www.helpnetsecurity.com Open in urlscan Pro
54.148.174.253  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1707790240"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Mirko Zorz, Director of Content, Help Net Security
February 12, 2024
Share


INTEGRATING CYBERSECURITY INTO VEHICLE DESIGN AND MANUFACTURING



In this Help Net Security interview, Yaron Edan, CISO at REE Automotive,
discusses the cybersecurity landscape of the automotive industry, mainly
focusing on electric and connected vehicles.

Edan highlights the challenges of technological advancements and outlines
strategies for automakers to address cyber threats effectively. Additionally, he
emphasizes the importance of consumer awareness in ensuring vehicle security.



CAN YOU DESCRIBE THE STATE OF CYBERSECURITY IN THE AUTOMOTIVE INDUSTRY,
ESPECIALLY IN THE CONTEXT OF ELECTRIC AND CONNECTED VEHICLES?

The automotive industry is experiencing a digital breakthrough transforming how
vehicles are designed, manufactured, and used, primarily driven by the
introduction and popularity of electric and autonomous vehicles. Technological
advancements have been introduced and integrated throughout the vehicle life
cycle. This brings numerous benefits like enhanced safety and improved
efficiency to the cars we drive daily, but it also brings new and pressing
cybersecurity challenges.

Now that our vehicles are becoming increasingly connected to the internet can go
through Over-the-Air (OTA) updates, use remote management, contain Advanced
Driver Assistance Systems (ADAS), and employ AI, the potential avenues for
cyberattacks have expanded for threat actors to exploit in a significant way.

WHAT STEPS ARE AUTOMAKERS TAKING TO ADDRESS CYBERSECURITY CHALLENGES IN THEIR
LATEST VEHICLE MODELS?

We use different forms and increasing amounts of software in our vehicles. The
first challenge is in the supply chain, not just in terms of who provides the
software; the issue penetrates each layer. Automakers need to understand this
from a risk management perspective to pinpoint the onset and location of each
specific risk. Suppliers must be involved in this process and continue to follow
guidelines put in place by the automaker.

The second challenge involves software updating. As technology continues to
evolve and more features are added, cybercriminals find new ways to exploit
flaws and gaps in systems that we may not have been aware of because of the
newness of the technology. Regular software updates must be administered to
products to patch holes in systems, improve existing vulnerabilities and improve
product performance.

In order to address these challenges, automakers need to conduct an initial risk
assessment to understand what kind of threats and the type of threat actors are
active within each layer of the product and supply chain in the automotive
industry. From the experience gained from the initial risk assessment, a
procedure must be put in place to ensure each internal and external employee and
supplier knows their role in maintaining security at the company.

The procedure determines which types of threat actors are active within the
automotive industry, where they are located, and each threat’s severity. This is
complicated because threat actors reside worldwide in large numbers, and each
group uses various forms of attacks to various degrees. Automakers use the
information collected daily to help protect their assets. Additionally, audits
must be conducted regularly to evaluate each supplier and employee to verify the
procedures are followed correctly, don’t need to be updated, etc.

CAN YOU EXPLAIN HOW VEHICLE MANUFACTURERS INTEGRATE CYBERSECURITY INTO THE
DESIGN AND DEVELOPMENT PROCESS?

Once you have a factory line running, the first step to integrate cybersecurity
into the manufacturing process is to secure the operation technology (OT) policy
by understanding the risk and how to close the gaps. Manufacturers must deal
with OT threats, which involve thousands of unique threats coming from the
product lines, sensors, and other equipment involved in the manufacturing
process, instead of systems like computers.

These threats can be especially dangerous if left ignored because of the
simplicity of the equipment used in this stage. Suppose you are a threat actor
and you want to damage an automaker. In that case, it is much more difficult to
conduct a cyberattack on the cloud or the employees of an automaker. Still, the
factory line is easier to attack because it uses equipment that is easier to
breach and actions are less detected. This is a very common area for threat
actors to target.

