Securing the connected vehicle: from siege warfare to epidemiology

Sam Hunt

by Sam Hunt

Connected vehicle security principles R1hbapm

In medieval times security was delivered by thick walls, drawbridges to restrict access, protected supply routes and enough food to survive prolonged sieges. These defence technologies and techniques worked fairly well when you needed to defend a clearly owned and defined boundary against a visible, co-located enemy that tried to attack with brute force. 

Now we live in a connected world. Our paradigms of defence and attack have changed. No longer is the ownership clear or our boundary wall well-designated. No longer is the enemy visible and co-located and brute force is just one of many, many types of attack. 

This change affects all areas of our connected life, but one area that is particularly vulnerable is our connected and autonomous vehicles. Taking each of these conditions in turn for connected vehicles you find:

  • No clear ownership — Imagine your autonomous vehicle hits another autonomous vehicle that failed to detect you coming. The hit happened directly after an instruction from city infrastructure to your vehicle. At the time you were asleep at the wheel and the autonomous vehicle was telling you to take it out of autonomous mode. This is one of many sorts of situations where it will be very tricky to determine fault and ownership. While not strictly a security issue, this really complicates the landscape for which we are looking to achieve security.
  • No defined boundaries — With current electronic systems it was easy to consider the vehicle as a discrete unit with a defined boundary. Now the physical vehicle is just one node in an unbounded network of connected actors such as the navigation systems directing it, the over-the-air updates being pushed from the manufacturer, other vehicles it connects to in a V2V mesh and the smart city infrastructure with which it interacts. Also with in-vehicle networking sub-systems used much more frequently, there are more options for attacks to proliferate within a vehicle.
  • Enemy is not visible & co-located — In 2010 the Stuxnet virus was released to the world targeting Iran’s nuclear centrifuges. It exploited a weakness in the Microsoft Windows and Siemens programmable logic controllers. It searched for specific controllers delivering specific instructions before inserting itself. With vehicles being connected, attacks can come from anywhere in the world and lodge themselves within critical systems.
  • Brute force is just one of many types of attack — A famous automotive hack took place in 2015 when security researchers remotely controlled a jeep with a journalist driving it. This became known as the jeep hack and is achieved by inserting fake messages between the CAN (controller area network),  the so-called brain of a vehicle and other electronic subsystems in the vehicle. This is just one of an increasing range of different attacks.
securing the connected vehicle

These changing conditions mean that the old paradigm of defending walls is no longer appropriate for securing connected and autonomous vehicles. 

To be successful in this complex environment a new approach is needed. In the UK, an industry collective of the AESIN (Automotive Electronics Systems Innovation Network) and the UK Automotive Council and Zenzic advocate a new approach. It focuses on designing vehicles and subsystems that are:

  • Heavily instrumented: so you can monitor health and detect attacks
  • Simulatable: so in the event of an attack you can determine the cause and identify solutions
  • Updatable: so that fixes can be rapidly put in place

The key to this approach being successful is a mindset shift away from static knowable threats to dynamic unknowable ones. This encourages us to build systems with greater resilience by encouraging more engineered differences to slow the propagation of threats and create a culture of continuous learning and deployment delivered through over-the-air updates.

This new mindset needs a new metaphor. The one most regularly being offered is that of epidemiology, the ongoing detection, vaccination and knowledge sharing effort used to tackle infectious diseases. 

At Star, we deliver applications and platforms that support connected vehicles. We take our responsibility to leading vehicle security practice very seriously, delivering in line with ISO standards (look out for the new ISO 21434 standard for road vehicle cybersecurity coming out this year) for quality management and information security as well as subjecting our code to rigorous penetration testing. We continue to grow and evolve our security practice not with the mindset of defending castles, but of fighting diseases. 

Connected vehicle security principles R5dkbapm
Sam Hunt
UK Director of Technology at Star

Sam Hunt is the UK Director of Technology at Star and a member of the Tech London Advocates working group on Corporate Innovation. Sam believes innovation is the art and science of solving the problems that matter. His mission is to unlock innovation for the success of our clients. Sam brings with him 10 years of experience across corporate innovation, startup ecosystems, emerging technology, and RnD. Having a unique mix of business and technical knowledge, he creates and implements game-changing solutions.

Create pioneering Automotive & Mobility experiences

We help companies ideate, build, launch and scale disruptive automotive and mobility solutions through user-centered design, embedded engineering and omnichannel experiences.

Explore our expertise
Loading...
North America, Big

We are truly global.
Explore our locations around the world.

North America, Big

Star is a global technology consulting firm that seamlessly integrates strategy, design and engineering as an end-to-end partner on its clients’ digital journeys. Star’s unique approach helps rapidly expanding startups and established enterprises reach their endgames while prioritizing empathy for the end-users, society, and the planet.

Insights & inspiration

Receive the latest Star insights on trends, technologies and endgame-driven approaches straight to your inbox.

Contacts

Or write us at hello@star.global

© Copyright Star 2024. All rights reserved Privacy Policy

plus iconminus iconarrow icon pointing rightarrow icon pointing rightarrow icon pointing downarrow icon pointing leftarrow icon pointing toparrow icon pointing top rightPlay iconarrow pointing right in a circleDownload iconResume iconCross iconActive Badge iconInactive Badge iconFocused Badge iconDropdown Arrow iconQuestion Mark iconFacebook logoLinkedin logoLinkedIn logoFacebook logoTwitter logoInstagram logo