Connected Cars Under Attack: What UN R155, WP.29 and ISO/SAE 21434 Ask of Automakers

Connected cars have made vehicle manufacturers a target for cybercriminals, and the aim of automotive cybersecurity is to let carmakers and regulators outwit attackers on their own terms. That is how Mike Hodge, cybersecurity solutions lead at Keysight Technologies, frames the field.

Hodge starts with the picture most people carry of a car hacker: a figure in a black hoodie and a Guy Fawkes mask, working at a top-end computer in a messy basement to a thumping 1990s techno track, who pulls off some shadowy coding trick, seizes a cellular signal, takes over a stranger's car and drives it off the road. He concedes the film version is exaggerated. For original equipment manufacturers (OEMs), though, the problem is serious. A single cyberattack can cost a carmaker up to $1.1 billion, by his account.

Money is only part of what worries executives. The fallout from an attack spreads widely, Hodge notes, and can include legal and compliance penalties, damage to the brand and heavy losses in market capitalisation.

Why the modern car is an easy target

Anything linked to a stream of information can now be attacked, and a modern car is in effect a data centre on wheels, so hackers' interest is no surprise. Almost every part of a vehicle, from the infotainment system and engine control units down to the steering column and brake lines, is wired into a set of computer-based subsystems.

Each subsystem gives an attacker several possible ways in. Hodge adds a second difficulty: cars communicate over many interfaces, among them USB, CAN bus, Wi-Fi, Bluetooth, cellular and automotive ethernet. That hands criminals a wide menu of attack routes and leaves engineering and testing teams with a very hard job to secure them all.

Regulators and standards bodies have not given up, however. They have drawn up a plan to push back, built on the ISO/SAE 21434 standard and the UNECE WP.29 and UN R155 regulations that carmakers have heard so much about recently. Hodge sets out what each one means in practice.

WP.29 sets the direction, R155 enforces it

UNECE WP.29, the World Forum for Harmonization of Vehicle Regulations, is a broad strategic effort to align OEMs on a whole range of vehicle rules, from headlights to exhaust pipes. In June 2020 it adopted a new framework for tackling cybersecurity risk in passenger vehicles. The work produced two regulations requiring carmakers to put measures in place that:

• manage cybersecurity risk in vehicles;

• make vehicles secure by design, reducing risk along the supply chain;

• detect and respond to security incidents across the fleet;

• deliver software updates safely without weakening vehicle security.

Hodge describes this high-level guidance as the carrot and the regulations that come with it as the stick.

The main regulation to emerge from the WP.29 framework in June 2020 is UN R155, which requires OEMs to build cybersecurity into every stage of the vehicle engineering lifecycle. Put simply, it comes down to two things. OEMs must set up and run a cybersecurity management system (CSMS) that applies risk-driven engineering processes to vehicle components, subsystems and assemblies. And carmakers must show that their CSMS complies in order to obtain "type approval" from the UN; a vehicle without that approval may not be driven on public roads.

Enforcement of UN R155 starts on 1 July in major markets including the EU, the UK, Korea and Russia, and Japan already enforces it. It applies to every new vehicle type built from that date. From 1 July 2024, every vehicle in production must comply.

ISO/SAE 21434 and a target that keeps moving

Hodge likens UN R155 to a lock and ISO/SAE 21434 to the key that opens it. Unlike R155, 21434 is a standard, not a regulation. R155 says a CSMS must be deployed; 21434 describes how to build one.

As with functional safety, automotive cybersecurity follows the classic "V Model" of engineering, so all testing of components and systems falls under verification and validation, on the right-hand side of the model. The complication, in Hodge's view, is that security never stands still. Functional safety needs testing only once for each component, but new threats, exploits and vulnerabilities appear daily, so security testing can never be a one-off exercise.

This is the job of the CSMS. A sound CSMS demands thorough evaluation of relevant threats through a Threat Analysis and Risk Assessment (TARA). After a TARA, OEMs can identify, apply and verify mitigations and then roll them out to components and systems through software updates. An efficient CSMS lets them reassess and deal with new threats promptly, while making sure a fix does not accidentally open another component or system to attack.

Attacking your own cars first

With the standards written and the regulations adopted, carmakers are left asking what comes next, and Hodge understands the uncertainty given the threats and the rules on the way. He argues, though, that ISO/SAE 21434, WP.29 and UN R155 are not a danger to OEMs but a playbook for defeating attackers. For carmakers, that means attacking their own vehicles before anyone else does.

The idea is to think like the adversary. Where a criminal would look for weaknesses in systems and components, the manufacturer can run controlled attacks to test vehicle security properly, in line with its CSMS. Usually called automotive penetration testing, this covers several kinds of test, including functional cybersecurity testing, fuzz testing and vulnerability testing. The tests must cover a full range of threat vectors and every point an attacker could enter through, which means every interface a modern car uses: cellular, Wi-Fi, Bluetooth, USB, CAN, automotive ethernet and others.

Software updates, the favoured way to fix vulnerabilities in automotive components and systems, then need extensive re-verification. The process repeats over and over, and Hodge considers automation essential to making it workable. He compares it with how often a phone updates: paying a tester to check every intended mitigation in every release would take an enormous amount of time and money.

Complying with UN R155 calls for testing that is repeatable, scalable and well documented. With large attack surfaces, new threats and mandatory compliance steps, Hodge regards integration and automation as the minimum requirement. A carmaker can piece together its own test platform from separate hardware and software components, he says, but the effort of running a homegrown system can easily cancel out whatever it gains.

Cybersecurity changes almost constantly, and Hodge expects a surge of new attack vectors, component threats and system vulnerabilities in the coming years. The carmakers that react fastest, he argues, will end up the best protected and the safest option for demanding buyers. His case is for getting ahead of attackers with an automated, integrated and intelligent approach, so that systems stay shielded, vehicles stay secure and, above all, passengers stay safe.