How do we secure vehicles that are now tech products?

The global market for smart vehicles is set to grow by 17% CAGR. The forecasted market size for 2032 is US $265.7 Billion. This includes smart automobiles like electric, autonomous, hybrid², etc.

A report by the Boston Consulting Group stated that by 2030, software-defined vehicles will create a value of more than $650 Billion for the automotive ecosystem. The automotive software and supplier market is also poised to double from $236 Billion to $411 Billion during this time frame.³ According to a McKinsey report, about 95% of new automobiles sold in 2030 will be connected and about two-thirds of customers will switch automobiles for a better autonomous driving car.⁴

These statistics indicate that the collaborations and partnerships between automotive manufacturers and technology or software providers will grow. This fosters rapid scaling, innovation, and a competitive edge.  The IT investments are already rising. For instance, General Motors (GM) announced the Ultifi software platform in 2020 for an enhanced vehicle experience. GM anticipates generating revenues of up to $25 Billion annually by providing software-as-a-service (SaaS) products in the vehicles through Ultifi software.⁵ 

Well, even though the benefits of putting software at the heart of automotive is one thing, it must be protected. Any device with software and connection to the internet is susceptible to hacking, posing potential digital risks. SDVs have complex software algorithms and sensors to navigate the environment. As more digital technologies come into the picture, the attack surface grows along with it – meaning the risks of facing a cyber-attack grow.

SDVs can have as many as 100-150 electronic controller units (ECUs) that are responsible for temperature, fuel injection, braking, and object detection. These ECUs are interconnected and are constantly interacting and exchanging data. Each of these can serve as an entry point for an attacker.

Rising entry points for hackers

As the architecture gets sophisticated with time, Centralized High-Performance Computing (HPC) platforms are being adapted to reduce the number of individual ECUs and facilitate a standardized development environment. This architecture reduces the number of entry points for hackers. For instance, any automobile that has a remote access feature has a possibility of being hacked. A hacker who has gained unauthorized access to your vehicle may attempt to take control of the critical functions. 

In 2022, a white hat hacker claimed that he found a way to hack Tesla electric vehicles by gaining remote access by exploiting third-party software. The hacker could gain access to some functions of the car. But it was just a white hat hacker trying to be curious, an organized group of criminals with sophisticated tools can cause a lot more damage.⁶

In 2023, some Ph.D. students from Germany tried to gain access to the rear heated seats (hardware) of a Tesla car. By jailbreaking, these students were also able to get hold of user data and some of its internal systems. Tesla’s rear seat heating is a feature that can be unlocked by paying a fee of $300. They managed to activate seat-heating without paying any fee.

Newer features open more avenues for hackers

More OEMs are rolling out such features - putting hardware and software behind the paywall. For instance, Mercedes-Benz announced that electric EQE and EQS can increase acceleration by paying $60/month. BMW also offers similar paywalled services.⁷ Users trying to bypass subscriptions by jailbreaking or using rogue software could lead to the launch of malware in the SDVs – which further increases the cyber risks. Over-the-air updates also provide an opportunity for hackers to gain access to vehicle systems. This could involve launching malware that manipulates the data. Imagine, a car not being able to identify maintenance and repair due to data manipulation done by malware. There are several other possibilities. Well, the motive for cybercriminals could also be data theft since these smart automobiles store a lot of users’ personal information. 

Software-defined vehicles don’t mean it’s an open invitation for the hacker to exploit. With stronger protection measures, they can be protected against digital threats. In-car security can be implemented to protect Electronic Control Units (ECU) and critical systems. This is done by using encryption and authentication methods. Since SDVs rely on networks for continuous communication and updates, network security becomes crucial too. OEMs can use a firewall and intrusion prevention systems to filter and monitor the traffic. Additionally, it imposes stronger encryption and authentication mechanisms ensuring only authorized communication occurs. Let’s talk specifically about intrusion detection systems (IDS).

Intrusion Detection System (IDS) Solution

Given the nature of the attacks and the evolving threat landscape, cars need to have threat detection in real time. IDS fits the bill here. The intrusion detection system monitors network traffic and analyzes patterns continuously. IDS uses signature-based detection to find attack patterns and anomaly-based detection to spot unusual activities. It inspects incoming and outgoing data packets – hunting for suspicious activities. IDS triggers alerts and notifies the security teams or Security Operations Center (SOC) team to respond to the identified threats.

IDS prevents unauthorized access, data breaches, malware infections, and cyber risks. Automakers can use IDS not only for early threat detection and incident handling, but also for better compliance rates. 

