Story image

Report finds automotive industry seriously wanting in cybersecurity

08 Feb 2019

 

Findings from a new report have laid the automotive industry’s cybersecurity practices bare after highlighting critical cybersecurity challenges and deficiencies affecting many organisations in the industry.

Synopsys and SAE International Release released the report (Securing the Modern Vehicle: A Study of Automotive Industry Cybersecurity Practices) that is based on a global survey conducted by Ponemon Institute.

The report surveyed 593 professionals from global automotive manufacturers, suppliers, and service providers. To ensure knowledgeable responses, all respondents are involved in assessing or contributing to the security of automotive technologies, including infotainment systems, telematics, steering systems, cameras, SoC-based components, driverless and autonomous vehicles, and RF technologies such as Wi-Fi and Bluetooth, among others.

According to the survey, a staggering 84 percent of automotive professionals have concerns that their organisations’ cybersecurity practices are not keeping pace with evolving technoligies. Furthermore, 30 percent of organisations don’t have an established cybersecurity programme or team, while 63 percent test less than half of the automotive technology they develop for security vulnerabilities.

Further key findings from the report include:

  • More than half of respondents say their organisation doesn't allocate enough budget and human capital to cybersecurity, while 62 percent say they don't possess the necessary cybersecurity skills in product development.

  • Less than half of organisations test their products for security vulnerabilities. Meanwhile, 71 percent believe that pressure to meet product deadlines is the primary factor leading to security vulnerabilities.

  • Only 33 percent of respondents reported that their organisations educate developers on secure coding methods. Additionally, 60 percent say a lack of understanding or training on secure coding practices is a primary factor that leads to vulnerabilities.

  • Seventy-three percent of respondents expressed concern about the cybersecurity of automotive technologies supplied by third parties. Meanwhile, only 44 percent say their organisation imposes cybersecurity requirements for products provided by upstream suppliers.

SAE International Ground Vehicle Standards director Jack Pokrzywa says the real-world data validates the concerns of cybersecurity professionals across the industry - and highlights a way forward.

"SAE members have sought to address cybersecurity challenges in the automotive systems development lifecycle for the last decade and worked together to publish SAE J3061, the world's first automotive cybersecurity standard,” says Pokrzywa.

“Armed with the findings of the study, SAE stands ready to convene the industry and lead development of targeted security controls, technical training, standards, and best practices to improve the security, and thus the safety, of modern vehicles."

Synopsys Software Integrity Group co-general manager Andreas Kuehlmann says in trying to stay on the pulse of innovation, the industry has fallen behind on cybersecurity.

"The proliferation of software, connectivity, and other emerging technologies in the automotive industry has introduced a critical vector of risk that didn't exist before: cybersecurity," says Kuehlmann.

"This study underscores the need for a fundamental shift—one that addresses cybersecurity holistically across the systems development lifecycle and throughout the automotive supply chain. Fortunately, the technology and best practices required to address these challenges already exists, and Synopsys is poised to help the industry embrace them."

Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.
D-Link A/NZ launches new home wireless surveillance kit
The Omna Wire-Free Full HD cameras and accompanying Wi-Fi Hub offer a number of new features, including Alexa/Assistant support.
CSOs - are you prepared for cloud cryptojacking?
A recent report found that almost half of the organisations surveyed have malware in one of their cloud applications.
Cryptomining apps discovered on Microsoft’s app store
It is believed that the eight apps were likely developed by the same person or group.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Swiss Post asks public to hack its e-voting system
Switzerland’s postal service Swiss Post is inviting keen-eyed security experts and white hats to hack its e-voting system.
Spoofs, forgeries, and impersonations plague inboxes
It pays to double check any email that lands in your inbox, because phishing attacks are so advanced that they can now literally originate from a genuine sender’s account – but those emails are far from genuine.