Automotive security and cybersecurity science
Applying security insights gained from scientific evaluation.
Rusted car (source: Finetooth via Wikimedia Commons)
Automotive cybersecurity generated many headlines in the past year. For three years in a row, Charlie Miller and Chris Valasek have given Blackhat presentations about vehicle vulnerabilities (2014, 2015, 2016). Their work caused Chrysler to recall 1.4 million vehicles after they showed the ability to hijack a Jeep remotely over the Internet in 2015.
While there have been high-profile disclosures, interest and attention in the field is still emerging, meaning now is a great time to apply cybersecurity science to automotive cybersecurity. Further, the ecosystem of connected transportation is still young and evolving.
Learn faster. Dig deeper. See farther.
Automobile security vulnerabilities are numerous and varied
Automobiles, like other cyber-physical systems, are vulnerable to design assumptions about how different control systems interact. Security researchers in 2011 said:
“Modern cars are controlled by complex distributed computer systems comprising millions of lines of code executing on tens of heterogeneous processors with rich connectivity provided by internal networks (e.g., CAN [Controller Area Network]). While this structure has offered significant benefits to efficiency, safety and cost, it has also created the opportunity for new attacks.
Not all automotive security will be technical. Last year, Senator Edward Markey introduced the Security and Privacy in Your Car Act of 2015. It sought to direct the National Highway Traffic Safety Administration (NHTSA) to set rules protecting unauthorized access to “(1) electronic controls or driving data, including information about the vehicle’s location, speed, owner, driver, or passengers; or (2) driving data collected by electronic systems built into a vehicle while that data is stored onboard the vehicle, in transit from the vehicle to another location, or subsequently stored or used off-board the vehicle.”
Scientific evaluation is a key first step
So how would you get started with automotive cybersecurity experimentation? Begin with a good, testable question about how a vehicle computer is expected to perform, how components interact, or how well private data are protected. Vehicles provide different technologies from traditional IT, such as specialized bus systems, but the essential elements of cybersecurity science remain the same:
- Pose a good question
- Formulate hypotheses
- Make predictions
- Experimentally test the hypotheses
- Analyze and modify the hypotheses
You may wish to know, for example, whether approximating GPS accuracy to 100 feet in vehicle-to-vehicle data sharing situations will effectively protect the privacy of drivers while also achieving certain benefits in congestion avoidance. For experiments and simulation, you will need data about vehicle density. You may find that, in Manhattan, approximating within one city block is the optimal distance for achieving privacy and automated congestion avoidance.
Achieving effective security solutions
As I talk about in Essential Cybersecurity Science, humans play many roles, from designers to users. Those who care about automotive safety should look for opportunities not only to produce and validate secure hardware and software, but also to implement user-friendly and effective solutions. You may develop a secure and effective accident avoidance system for a self-driving car, but be sure to consider how you will communicate to the user why the car is swerving, and use user-testing to validate the effectiveness of your design! I haven’t seen any evaluations on the improvements to distracted driving from heads-up displays in vehicles, but their effectiveness is a testable hypothesis.
Cybersecurity solutions for vehicles and transportation will flourish in the coming years. In a previous post I offered some clarifying questions to ask vendors, researchers, and developers about their claims of security and performance. We should all exercise vigilance to differentiate hype from science in emerging automotive cybersecurity.
If you’d like to learn more about the current state of cybersecurity and automotive security, I suggest you read McAfee’s recent white paper, “Automotive Security Best Practices,” which offers insights about vehicle-related connected infrastructures and potential next-generation technologies. In it you can find many opportunities for practical scientific evaluation and development, including “Determining when and how a vehicle will fail, deciding when and whether to update code, and determining which features to disable for a failsafe mode so that the vehicle and occupants are protected…”