Rules and Guidelines
Want to participate in the discussions? Please read our Community Rules and Guidelines. Need some help? Visit Support and Answers.

  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 15 subscribers
  • Views 1759 views
  • Users 0 members are here
Options
You may also be interested in
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Automotive Cyber Security

Deborah-Claire McKenzie
Connected vehicles have numerous potential benefits for convenience, safety, travel time and access to mobility, and the features that deliver these have become essential selling points. Advances in autonomy will increase the number and types of connections and travellers’ reliance upon them. In 2020, most new vehicles are connected vehicles and many have online connections to safety-critical systems, putting them at risk of deadly hacks. It’s not clear that the automotive industry is fully equipped to deal with this and they may even be deceiving the public about their lack of preparedness.


In response to these challenges, the new UNECE WP.29 type approval regulations for cybersecurity and over-the-air (OTA) updates enter into force in January 2021. The cybersecurity management standard ISO/SAE 21434 “Road Vehicles – Cybersecurity Engineering” is also hotly anticipated next year. But is the industry ready?

Stepping up in this connected world is a major challenge for the established automotive industry and Intelligent Transport Systems (ITS) providers. A number of these challenges can’t be solved without addressing deep-rooted issues such as reluctance to collaborate, a lack of specialised security talent, and engineering processes that don’t consider security throughout the lifecycle.


The ARTS TN have organised a webinar on Automotive Cyber Security on 21 October 2020 at 11.00hrs BST. Ahead of the webinar we’d like to hear your views on the following questions:


•    How well are automotive and ITS businesses positioned to deal with security in their products and services? 

•    What do the various industries need to do to create conditions where security can be assured by design throughout the lifecycle of their products and services? 

•    What are the gaps, how big are they, and what capabilities are needed to address them?


If you have other questions that you’d like to post here, we will also consider these for discussion by our experts in the Q&A panel during the webinar.

Parents
  • 0
    It's a very good point to make, Andy. From my observations, it's not only independent review that is an issue, it's also a problem between companies working together. It's very difficult to build the big picture. There's an interesting paper by one of my fellow PhD students at Coventry "Cybersecurity threats in the auto industry: Tensions in the knowledge environment" https://www.researchgate.net/publication/341610540_Cybersecurity_threats_in_the_auto_industry_Tensions_in_the_knowledge_environment which has some revealing insights about the lack of a collaboration culture.

    The UNECE WP.29 regs, supported by ISO/SAE 21434 will be a much needed focal point, as industry has been desperate for something to coalesce around on these issues. 21434 will specifically require that "A cybersecurity audit shall be performed to independently judge whether the organizational processes achieve the objectives of this document" and the DIS has been out since February, but I suspect this won't hit home until the standard is in force. It's going to be a steep learning curve for the manufacturers, the independent reviewers and the regulators. I'm involved in the development of ISO PAS 5112 currently, which is an auditing standard tied to 21434, but it's early days for that and it won't be a full standard. One of our speakers, Paul Wooderson, will be talking more about this at the webinar.
Reply
  • 0
    It's a very good point to make, Andy. From my observations, it's not only independent review that is an issue, it's also a problem between companies working together. It's very difficult to build the big picture. There's an interesting paper by one of my fellow PhD students at Coventry "Cybersecurity threats in the auto industry: Tensions in the knowledge environment" https://www.researchgate.net/publication/341610540_Cybersecurity_threats_in_the_auto_industry_Tensions_in_the_knowledge_environment which has some revealing insights about the lack of a collaboration culture.

    The UNECE WP.29 regs, supported by ISO/SAE 21434 will be a much needed focal point, as industry has been desperate for something to coalesce around on these issues. 21434 will specifically require that "A cybersecurity audit shall be performed to independently judge whether the organizational processes achieve the objectives of this document" and the DIS has been out since February, but I suspect this won't hit home until the standard is in force. It's going to be a steep learning curve for the manufacturers, the independent reviewers and the regulators. I'm involved in the development of ISO PAS 5112 currently, which is an auditing standard tied to 21434, but it's early days for that and it won't be a full standard. One of our speakers, Paul Wooderson, will be talking more about this at the webinar.
Children
No Data

Community Rules & Guidelines