In recent years, connected cars, electric vehicles and automation have been three major driving forces of innovation in the automotive industry. Built on the digitization of in-car systems, these leaps forward by introducing software and connectivity to car IT systems, have opened the door to cyber threats.<\/p>\n
The number of annual\u00a0automotive cybersecurity\u00a0incidents have increased by an astounding 605% since 2016, according to Upstream Security\u2019s\u00a02020\u00a0Automotive Cybersecurity\u00a0Report<\/a>. More than half of these\u00a0cyberattacks\u00a0were carried out remotely by\u00a0hackers\u00a0with the aim of disrupting businesses, stealing property, and demanding ransom. Popular attack vectors included keyless entry systems,\u00a0backend\u00a0servers, and mobile\u00a0apps.<\/p>\n Recognizing the need for cybersecurity standards for connected, digitized and\u00a0autonomous vehicles, the World Forum for Harmonization of Vehicle Regulations (WP.29), a working party of the United Nations Economic Commission for Europe (UNECE), issued new regulations to address these growing risks. UN Regulation No. 155 on Cyber Security and Cyber Security\u00a0Management Systems\u00a0is the first international regulation governing\u00a0modern vehicles\u2019 cybersecurity. Under it, among other provisions,\u00a0automakers\u00a0have an obligation to perform\u00a0vehicle\u00a0cybersecurity\u00a0risk\u00a0assessments\u00a0and monitor and report security incidents.<\/p>\n UN Regulation No. 156 on Software Updates and Software Updates Management Systems introduced a series of standards for software updates, including those over-the-air, to mitigate cybersecurity risks. Adopted in June 2020, these two landmark UN vehicle regulations came into force on 22 January 2021 and are applicable in the 54 countries that are parties to the 1958 Agreement.<\/p>\n However,\u00a0connected vehicles\u00a0are not the only\u00a0vulnerabilities\u00a0the\u00a0auto industry\u00a0faces. They are also big companies with complex IT infrastructures and global\u00a0supply chains. They collect massive amounts of sensitive information from customers, partners and employees and often process payment information on a large scale. Innovation also means the existence of patents and intellectual property<\/a> (IP) whose safeguarding is paramount to an\u00a0automaker\u2019s success.<\/p>\n Personally identifiable information (PII) is protected under data protection laws such as the EU\u2019s\u00a0General Data Protection Regulation<\/a>\u00a0(GDPR) and the\u00a0California Consumer Privacy Act<\/a>\u00a0(CCPA) while the\u00a0Payment Card Industry Data Security Standard<\/a>\u00a0(PCI DSS) enforces the protection of payment systems from breaches, fraud, and theft of cardholder data.<\/p>\n In countries like Germany, carmakers took matters into their own hands: automotive group Verband der Automobilindustrie (VDA) developed an Information Security Assessment (ISA) based mainly on existing international standards ISO\/IEC 27001 and 27002. The VDA then set up the Trusted Information Security Assessment Exchange<\/a>\u00a0(TISAX) to act as an assessment and exchange mechanism through which organizations can submit\u00a0ISA compliance audits<\/a>.<\/p>\n These laws and standards impose several cybersecurity best practices for vehicle manufacturers and the companies that want to work with them. Noncompliance can mean massive financial penalties when it comes to laws such as GDPR and CCPA, the inability to accept credit or debit card payments in the case of PCI DSS or a loss of business contracts in case of a failure to present a valid TISAX assessment.<\/p>\n Automakers can turn to cybersecurity solutions to meet these requirements and protect both personal data and sensitive corporate information. To prevent ransomware and malware attacks, vehicle manufacturers can implement both basic security measures such as the use of firewalls and antimalware solutions, but also more advanced strategies such as the use of\u00a0Trusted Platform\u00a0Module<\/a>\u00a0(TPM) capabilities and the adoption of\u00a0Zero Trust<\/a>\u00a0architecture.<\/p>\n However, malicious outsiders are not the only concern. The automotive industry must also be mindful of insiders. Especially when it comes to IP and sensitive business information, car companies are vulnerable to insider data theft and corporate espionage. Removable devices, in particular, have long been a problem vehicle makers have struggled to address<\/a>. Through small devices such as USBs, data can easily be exfiltrated even from computers located in secured environments and offline machines.<\/p>\n A simple way to address this issue is to use Data Loss Prevention<\/a> (DLP) solutions with device control\u00a0<\/a>modules. Through them,\u00a0automakers\u00a0can monitor, control and block the use of peripheral and USB ports and Bluetooth\u00a0connections. By applying user-based authorization of removable devices<\/a>, they can identify which employee has used a removable device at what time.<\/p>\n DLP also helps prevent sensitive data from leaving the company network. Through predefined profiles for regulations such as the GDPR or CCPA or standards such as the PCI DSS, but also for different categories of IP such as patents, blueprints or proprietary algorithms, automotive companies can apply policies at the data level, ensuring that files containing sensitive data cannot be transferred and any attempt to move it will be logged and reported. Through both device control and DLP policies for data transfers, companies in the automotive industry can thus identify potential malicious insiders<\/a> attempting to steal data and prevent it in real-time.<\/p>\n The\u00a0automotive industry\u00a0often runs multi-operating system networks. Linux is the preferred OS for secured environments and while it is true that it is more resistant to external threats than Windows, it is just as vulnerable to insider threats, whether they come in the form of malicious or careless employees. The same is true of macOS that has recently started gaining more traction in the enterprise.<\/p>\n Automotive companies should therefore search for suitable solutions that offer the same data protection features for Linux and macOS as they do for Windows. While rare, cross-platform solutions like Endpoint Protector<\/a>, which can be applied to all three, do exist. Such tools make company-wide implementation easier and allow admins to control data protection policies for all endpoints from a single interface.<\/p>\n Vehicle manufacturers and all the companies that make up their supply chain, process not only personal and financial information but also sensitive data concerning their prototypes, patents and schematics. Losing them can have a severe impact on a company\u2019s competitive advantage which is why businesses must do all in their power to protect them from both insider and outsider threats.<\/p>\n","protected":false},"excerpt":{"rendered":" In recent years, connected cars, electric vehicles and automation have been three major driving forces of innovation in the automotive industry. Built on the digitization of in-car systems, these leaps forward by introducing software and connectivity to car IT systems, have opened the door to cyber threats. The number of annual\u00a0automotive cybersecurity\u00a0incidents have increased by … <\/p>\nInternal Data Security<\/h2>\n
Protecting Sensitive Data<\/h2>\n
Securing all operating systems<\/h2>\n