{"id":55241,"date":"2023-03-21T15:47:37","date_gmt":"2023-03-21T15:47:37","guid":{"rendered":"https:\/\/expleo.com\/global\/en\/?post_type=insights&p=55241"},"modified":"2024-03-12T05:42:03","modified_gmt":"2024-03-12T05:42:03","slug":"automotive-new-cybersecurity-frontier","status":"publish","type":"insights","link":"https:\/\/expleo.com\/global\/en\/insights\/blog\/automotive-new-cybersecurity-frontier\/","title":{"rendered":"Is cybersecurity the new defining power of future vehicles?"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With vehicles now collecting, accessing, and storing a large volume of data, cybersecurity has become a major focus for the automotive sector<\/span>. <\/span>In fact, work\u2019s been underway for more than a decade to answer the unique security questions posed by the big auto industry disruptors \u2013 automation, connectivity, and e-mobility.<\/span>\u00a0<\/span><\/p>

As early as\u202f<\/span>2011<\/span><\/a>, manufacturers were working with the <\/span>United Nations Economic Commission for Europe\u202f(UNECE<\/span><\/a>)<\/span> to develop a regulatory framework to support auto cybersecurity. Incidentally, the security risk received worldwide attention in 2015 when white hat hackers took control of a vehicle over the internet, leading to the\u202f<\/span>recall of 1.4m vehicles<\/span><\/a>, and the industry responded by redoubling its efforts to tackle the issue.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to the UNECE,\u202f<\/span><\/span>cars now con<\/span>t<\/span><\/strong><\/span>ain up to 150 electronic control units<\/strong><\/span><\/span><\/span><\/a>\u202fand about 100 million lines of\u202f code \u2013 four times more than a fighter jet \u2013 and that\u2019s projected to rise to 300 million lines of code by 2030<\/span><\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The new frontier: UN R155 and UN R156 <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To address th<\/span>e growing threat of cyberattacks<\/span>, <\/span>the UNECE published the first regulations<\/span> in January 2021. UN R155 and UN R156, regulations aiming at enhancing the security of current and future car models, were implemented in July 2022 for new type approvals. From July 2024, they\u2019ll become mandatory for all new cars produced across\u202f<\/span>54 countries<\/span><\/a>.\u00a0<\/span>\u00a0<\/span><\/p>

  1. UN R155 mandates that vehicles must have a Cybersecurity Management System (CSMS) in place, meaning applying cybersecurity practices and measures across the development process and life-cycle of vehicles. Although no CSMS is currently mandatory for suppliers, they tend to put in place the right processes, assessments and security concepts (e.g. ISO 21434) to comply with regulations.<\/span>\u00a0<\/span><\/li>
  2. UN R156 deals with the software update management system (SUMS). It provides all the requirements to achieve a secure software update during the life-cycle of a system.<\/span>\u00a0<\/span><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    The players on the new frontier <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Automotive\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Three unique cybersecurity challenges facing automotive <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    1. One-size needs to fit all
      <\/strong>Cybersecurity is relatively new to automotive \u2013 it\u2019s been a focus for around ten years, so it\u2019s still work in progress. The current major challenge is to standardise the security concepts, to make sure all manufacturers and suppliers use the same. It was a success on the diagnostics feature, prioritised because it\u2019s a crucial security feature. Whether a manufacturer or a supplier wants to implement a diagnostic interface, they will always need to refer to the Unified Diagnostic Service (UDS) standard. ‘Unified’ in this context means that it\u2019s an international and not a company-specific standard. The main goal today is to have a standard for all the security relevant features, which is obviously very complex to achieve, as all manufacturers will need to agree on them.<\/span><\/li>
    2. An eternal update cycle
      <\/strong>An additional challenge comes from the length of the automotive product life-cycle, opposed to the rapid evolution of cyber-threats. Development life-cycles range up to five years, and the average age of a car at scrappage is\u202f12 years<\/span><\/a>, therefore an end-to-end lifecycle of more than 15 years to account for. Add on top of that <\/span>the embedded aspect of the automotive systems. Automotive manufacturers have limited resources and need to limit the cost of a new vehicle, so they can\u2019t always integrate the best security into the systems. When an algorithm or a hardware security is selected, it\u2019s based on international recommendations like NIST or FIPS and commit to providing unbreakable features for at least 10 years. If a security vulnerability is found, or if the algorithms are outdated, they\u2019ll need to be managed via software updates.\u00a0\u00a0<\/span>\u00a0<\/span><\/li>
    3. A time of seismic change
      <\/strong>With increased connectivity comes greater threats. In the past, hacking events primarily resulted in inconvenience to infotainment users. Now cyber-attacks can impact the safety of drivers, passengers, and other road users. This means cyber protection is now on par with functional safety. On top of that, new transport on-demand or MaaS (Mobility as a Service) models will pose new problems to solve, like the security of payments, billing, and personal data.\u00a0\u00a0<\/span><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      Keeping up with innovation with Expleo <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      In the battle between innovation and cybersecurity, innovation needs to keep winning. Automotive consumers prefer innovative features and are willing to share personal data to take advantage of them. Since market demand still favors innovation, OEMs and tier 1 and 2 suppliers need to keep up with the dynamics of automation and connectivity, or they take the risk of falling behind. But favouring innovation shouldn\u2019t mean accepting the risk of cyber incidents. The focus should be on the integration of innovation, cybersecurity, and functional safety to shape the future of the auto industry.\u00a0<\/span>\u00a0<\/span><\/p>

      We draw skills and experience across engineering and technology \u2013 everything from Banking, Financial Services, and Insurance (BFSI) to automotive engineering \u2013 which means we offer a unique combination of design thinking to our clients that delivers innovation while ensuring safety and security. We also guide our customers to navigate the ever-changing regulatory landscape.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t
      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      \r\n \r\n \r\n Let's talk <\/span>\r\n \r\n

      \r\n To find out more about regulation or to discuss other cybersecurity related services, contact our cybersecurity team.<\/span> <\/h2>\r\n
      \r\n Please fill in the form below and we will get in touch with you shortly.<\/span> <\/div>\r\n <\/div>\r\n\r\n \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t\n\t\t\t\n\t\t\t\n\n\t\t\t\n\t\t\t
      \n\t\t\t\t\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t