The Synopsys Software Integrity Group is now Black Duck®. Learn More

close search bar

Sorry, not available in this language yet

close language selection

Connected cars need better connection to cybersecurity

Taylor Armerding

Feb 27, 2019 / 5 min read

The “connected” car—as in, connected to the Internet—is now mainstream. Ads for modern vehicles are filled with aggressive promotion of features that require connections to the online world—lane assist, GPS, collision avoidance, automatic calls to 911 if there is a collision.

They are also rich in physical safety features—seatbelts, airbags, antilock brakes and more.

But a report out this week by the Ponemon Institute titled Securing the Connected Car: A Study of Automotive Industry Cybersecurity Practices found that they are not so rich in software security. When it comes to what is needed for safe operation in an online world, those vehicles are not yet ready for prime time.

RELATEDAutomotive cyber security challenges revealed in new study

Auto software security report findings

The report is based on a survey of 593 security practitioners, product development professionals and engineers within the industry.

Report

Securing the Modern Vehicle
A Study of Automotive Industry Cybersecurity Practices

This report outlines the main organizational, technical, testing, and supply chain challenges the automotive industry faces and introduces solutions for addressing them.

Perhaps the most encouraging finding is that a majority of respondents are very much aware of the problem. More than two-thirds said the need for better cybersecurity is “urgent,” for obvious reasons: 62% said they think a malicious or proof-of-concept attack against automotive software, technology or components is very likely in the next 12 months.

But other key findings are less encouraging:

  • Software security is not keeping pace with technology in the industry.
  • Few companies—just 10%—have an established cybersecurity team.
  • Less than a third of organizations (31%) educate their developers on secure coding methods.
  • Fewer than half (44%) impose cybersecurity requirements on suppliers and other third parties.
  • A majority said their organizations don’t have the skills, budgets or resources to make their products secure before they go to market.
  • Only 39% said their organization issues timely software updates. And 25% said they don’t deliver security updates at all.
  • While 52% of respondents said they were aware of the potential harm to vehicle occupants from software vulnerabilities, only 31% said they felt empowered to raise those concerns with upper management.

Software bugs in connected cars endanger lives

auto software security modern vehicle

The significance of all this should also be obvious. The modern vehicle is a computer—actually dozens to more than 100 computers—containing more than 100 million lines of code that control everything from the infotainment system to safety systems like steering, acceleration and brakes.

That makes automotive manufacturers software companies just as much as they are transportation companies.

And software vulnerabilities could undermine the safety of those systems and features: Anything online is a target for cyber attackers. A hacker can put not just users’ personal information at risk, but their physical safety as well. Software security is easily as important as seat belts, airbags and antilock brakes.

These risks are not just theoretical. Security researchers Charlie Miller and Chris Valasek made international headlines four years ago when they remotely hacked into a Jeep Cherokee driven by a reporter for Wired magazine. They took control of the air conditioning, wipers, accelerator and brakes from 10 miles away. But they could have done the same thing from thousands of miles away.

The message at last year’s RSA Conference in San Francisco was much the same: Sergey Kravchenko, senior business development manager, future technologies, at Kaspersky Lab, said his firm had demonstrated that hackers can get control of vehicle functions like door locks, brakes and the engine. They can track a vehicle’s location through the GPS.

Report data confirm suspicions about auto software security

auto software security data

Still, even with multiple anecdotes like those, there has been a lack of the comprehensive data needed to understand the industry’s overall cybersecurity posture and its capability to address software security risks inherent in connected vehicles.

This report, commissioned by Black Duck and SAE International, is meant to address that gap.

Tim Weisenberger, project manager, technical programs, Global Ground Vehicle Standards at SAE, said the results provided “empirical data to validate our hunches,” which included not just problems but good news as well.

“The industry really is aware of the cybersecurity threats it’s facing in the entire ecosystem of interconnected vehicles,” he said. “Their resources may be applied a bit more thinly than they’d like, but they’re very aware of their strengths and shortcomings. I think they’re pointed in the right direction.”

And Chris Clark, principal security engineer, strategic initiatives, at Black Duck, said while the survey showed there is still much to be done, “this is not necessarily a negative thing. It’s pretty typical of what we see in other industries—it’s in the process of becoming more mature.”

How to improve software security in connected cars

auto-software-security-area

Much of that maturity, both said, could come from a shift in two areas: perception and development.

The shift in perception, they said, is to move from thinking that security testing is simply an expense with no payback to realizing that it is an investment that will pay dividends with better functioning of components and far less risk to owners—risks that could result in brand damage, expensive recalls and perhaps even more expensive liability.

The shift in development would be what the security industry calls a “shift left”—to make security testing part of product development from the beginning and throughout the development life cycle, not just at the end.

Testing is an expense, Clark acknowledged. “But it is clear that effective testing is happening far too late. For the majority, testing is post product release, which can lead to a 6x–14x increase in cost.

“If we start to shift left—moving that testing earlier and earlier—we start to see a reduction in cost. Eventually it gets to where cybersecurity is just one of the standard processes, like safety testing for a vehicle. The time and expense will pay off,” he said.

And in spite of a significant list of weaknesses that need major improvement, Clark said auto manufacturers shouldn’t be upset about it. “They should look at this as a growth opportunity versus a threat to their industry,” he said.

Report

Securing the Modern Vehicle
A Study of Automotive Industry Cybersecurity Practices

This report outlines the main organizational, technical, testing, and supply chain challenges the automotive industry faces and introduces solutions for addressing them.

Continue Reading

Explore Topics