SAE Update - May 2022 - 6

TECH FOCUS:
CybErSECUriTy
What is cybersecurity?
U.S. Dept. of Homeland Security
resources for urgent security
improvements, CISA has
compiled a " Shields Up " catalog
of free services from government
partners, and industry to assist.
Shields Up | CISA
According to IBM's 2021
Security report, the most
common initial attack vector,
compromised credentials, was
responsible for 20% of breaches
at an average $4.37 million per
breach.
SAE International has
developed technical
specifications to describe best
practices and considerations to
support secure mobility and
communications between a
vehicle and an off-board device
(e.g., telematics service providers
or an OBD-II scan tool) - for
example, SAE J3005 and J3138
technical documents to provide a
reference and overview of current
best practices that are used for
securing the Data Link Connector
6
May 2022
(DLC) from cybersecurity threats when unsecured
external devices are attached. Such external devices
may include OEM or aftermarket external test
equipment (e.g., diagnostic scan tools), remotely
connected applications (e.g., telematics devices
commonly used by insurance companies), other
wireless connectivity devices, or other unknown
devices. As many researchers are aware, some DLCs on
older model year vehicles may have direct, unrestricted
access to one or more critical in-vehicle networks
vulnerable to cybersecurity threats. The practices
outlined in the SAE documents are examples of secure
in-vehicle diagnostic connectivity methods which are
considered acceptable for use in the automotive
industry.
Cyberscurity is a process
In 2021, the ISO/SAE21434 Cybersecurity Engineering
specification was published. This document specifies
engineering requirements for cybersecurity risk
management, including product development,
production, operation, maintenance, and
decommissioning of electrical and electronic systems
in vehicles. ISO/SAE 21434 also defines a framework
with requirements for cybersecurity processes. The
framework includes recommendations for ongoing
cybersecurity training and continuing education.
UPDATE

https://www.cisa.gov/shields-up https://www.ibm.com/security/data-breach https://www.sae.org/standards/content/iso/sae21434/

SAE Update - May 2022

Table of Contents for the Digital Edition of SAE Update - May 2022