In an era where innovation and technology have revolutionized the way we move and connect, the need for robust cybersecurity in AVs and ADAS has emerged as a red-hot topic within the automotive industry – and was therefore a key feature of our agenda at AutoSens Brussels.
So why has this issue ignited such intense interest across the spectrum of professionals working on these cutting-edge mobility solutions? The answer is simple: the integration of advanced software, connectivity, and automation has propelled AVs and ADAS to the forefront of our evolving transportation landscape. This means they’re no longer a niche fascination, but an integral part of our collective future. However, the convergence of physical and digital worlds in these vehicles opens up a Pandora’s box of cybersecurity concerns. From the prevention of hacking attempts to securing personal data, the challenges are immense, and the consequences of failure could be catastrophic.
In this article, we speak to some of the foremost experts in the industry to explore the critical role that cybersecurity plays in the development and deployment of AVs and ADAS. We’ll delve into the specific challenges the entire supply chain is facing across sensing and semiconductors, potential threats, and the collective responsibility of all stakeholders in the automotive industry to ensure the safety and security of these technological advancements. So, fasten your seatbelts and join us as we navigate the fascinating intersection of mobility and cybersecurity this Cybersecurity Awareness Month.
What key factors does the ADAS/AV and wider mobility industry need to be focused on for a more cyber-secure future?
Jean Linis-Dinco, Data Governance Specialist at VPS, shares her expertise…
“There are several things that the ADAS/AV and the wider mobility industry can focus on to ensure that the industry is cyber-secure. And we can go on and on talking about end-to-end encryption and hardware security, but one concept that people often overlook is the security issues in supply chain.
Problems that can arise from supply chain insecurity include the lack of consistency when it comes to security standards with third party components. This is much more common in the automotive sector where components are often sourced from various supplies. Suppliers then rely on sub-suppliers and so on. Each link here represents a potential security if not properly managed and vetted. Not only it is important that all hardware and software are sourced from third parties meet the same security standards, it is also crucial to establish a system that allows for an end-to-end traceability of components. The good thing about traceability is not only can you trace them for security purposes, you can also use it to ensure that components are sourced ethically and that the vendors you are working with are eco-friendly.
All this can be done via audits and supply chain risk management as mechanisms for understanding and reducing risk. Another possible solution is to leverage ‘Digital Twins, which allows organisations to simulate and ‘stress-test’ various scenarios and security protocols in sandbox before implementing them in the real word.“
From a security perspective, what key aspects should we be focussing on when designing ADAS systems for the future?
Frank Schirrmeister, Vice President Solutions & Business Development at Arteris answers…
“The industry needs to address security aspects of ADAS systems holistically across the design chain, considering hardware and software. The overall stack is quite complex, from semiconductor IP building blocks to sub-systems, systems-on-chips, and heterogeneously integrated chiplets to PCB boards and systems. On the software side, users deal with hardware abstraction layers, operating systems, drivers, middleware, and applications. All of those layers present attack surfaces that bad actors may try to exploit, so a holistic approach to security is essential.
At the level of networks-on-chips at which Arteris operates, the data transport can be secured and “firewalled” during silicon implementation, and users can add monitors tracking potential security issues. With this we contribute just one part of a very complex puzzle to secure ADAS systems.”
We’re aware of the importance of prioritising cybersecurity in sensor design. Do you see this happening in the industry, and if not, what can we do to work towards it?
Ludovic Rota, Product Marketing Manager at onsemi says…
“For automotive, the case is no longer a debate. UNECE R155 regulation mandates Cybersecurity Management System (CSMS) for all car manufacturers (OEMs) by 2026 in Europe and Japan (and similar actions have been initiated in the US and in China), That percolates down to their TIERs suppliers as a requirement to comply with Cybersecurity ISO 21434 standard for all their electronic products. This was well presented and described by Autocrypt (see more from Autocrypt below).
Image sensors are no exception. The point I highlighted in my presentation is the fact that those sensors are playing a critical role in self-driving capability (whatever partial with ADAS and total as with autonomous vehicles). Many are still debating if an attack on a camera is doable and it is worth defending against it. Car components are requested to have a 15 to 17 years life cycle. It is not obvious today to imagine how an attacker could get to the cameras in a car and exploit them to take control of the vehicle or harm occupants / pedestrians using it. It would need to access the vehicle, get into it, access the camera location, disassemble it and find a way to gain control. It sounds highly unlikely. Yet, what is not possible today could perfectly become possible tomorrow, especially with a 17 year life time to guarantee.
So all the OEMSs we discussed with told us they require full coverage protection for all their electronic components, especially the ones which are considered entry-points to their systems (which is the case of an image sensor in the camera). And it simply makes sense. What is at stake (especially with software-defined vehicles now considered “computers on wheels”) is simply too high if importance to leave any doubt regarding possible vulnerabilities in the vehicles.”
There’s been a lot of focus on cybersecurity requirements from the UNECE regulations – what does this mean for the future of our industry?
Hyunse Lee, Vice President at AutoCrypt, tells us his view…
“Both the regulation for type approval and engineering, auditing industry standards look at securing the entire lifecycle of the vehicle – from vehicle production to post-production. These guidelines look at security as a process, not a one-stop fix. This means manufacturers, as well as suppliers, are to seek a comprehensive cybersecurity solution that not only covers the bases of the vehicle’s security but also validations using proven defensive and offensive methods, security events monitoring, and response systems to ensure vehicles will stay secure throughout the lifecycle.”
Why is code review essential to a modern security strategy, and do you see this happening in the industry?
Chris Dickens, Senior Solutions Engineer at HackerOne gives us his insight…
“Code review is crucial for a modern security strategy as it aids in the early detection of vulnerabilities and mitigation of evolving threats. IBM and NIST suggest it costs 15x more to fix a vulnerability in production than in code, meaning not only is code review essential for security it is also significantly cheaper to find vulnerabilities at this stage.
Furthermore, it promotes knowledge sharing, and accountability, leading to continuous improvement in coding standards and practices – this benefit is recognised by industry standards and is now mandated by the Digital Operational Reliance Act (DORA).
HackerOne Code Review and Code Audit offers a unique solution that enables development teams to benefit from the expertise of over 600 experienced developers for real-time code reviews of both pre- and post-merged code. This engagement model, similar to SAST and DAST, involves actual developers who bring their extensive knowledge, resulting in valuable insights and the identification of security flaws in context. The solution boasts an average response time of under 2 hours, a low rate of false positives, and has proven effective in uncovering an average of 25 medium to critical vulnerabilities per 200,000 lines of code”
