Automotive Engineering - May 2024 - 8

TECHNOLOGY REPORT
white-hat officer of Afuzion, an Israeli
security firm, serves on the SAE G-32
Cyber Physical Systems Committee. He
said that when including both ground
and aviation vehicles, the target of cyber
threats has moved well beyond data
Hackers are launching attacks faster than even a few years ago.
and information.
" This is not like the popular perception
- the one that you see in movies
- that have cyber attacks going for
information, and the worst thing you
can have is lost information or have
your information exposed, " David said.
" With cyber-physical systems, the odds
are much steeper. You may lose your
life, you may lose your system, you may
lose some critical equipment like an
airplane or a power station, like, not just
one car in the in the case of ground vehicles,
but a whole lot of cars. "
Upstream VP for Market Development
Giuseppe Serio said heavy trucks and
agricultural machinery could also be a
target. " If we look at, for instance, agriculture
or heavy truck machines, there
is (and will be) a lot more automation.
So there's probably not so many risks
related to safety, but more to business
continuity and operation. "
David also said the complexity of the
In 2023, attacks against large numbers of targets proliferated.
millions of assets. If you just look at the
really dramatic incidents, we more than
doubled from 2% to 5%. What we consider
high impact has doubled from
20-ish to almost 45%. "
As an example of impact, she cited a
2023 ransomware attack on a long-haul
trucking fleet with more than 1,000 vehicles.
The attack struck at the company's
business software and shut
down everything from driver time-logging
- really important for regulatory
compliance - to software that managed
logistics and employee management.
" It took the company three weeks
to fully recover once the event was
over, " she said.
The report also foreshadowed the
8 May 2024
development of Ocean AI a bit, when it
discussed hackers' use of generative AI.
" By using GenAI to simulate attack environments,
cybersecurity faces an additional
challenge, as it leads to more
unpredictable and sophisticated attacks,
increasing the difficulty of detection, "
the report said.
Targets aren't only cars
The industry does know and generally
understands the looming threats. During
a February SAE webinar discussing
" Cybersecurity in the Air and on the
Ground, " the founder of another cybersecurity
firm ominously said it's not just
wheeled vehicles that are under attack.
Aharon David, cofounder and chief
problems is growing daily and cited
airports as an example. " It's in the complexity
of it, " he said. " And it's a huge
miracle that we have not been hit harder
yet. And I hope it's not going to happen
anytime soon. And I hope we advance
fast enough with our regulations
and methodologies. "
What's one big thing getting in the
way of solutions? David said it's the way
many executives perceive risk. " There is
a lot of gray, and our cyber adversaries
thrive in the shadows. " He said executives
need to understand that security
planning is about planning for the next
attack, not necessarily the previous one.
" The worst issue is the one that hasn't
happened yet, " he said. " [The term]
'likelihood' is for executive games.
Human factors cannot be reduced to
probabilities and statistics, " he said.
" Where there is a will, there's a way. "
The Upstream cybersecurity report is
available online.
Chris Clonts
AUTOMOTIVE ENGINEERING
BOTH IMAGES: UPSTREAM
https://upstream.auto/reports/global-automotive-cybersecurity-report/
Automotive Engineering - May 2024

Table of Contents for the Digital Edition of Automotive Engineering - May 2024
