with UN R155 demands a repeatable, scalable and well-documented testing approach. And between sprawling attack surfaces, emerging threats and mandatory compliance processes, integration and automation aren't luxuries -- they are essentials.

Protect what matters most

By its very nature, the world of cybersecurity is in a near-continuous state of change.

In the coming years, we will likely see a mass proliferation of new attack vectors, component threats, and system vulnerabilities.

It should come as no surprise, then, that the automakers who respond the swiftest will emerge as the most protected, the most secure and the safest choice for discerning customers.