WHAT KEY STRATEGIES ARE YOU RECOMMENDING FOR PROTECTING CONNECTED AND ELECTRIC
VEHICLES AGAINST CYBER THREATS?

Automotive companies must take a proactive approach to addressing cybersecurity
threats instead of being reactive. This allows security teams to avoid threats
instead of responding later once the damage has already been done. A few
proactive strategies I’d recommend for companies are the following.

 * Conduct a risk assessment to understand and prioritize current and future
   risks.
 * Develop company-wide security policies and procedures so all employees know
   their roles in maintaining security.
 * Hold regular security training and awareness programs to educate employees.
 * Implement strong network security measures, including firewalls, detection
   systems, and encryption, to monitor your network traffic for any anomalies
   regularly.
 * Regularly backup critical data and store it in secure locations.
 * Develop a comprehensive incident response plan outlining steps to be taken
   during a cyberattack.
 * Conduct periodic security audits to evaluate the effectiveness of security
   measures and identify improvement areas.

Cybersecurity is an ongoing process that requires constant vigilance and
adaptation – current strategies will likely become outdated and need to be
reworked as new threats emerge.

WHAT ROLE DO REGULATORY BODIES PLAY IN SHAPING CYBERSECURITY STANDARDS FOR
ELECTRIC AND CONNECTED VEHICLES?

Regulatory bodies play a role in shaping cybersecurity standards, but they do
not help you secure your products directly – that is up to each individual
player in the automotive supply chain. The goal of regulatory bodies is to
provide automakers with best practices on steps to take in the event of a cyber
hack, what players to communicate with, and how deep to reach depending on the
severity of the threat.

Once an automaker is compliant with certain regulatory rules, they will then ask
the regulatory bodies to come to conduct an onsite visit, where they conduct an
audit for months at a time, trying to hack each layer they can and look for any
areas of weakness, to identify what needs to be patched up. This process needs
to be repeated until the automaker is fully compliant.

WHAT ARE THE BEST PRACTICES THAT CONSUMERS SHOULD BE AWARE OF TO ENSURE THE
CYBERSECURITY OF THEIR ELECTRIC OR CONNECTED VEHICLES?

Consumers need to make sure the data collected in the vehicle stays private. For
example, if you have an electric vehicle (EV) and you need to charge it, you
might visit a public charging station. Not many people know this, but your
vehicle data can be easy to hack at public charging stations because you are not
only transferring electricity but also data.

To prevent this from happening, vehicle owners need to ask the right questions.
Owning an EV is no different than when a homeowner goes to buy a large kitchen
appliance, for example. The right questions need to be asked, including – who
made it, whether the company has a cybersecurity procedure in place, whether it
is currently compliant with regulatory body requirements, etc. Making sure that
all software is regularly up to date is also essential. EV users must download
official software from trusted brands using a secure network.

Along with automakers, consumers are partially responsible for their own
security, which needs to be stressed to the general public more. Without this
knowledge, consumers are left highly vulnerable to hacks from cybercriminals.





More about
 * automotive security
 * connected cars
 * cyberattacks
 * cybersecurity
 * opinion
 * REE Automotive
 * risk assessment
 * software
 * standards
 * strategy
 * supply chain

Share


FEATURED NEWS

 * Critical Fortinet FortiOS flaw exploited in the wild (CVE-2024-21762)
 * Decryptor for Rhysida ransomware is available!
 * Integrating cybersecurity into vehicle design and manufacturing

Whitepaper: Why Microsoft’s password protection is not enough



SPONSORED

 * Whitepaper: Why Microsoft’s password protection is not enough
 * eBook: Defending the Infostealer Threat
 * Guide: SaaS Offboarding Checklist




DON'T MISS

 * Critical Fortinet FortiOS flaw exploited in the wild (CVE-2024-21762)
 * Decryptor for Rhysida ransomware is available!
 * Integrating cybersecurity into vehicle design and manufacturing
 * Hacking the flow: The consequences of compromised water systems
 * SiCat: Open-source exploit finder




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2024 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×