How OEMs Drive Cybersecurity in Smart Vehicles

As the automotive industry speeds toward the dream of software-defined vehicles, IT systems are becoming more embedded in the driving experience — opening new attack routes for hackers.

Financial services firm and researcher Evalueserve claims connected cars could exchange up to 4 terabytes of data per day, or the equivalent of around 8 million digital photos. The need to secure this massive data flux is creating an entirely new branch of cybersecurity devoted to the automotive sector.

It’s a branch concerned not only with securing data while a connected car is in use, but also across the automotive life cycle, from manufacturing to aftersales.

Automotive industry cybersecurity is evolving rapidly, because OEMs have not traditionally faced IT security threats in the manufacturing or use of their products. Nor has the industry been a major target for hackers, beyond the malware threats faced by all enterprise operations.

The arrival of software-defined vehicles means the auto industry now needs to get ahead of data encryption, IT platform security and the use of AI and other tools for the enhanced identification of vulnerabilities.

Yet, as things stand, “Vehicle-to-everything and vehicle-to-grid communication security development is reactive, as most technology is still pilot phase and requires strong hardware and software integration,” said an executive interviewed by Evalueserve.

Factory Cybersecurity

OEM manufacturing does boast several cybersecurity strengths. For example, the industry is already encrypting communications within internal components and uses an architecture design based on isolated zones that minimizes the risk of malware transmission in vehicles.

Similarly, devices that the car might connect to, including cellphones, already use secure technologies such as elliptic curve cryptography. And manufacturers rely on secure cloud providers for data storage and over-the-air software updates.

However, as vehicles add more data entry points, concern is growing about the vulnerability of an expanding attack surface. The industry collaborations required for software-defined vehicle development, often involving small or start-up companies, could also create openings for hackers.

Software-defined vehicles will interact with a growing number of IT systems, any one of which could be compromised by a determined threat actor. It’s uncertain whether the legacy systems currently being integrated into connected cars have all the security they might need.

The need to shore up industry defenses is being addressed by an array of cybersecurity providers, operational technology (OT) security specialists and Tier 1 suppliers. These providers are helping introduce cybersecurity best practices such as standardization, code signing, penetration testing, controlled access and monitoring, tamper-evident hardware seals and secure software development life cycles.

In response to security concerns, some OEMs are using virtual security operation centers to aggregate, correlate, analyze and report on vehicle threat data to mitigate risks and manage vulnerabilities.

These centers are usually run by OEMs, for data privacy purposes, but developed by third parties.

Across all fronts, OEMs are seeking to beef up their cybersecurity capabilities, usually in partnership with specialist firms. Only about 5% of current cybersecurity initiatives are developed in house, although this could rise to 20% in the next 10 years as automakers gain experience.