Ride the Lightning

Lawmakers Ask Automakers: How are You Protecting Cars from Cyberattacks?

June 2, 2015

It's a darn good question – and we really haven't received a lot of good answers.

As a The Washington Post story noted, we are looking at a new world of automotive technology. Now the cars can monitor everything from tire pressure to our music and some have WiFi hotspots built into the dashboards. Driverless cars are already here, and may take over the marketplace within a generation.

Ten members of the House of Energy and Commerce Committee are questioning how the government and auto-makers are preparing for the potential cybersecurity risks of software in vehicles. In a letter sent to 17 car manufacturers and the National Highway Transportation and Safety Administration, the lawmakers want the agency and automakers to provide details on what they are doing to protect against cyber-vulnerabilities – including how they test vehicles for such vulnerabilities while they are being designed and once they are on the road. Letter recipients were asked to respond by June 11th.

The NHTSA did not immediately respond to an inquiry about the letter, but the agency is researching cybersecurity issues related to cars and released a summary of cybersecurity best practices as well as a report on potential security threats to vehicles last September.

The auto industry certainly has taken note of the threats and is incorporating security measures, however cybersecurity experts have warned that the auto industry is lagging behind some other sectors. Researchers Chris Valasek and Charlie Miller were able to take over the brakes and steering of a Ford Escape and a Toyota Prius using a laptop connected to the vehicles with a cable. Last year, they released a report laying out potential wireless "attack surfaces," like WiFi connections and Bluetooth in many cars on the market that might be targeted by a malicious attacker. Senators Ed Markey and Richard Blumenthal are currently working on legislation that would direct NHTSA and the Federal Trade Commission to establish federal standards for vehicular cybersecurity and privacy.

Sorely needed – and such standards will no doubt be obsolete as soon as they are issued – the increasing use of technology in cars is simply moving too fast.

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
http://www.senseient.com
http://twitter.com/sharonnelsonesq
www.linkedin.com/in/sharondnelson