Solving The Connected Car Security Conundrum
1. In the wake of the damning report by US senator Markey, are public fears surrounding car hacks justified?
Volvo: There is certainly no reason to be complacent. This is a very serious subject and Volvo Cars is well known for treating safety as a top priority. However, looking at different news reports, it is easy to mix the topic of protecting position and status data of a car with the concept of externally taking control of a moving vehicle.
These are very different subjects as it is viable to physically ring-fence car control systems from the vehicle communications network. The challenges of preventing someone from learning information on the position and status of a vehicle is similar to the challenge faced by any communication device such as a phone or a lap top.
Security Innovation: The public should be concerned, but panic is not justified. The leading web and technology companies have been tackling cybersecurity issues for many years, and still fall victim to hackers on occasion. As cars become increasingly connected, remote hacking attacks are a bigger threat and will happen. But cyberattacks on cars probably won’t become as commonplace as web attacks, as hacking a car is difficult to do, difficult to scale, and the financial incentive is limited.
2. What are the biggest challenges to connected car security at the moment?
Volvo: Possibly the biggest challenge to car security is speed of change. In comparison to other consumer electronics items, car development is slower and in the main, upgrades and security patched require bringing the car in to the dealer, usually only at a scheduled service. Over the Air Updates could be seen as a solution to this however opening this gateway is a double edged sword.
Security Innovation: The Controller Area Network (CAN) bus, which connects most Electronic Control Units (ECUs) in a car, is a very old technology with limited bandwidth. Until recently, most data sent over the CAN bus had not been encrypted, leaving cars wide open for enterprising hackers. Now, carmakers are beginning to adopt encryption protocols to protect CAN communications. But the limited bandwidth and message sizes of the CAN bus limit the effectiveness of crypto solutions.
3. Which connected vehicle entry points are most vulnerable to breaches and why?
Volvo: Every effort is made to secure all entry points. The telematics unit is low risk as only limited networks are accessible through this channel. To gain access to other systems it is necessary to gain access to the vehicle and then it is still easier to disrupt mechanically than digitally.
Security Innovation: The On Board Diagnostic (OBD-2) port is extremely vulnerable to breaches, because it has direct access to the CAN bus and is being interfaced through various 3rd party dongles with Bluetooth to mobile phone connections. Often these 3rd party dongles, which are used for Usage Based Insurance, Driver Monitoring or Engine Performance Enhancers, aren’t designed with security in mind and can allow hackers direct access to the CAN bus.
4. Does automotive security need standards, and if so where should they come from?
Volvo: Standards can help although in this area they may progress slower than the development required. It is absolutely in the interests of the car industry to pursue the highest standards of digital security. If standards are developed it should be a collaborative effort.
Security Innovation: Security is a cost that often does not help enhance demand for or the selling price of a product. As a result, companies must balance security and profitability. Auto makers and their subcontractors typically operate with very thin margins, which makes spending on security even more difficult.
Without mandatory security standards, there will be cases where someone in the supply chain cuts back on security due to costs, which could potentially lead to injury or loss of life down the line. Government issued standards is likely the only way to ensure that security is adopted throughout the automotive supply chain, but these standards will result in increased costs to consumers.
5. Is security a high enough priority to companies working in the connected car?
Volvo:Within Volvo Cars, safety in and around our cars and digital security is the highest priority.
Security Innovation: As with most large companies, security awareness, concern and implementation is not uniform throughout. There are groups within automakers and suppliers that have been concerned with cybersecurity for some time, while other groups have not even begun. Our experience with many Fortune 500 companies have shown us that organizations go through different stages in the cybersecurity maturity model.
First, they typically go through a “Panic Scramble”, which leads them to buy tools and appoint security leads to start “adding in” security. This usually leads them to the “Pit of Despair” where the sheer number of vulnerabilities and false positives, the lack of training, and waning executive support results in a decline in security priority.
Finally, these organizations begin to adopt security as part of their entire process, rather than an add-on, which allows them to more effectively use tools, develop processes, and train people to move along the cybersecurity maturity curve.
