Making Security a Priority in Connected Cars

Malte Pollmann is CEO of Utimaco.

The automobile has evolved from a machine that gets us from point A to point B, into a computer on wheels, and even a shop on wheels. As a result, all eyes are on cybersecurity for the connected car.

New cars are now equipped with 3G and 4G connectivity, and consumers are getting used to the growing number of novel conveniences like parking assistance, internet connectivity, streaming media, traffic guidance systems and safety alerts. Though we’re moving closer to the reality of vehicle-to-vehicle communication (V2V), vehicle-to-infrastructure communication (V2I) and autonomous cars, we have yet to see all of the possibilities the connected car can bring. This is why, in parallel to these advances, it’s imperative that the connected vehicle provide a solid foundation and make deeper investments into V2V security, if it’s ever to reach its full potential.

A recent survey from Accenture shows that consumers want to stream music and surf the internet, all while their car identifies issues and helps navigate traffic. They also hope to have access to social media and email dictation, and features like night vision, fatigue warning, blind spot devices, car-to-car communication and finally autopilot. More and more, this conglomeration of technologies will become a standard, not a luxury. But what’s the payoff when this suite of comforts can be accessed by a third party when the driver is behind the steering wheel? The connected car is a goldmine for hackers, and highly susceptible to security breaches. IHS Markit tells us there are nearly 112 million connected vehicles around the world, and the global market for automotive cybersecurity is expected to grow exponentially.

The Hack: It’s not a Matter of if, but When

The growing number of Internet-connected devices and accessories in the connected car opens it up to new potential points of attack for cybercriminals. Connected vehicles are tied into a variety of outside networks for communications, navigation, maintenance, and even the ability to be directed by apps on smart phones, providing an ever-growing attack surface with an increasing number of points (or vectors) where an attacker could try to gain access into the environment. For the connected car network, it will not be a matter of if you are impacted by a vulnerability exploit or breach, it will be a matter of when.

Failing to properly secure the connected car means more than just putting your personal information at risk; it can take key components of the car offline, rendering it undriveable or something even more catastrophic. For example, it’s been made public via Wikileaks that CIA employees have worked to infect vehicle controllers with malware, under the code word “Vault 7.” Hacker groups like the Shadow Brokers have already exploited these NSA tools, including the notorious WannaCry ransomware exploit that temporarily knocked key business offline, and show no signs of stopping. It is just a matter of time when an exploit kit aimed at the connected car hits the dark web.

The threats to connected cars have been made clear, but the Herculean task now at hand is implementing top-level security practices under time-sensitive and high-pressure conditions. Car makers are in an arms race to develop these vehicles, hoping to gain a competitive edge and become the go-to name in the market. Complications rise to the surface as the hours spent developing the exciting, futuristic features of the connected car far outweigh time spent examining the security issues abound in integrated IT systems. More to the point, manufacturers are still adapting to the processes and structures that are standard to the traditional production of IT.

As Car Becomes Computer, There’s No Need to Start from Scratch

As the automotive industry realizes security must be at the core of the connected car, it faces the challenge of integrating proven IT and security solutions that reliably secure both networked production sites and the vehicles themselves. Consumers are clearly excited, but expectations are high – they want advanced connected cars and expect manufacturers to thoroughly secure their vehicle, as well as provide ongoing security updates. Since manufacturers are just dipping their toes into the business of cybersecurity and are under pressure to deliver quickly, it’s imperative they take note from highly regulated industries with deep security experience like technology and finance.

The current state of the automotive market tells us that the transformation to connected/networked vehicles can only succeed cross-company as industry standards – protocols and processes – must be implemented across the board. Legislators may be reluctant to force them upon the industry, leaving car makers to define best practices and de facto industry standards. As part of this process, they should consider current standards from other highly-regulated sectors such as banking, and adapt to their specific needs. Car makers may find themselves navigating financial regulations, for example, to ensure that connected vehicles can safely and securely execute transactions and simple payment processes when refueling/recharging at the (electrical) station, automatically billing parking tickets and purchasing new parts and gear as needed, among other scenarios.

Building the Connected Car Starts with the Box

As auto manufacturers attempt to ingrain themselves in the practices of IT and security to get their connected cars on the road, they have the advantage of learning from other industries. Security standards have already been established in the technology and finance sectors, and they can be adapted by the automotive industry to protect the data and systems in networked vehicles. At the center of consistent security is end-to-end encryption, in which hardware security modules (HSMs) constantly establish protection via authentication. They are used, for example, in the following methods:

Security will Make or Break the Connected Car

As the automotive industry scrambles to develop vehicles with an impressive suite of IT features that stand out from the crowd, it is essential security is not seen as an added feature, but a prerequisite. The connected car will only reach its full potential if security is made a top priority – safety risks within the vehicle as well as threats to greater networks like the electric grid have the potential to create serious safety issues and unwanted disruptions to service.

Facing this new phase in the industry, auto manufacturers that have traditionally been tasked with providing safe, sturdy and well-built vehicles are switching gears to build hyper-connected and equally secure next-generation cars with the sleekest, coolest tech that can play the field with smartphones and other devices. But when cars become computers, the everyday traffic jam is a hacker’s paradise. To ensure security is fundamental to the development of the connected car, auto makers and OEMs must implement practices that quickly resolve any detected safety gaps during the process of production and systems development. Similarly, big industry players will be encouraged to join forces to develop cross-company/industry standards and adopt and adapt established ones.

Opinions expressed in the article above do not necessarily reflect the opinions of Data Center Knowledge and Penton.

Industry Perspectives is a content channel at Data Center Knowledge highlighting thought leadership in the data center arena. See our guidelines and submission process for information on participating. View previously published Industry Perspectives in our Knowledge Library.