Automotive Penetration Testing Solution

Penetration Testing is an important approach to assess the security posture of the SDVs. Simulating real-world attacks helps the teams uncover weaknesses and gaps in the architecture, firmware, software, network protocols, and more. Different methods like vulnerability scanning, reverse engineering, fuzz testing, network penetration testing, etc. are deployed to gauge the effectiveness of the existing protection measures. This approach enables OEMs to mitigate risks proactively and fix them before SDVs are launched in the market. With penetration testing, manufacturers can also achieve compliance levels as required by different automotive standards.

Zero Trust Security and Microsegmentation Solutions

Zero Trust enforces strict access controls that continuously verify the identity of any device trying to gain access to a vehicle system or application. As the name suggests, it trusts no user or device, unless the identity and context are verified first. Only authorized devices are granted access to data or applications that they should have access to, and nothing more. It uses the least privilege principle, granting the minimum level of necessary access. By using such strong identity management and encryption protocols, OEMs can secure vehicle data. Apart from identity verification through access control and multifactor authentication, Zero Trust uses the microsegmentation principle. 

With microsegmentation, a vehicle’s internal network is divided into isolated zones or smaller segments, thus limiting the lateral movement of attackers in case of an incident. Security controls and policies can be applied to each of these segments differently, depending on criticality.  These virtual boundaries can prevent the attack from spreading and causing major damage. Zero trust also secures the application programming interface (API) through communication protocols for in-vehicle systems and external interfaces like mobile apps or cloud services to protect against API-related attacks and data breaches. 

Vehicle Security Operations Center (VSOC) for security monitoring solutions

Automotive companies also need a centralized management hub to oversee the security policies and responses – hence the need for VSOC. A VSOC sets and enforces policies, ensuring consistent application across the vehicle fleet. The primary responsibility of VSOC is to continuously monitor and respond to threats in real time. Automotive security monitoring involves continuously surveilling network activities, log files, sensors, GPS, cameras, telematics, and system behaviors. Apart from monitoring, VSOC also deploys tools that collect and analyze logs, network traffic, and system activities in real time. This includes detecting patterns, anomalies, potential threats, etc. Any deviations or suspicious patterns trigger alerts, enabling rapid response from the experts to potential threats. VSOC helps vehicle owners, fleet managers, and law enforcement agencies in security monitoring, incident response, asset protection, and data insights. 
In summary, these protection measures employ advanced technologies like signature-based detection, encryption, authentication, firewalls, network segmentation, and continuous monitoring. This creates a multi-layered defense system for software-defined vehicles. This technical approach helps identify, prevent, and mitigate threats, safeguarding the integrity and functionality of connected cars.

In 2021, the United Nations Economic Commission of Europe (UNECE) enacted first-of-its-kind security regulations UNECE R155, specific to vehicles. The UNECE R155 applies to the automotive industry dealing with connected and automated vehicles (new vehicles produced from July 2024) in the European Union. It has framed guidelines to address potential risks associated with increased connectivity and electronic control systems. 

The key aspects of this framework require the manufacturers to:

• Demonstrate that a cyber security management system (CSMS) is in place for vehicles.
• Conduct risk assessments; provide its analysis.
• Define mitigation measures; and prove they work.
• Provide measures to detect and prevent attacks on vehicles.
• Use of CSMS for streamlined communication and improved efficiency in monitoring.
• Report cyber incidents, if any.

This regulation applies not only to OEMs, but also to their suppliers because the supply chain risks also have significantly gone up. In addition to R155, R156 has also been enacted concerning software management, software versions, software configuration, documentation, over-the-air update management, etc.  

UNECE R155 also directs manufacturers to comply with ISO/SAE 21434 standards, which are broader. R155 emphasizes achieving compliance by defining processes and highlighting the need for security management systems.¹¹ Non-compliance with these regulations may lead to significant fines, penalties, or even suspension of automobile sales in some countries. By adhering to these compliance requirements, an OEM demonstrates a commitment to security, mitigates risks, and avoids heavy penalties. But more than that, they can create a brand reputation, and competitive advantage, and win customer trust.

Advice on making software-defined vehicles more secure

T-Systems can help you implement robust cyber defense for your vehicles and fleet. With our expertise in automotive and security, we can assist you in meeting UNECE and ISO standards for software-defined vehicles. T-Systems can empower you to integrate strong cyber defense measures like IDS, Automotive Penetration Testing, Zero Trust, Microsegmentation, VSOC, and more. We’re ASPICE (Automotive SPICE) Level 2 certified. Our quality project management and engineering processes are tailored to match your automotive software development needs. With our automotive solutions, create a competitive advantage, manage risk better, improve compliance, and offer quality assurance for your customers. Get in touch with us today.