Cybersecurity impact and outlook for automotive systems

Event report

[Read more session reports from the Symposium on the Future Networked Car (FNC-2019)]

The session was moderated by Mr Michael L. Sena (Consulting AB) who explained that we need to find solutions for over-the-air (OTA) updates and that there is a need to assess cybersecurity issues in that regard. He mentioned his report from 2015 which already addressed certain challenges.

Mr Miguel Banon (Vice President, Business Line Cybersecurity, DEKRA) pointed out that the automotive sector is relatively new to cybersecurity issues in comparison with other technology sectors. He explained that safety concerns are well engaged in productive cycles but not in terms of cybersecurity and that there is a need to learn quickly from other types of products. Banon noted the urgent need to develop standards and regulations for the sector because cybersecurity issues will become increasingly important for car manufacturers and the future of networked cars.

Banon spoke about the different approaches in the EU and the US, wherein the former rely more on policy developments, while the latter opt for more regulations which are developed through market powers and insurance approaches. He further pointed to the challenges for future certifications given that networked and automated vehicles will rely on a mix of different standards. Finally, Banon said that there have not been many cyber-attacks on cars yet because there currently is no business case for hackers to do so. However, he foresaw cyber-attacks on car systems becoming more lucrative in the future and that cars will increasingly become targets of such attacks.

According to Mr Martin Rosell (CEO, WirelessCar) cybersecurity must be included in cars from their inception. This also means that cybersecurity must be monitored in every single step of the value chain. His company is working on improving the connections between cars and explained that the data from cars is needed to build ecosystems to turn provide business to business (B2B) and business to customer (B2C) solutions. Rosell also mentioned the extreme complexity in analysing the obtained data given that security protocols are constantly updated. Additionally, given that no connected services incorporated in cars are fully cloud-based, hybrid solutions must be implemented – a challenge in itself in terms of securing cars from cyber-attacks.

He noted that the EU’s General Data Protection Regulation (GDPR) and the Cloud Act in the US have had implications on security. Similarly, China’s prohibition of encryption for data in the cloud makes finding cybersecurity solutions very challenging.

According to Rosell, edge-computing will alleviate some of the cybersecurity concerns, but cautioned that the growing need for sensors on cars also offers a broader front for cyber intrusions.

Mr Amir Einav (VP of Marketing, Karamba Security) explained that his company is incorporating an approach of a self-defending vehicle in terms of cybersecurity. He further mentioned that a lot of progress has been made with the help of white hat attacks on Tesla, Jeep, and BMW vehicles. These white hat attacks are conducted with the intention to improve security by disclosing weaknesses and vulnerabilities in the products

Einav said that the issue of cybersecurity is increasingly being recognised by Original Equipment Manufacturers (OEMs) and that Karamba Security is trying to help manufacturers to keep their systems safe through built-in security solutions. He noted that criminals have sharing networks and that the automotive industry must develop sharing networks of their own to enhance sector-wide exchanges regarding security concerns.

According to Einav, networked and automated cars are Internet of Things (IoT) devices and the automotive industry has a chance of leading the IoT developments.

He also mentioned that attacks might not only be used to take control of the car, but that they might also become targets for their computational power, which can be used for data mining and other types of malicious purposes. However, Einav said that hackers are usually looking for easy targets and that the automotive industry might be able to avoid becoming too much of a target if they incorporate strong safety mechanisms.

Ms Aline Gouget (Technical Advisor, Advanced Cryptography, Gemalto) pointed out that risk assessments and the understanding of global threats are crucial to provide good cybersecurity solutions. She highlighted the fact that increased complexity of cars which incorporate many different technologies make it more difficult to develop cybersecurity mechanisms.

She mentioned that ‘security by design’ must be part of the solution, but warned against incorporating more complexity in car systems by adding too many security layers. Rather than adding to the complexity, cybersecurity solutions should be developed around sound risk assessments which highlight the most vulnerable areas. Additionally, Gouget noted that maintaining user privacy through certificates and encryption is an important challenge because certificates need to be changed regularly in order to ensure the highest level of privacy.

Mr Darren Handley (UN Task Force on Cyber Security and OTA issues (CS/OTA), Department for Transport UK) said that regulations will help to integrate cybersecurity and pointed out that systems must not only be safe, but also resilient. He explained that currently certain legal frameworks could be used to prosecute perpetrators of cyber-attacks but that these are not specific to networked vehicles. Certain breaches could, for example, be prosecuted under the GDPR.

According to Handley, manufacturers need to show their efforts in terms of securing vehicles from cyber-attacks in order to give people confidence in the new products. He also introduced the idea of creating an oversight body which would control the levels of cybersecurity used by car manufacturers.

Mr Shay Horowitz (Head of Marketing, Cymotive) noted that the industry is still learning how to keep devices secure over time and future proof. He also mentioned that so far there have been no malicious cyber-attacks, but rather, attacks with the intent of furthering safety.

He encouraged car manufacturers to conceive cars like a software company would in order to better prepare for potential attacks. He insisted that the industry should think like hackers and that then they will be able to understand how their cars could be attacked. This step will facilitate the development of built-in security attackers.

Mr Oren Betzaleli (Senior Vice President & GM, Software Platforms, HARMAN) noted that more attacks on cars will occur in the future due to the massive connection of cars which will provide a business case for malignant hacks.

Betzaleli explained that the conception of resilient systems is of the highest importance as well as conceiving ways to react to an attack. Therein, OTA systems should be made mandatory which could rollout security patches according to Betzaleli.

Mr Koji Nakao (Rep. ITU-T SG17, NICT, Japan) spoke about the challenges of conducting cybersecurity risk assessments given the complexity of networked cars. He further noted the difficulty of disclosing security vulnerabilities to manufacturers because they often do not wish to expose themselves by publicly acknowledging them. Another difficulty is the verification of disclosed vulnerabilities by manufacturers which is why certain companies are starting to create verification mechanisms for vulnerabilities about their products which have been disclosed by third-parties.

Nakao explained that with most attacks, many IoTs are already infected and that infections are often not installed into the device directly – but that they are integrated into the various gateways. Therefore, risk assessments for cyber-attacks on networked cars should also involve the analysis of external infrastructures.