Connected cars continue to drive security concerns says Raj Samani, CTO EMEA, Intel Security.

With the world expecting 150 million connected cars on the roads by 2020, it’s not just the automotive industry that’s paying attention to this new wave of innovation. In fact, even the Queen has something to say on the matter. In the Queen’s speech earlier this year, Her Royal Highness introduced changes to enable driverless cars to be insured under ordinary policies.

This commitment to furthering the development of the driverless car economy was echoed by the UK government just this month, with the launch of major consultation to help pave the way for automated cars to be used on British roads.

Such forward thinking will ultimately be a fantastic boost to the UK economy. According to Intel, connected cars are the third‑fastest‑growing technological devices after phones and tablets. It is equally important, that in its pursuit of innovation, the government and indeed the automotive industry, doesn’t neglect the security essentials, which will guarantee the success of these new technologies, as well as the safety of its users.

Whenever new technology is adopted, criminals look to identify ways to exploit them for financial gain. As the world’s connectivity continues to grow, so too do the risks of attacks from cybercriminals.

The potential to hack and gain control of connected vehicles is a very real threat and has been clearly demonstrated through a number of demos. We are yet to see this translate into real‑world attacks, however as with any crime, it is just a matter of requiring a motive. Generally, cybercriminals take action with the aim of financial gain. If driverless and connected vehicles are to become commonplace in the UK and globally, it is just a matter of time before attackers find a means to use this as an opportunity to fulfil one of these motives.

Considerations ahead of the connected car innovation influx

Intel developed the Automotive Security Review Board (ASRB), in conjunction with founding members Aeris and Uber. We form a collaboration of top security and automotive industry talent from across the globe, who work together to stay one step ahead of cybercriminals and secure vulnerabilities before criminals have the opportunity
to turn this potential risk into a dangerous reality.

By adding internet connectivity to cars, the auto industry is enabling exciting new features, such as real‑time telematics, smart intersections, and autonomous driving. However, it is also exposed to the full force of malicious activity. This is driving the need for designed‑in security solutions to ensure that next‑generation cars can operate to their full potential in a malicious operating environment.

Security from design

Like safety and reliability, vehicle security starts in the design phase. Consolidation and interconnection of vehicle systems requires a security design that is intentional and proactive. Expanding on experience from related industries, such as defence and aerospace, there are some foundational principles that can be utilised: defence‑in‑depth, similar to the layers of protection analysis (LOPA) methodology used for safety and risk reduction, and designing secure systems from the hardware to the cloud with identified best practices and technologies for each discrete building block. These include such things as secure boot; trusted execution environments; tamper protection; isolation of safety critical systems; message authentication; network encryption; data privacy; behavioural monitoring; anomaly detection; and shared threat intelligence.

On the production line

But it doesn’t stop with design; automotive security needs to continue right through to the production and operation stages. Best practices for production processes ensure that the design components are correctly implemented and their implementation is linked back to the properties in the secure design, giving customers confidence that the platform is secure. These include code reviews; component and system‑level penetration tests; continuous validation of security assumptions; inbound and outbound materials processes; maintenance and upgrade plans; and a feedback loop for continuous learning and improvement.

On the road and beyond

Threat analysis and risk assessment continues throughout the life of the car as old vulnerabilities are patched and new ones come to light, so the risk of attack can even increase with time. Detailed incident response plans in the event of a newly discovered vulnerability or security breach provide confidence to the consumer and manufacturer. Techniques such as over‑the‑air software or firmware patches and upgrades quickly close vulnerabilities and significantly reduce recall costs. Threat intelligence guides the identification and understanding of potential criminal business models to help prioritise threats, their associated risks, and appropriate incident response. These operational measures require secure chains of trust that are designed into the vehicle and meant to last for its deployed lifetime.

Best practices for automotive security are an evolution and amalgamation of both product safety and computer security.

Some key checkpoints for success include:

Protecting every ECU, even for tiny sensors.

Protecting functions that require multi‑ECU interactions and data exchange.

Protecting data in/out of vehicular systems.

Protecting privacy of personal information.

Integrating safety, security, and usability goals.

Dealing with the full lifecycle of vehicular and transportation systems.

Summary

Before the connected car industry explodes into the mainstream, we need to see security of vehicles and transportation systems improved to such a degree that attacks will be hard to execute, while preventive and mitigation techniques are in place to react to vulnerabilities quickly and before widespread damage can be done. The Automotive Security Review Board’s ultimate goal is to facilitate a world driven by self‑healing cars – vehicles that are able to detect malicious intent, resist attacks and perform self‑repair. Through the collaboration between standards organisations, the automotive industry and security experts, this vision can be achieved.

This article was first published in the September 2016 issue of TEST Magazine. Edited for web by Jordan Platt.