April 2024: Automotive Cybersecurity Safeguards

When
April 3rd, 2024 11:00 AM EST

Who
Darryn Persaud, CMO, Comply.Law

What
“Automotive Cybersecurity Safeguards”

Description
This session will discuss an overview of how OEMs can improve Cybersecurity and protocols within their environments though an industry overview and three recent case studies that illustrate how detrimental a cybersecurity threat and or attack can be specifically to the automotive industry.   Presenter will then discuss preventative measures and solutions pertaining to these issues that are relevant and attainable for OEMs, their third-party vendors (i.e. apps, cloud technologies )  and their dealership partners, that include ongoing training, preventative software and technologies, and daily practices that should be second nature and implemented into standard protocols within any organization.

March 2024: The SAE Electric Vehicle Charging Station Illustrative Example: How to apply JA7496 standard to Electric Charging Scenarios Insights

When
March 6th, 2024 11:00 AM EST

Who
Jay Schwartz, SAE G-32: S.A.E. Cyber-Physical Systems Committee’s Electric Vehicle Illustrative Example Subcommittee Chair

What
“The SAE Electric Vehicle Charging Station Illustrative Example: How to apply JA7496 standard to Electric Charging Scenarios Insights”

Description
Electric vehicle charging stations are proliferating, and there is no end in sight for how many of them will ultimately exist.  However, these stations are highly dependent on how they interface with both the vehicle and “the world”.  Given their sophistication versus traditional gas pumps there needs to be a way to make them cyber-secure from a system point of view that is agnostic to their hardware, software, data, mechanical, and functional characteristics and properties.

February 2024: 2024 Global Automotive Cybersecurity Report: Key Findings & Insights

When
February 7th, 2024 11:00 AM EST

Who
Shira Sarid-Hausirer, Upstream Security

What
“2024 Global Automotive Cybersecurity Report: Key Findings & Insights”

Description
Since 2019, Upstream has been releasing the definitive Global Automotive Cybersecurity reports which analyze hundreds of automotive incidents in order identify major trends and predict what’s ahead in the cybersecurity threat landscape.

Now, with the 2024 report just out, we look back at 2023 and can safely say that this past year, the automotive industry has reached an inflection point.  Based on our analysis of hundreds of automotive incidents between 2010-2023, we’re seeing that the sheer impact of cybersecurity attacks has dramatically increased during 2023, with far-reaching consequences for automotive stakeholders (inc. OEMs, automotive manufacturers and suppliers, EV charging companies). During the community call we’ll put a spotlight on key shifts that took place in the automotive industry in 2023, discuss the role of GenAI - how it’s being used by threat actors and how it can also be harnessed for threat detection and remediation. We’ll also provide overview of new security regulations and predictions for the year ahead.

January 2024: Scalable Attacks on Connected Vehicles

When
January 10th, 2024 11:00 AM EST

Who
Ramiro Pareja Veredas, Principal Cybersecurity Consultant, IOActive & Yashin Mehaboobe, Senior Cybersecurity Consultant, Xebia

What
“Scalable Attacks on Connected Vehicles”

Description
For the last 10 years, the automotive industry has been involved in an electrification and automation process that is revolutionizing the way we drive. The fundamentals of this deep transformation are battery-powered engines, self-driving cars, and connected vehicles. These technological advances - especially vehicle connectivity – bring about many new cybersecurity challenges that need to be addressed in the coming years.

The goal of the work that we present here assess the current state of connected vehicle cybersecurity. Compared with other works already published, in which the researchers chose to attack a popular modern car, IOActive focused on other automotive components and systems that cybersecurity experts - and car designers - usually overlook, and which could be abused to launch scalable and massive attacks. We analyzed devices including telematics, OBD2 dongles, 5G modems, MQTT servers, and mobile apps, aiming to get a broader picture of the state of automotive cybersecurity, expanding on the existing view based limited to the vehicles themselves.

IOActive’s research identifies multiple vulnerability issues that can be exploited remotely to gain full control of an entire fleet of cars, heavy-duty trucks, and cranes. Although our work is limited to a few devices - not enough to draw an industry-wide conclusion - it indicates that these types of cybersecurity issues might be common and that the cybersecurity of connected automotive systems needs to be improved.

December 2023: API Security Risks for Connected Cars

When
December 6th, 2023 11:00 AM EST

Who
Dan Barahona, Founder, APIsec University

What
“API Security Risks for Connected Cars”

Description
According to Gartner, APIs have become the “most frequent attack vector” – and this appears to be very true for the automotive sector. While APIs offer remarkable benefits for software development, integration, and scalability, they have become a primary target for attackers. Recent studies have show connected cars susceptible to API manipulation to lock/unlock car doors, start and stop engines, and much more.

This session will discuss why APIs appeal to attackers, what makes them especially difficult to secure, and best practices for keeping car APIs safe.

November 2023: The Game of IT/OT Security: Unveiling New Critical Developments in Our Critical Infrastructure Threat Landscape

When
November 1st, 2023 11:00 AM EST

Who
Adam Robbie, Senior Staff Researcher, Palo Alto Networks

What
“The Game of IT/OT Security: Unveiling New Critical Developments in Our Critical Infrastructure Threat Landscape”

Description
Critical infrastructure such as manufacturing, electrical-grid, or water-utilities uses Industrial Control Systems/Operation Technology for daily operations. If you have pumped your car, turned on the light, or drank water, then you have interacted with ICS. In this presentation, we will discuss our research team’s findings related to three new critical developments in the ICS/OT threat landscape. These findings are based on data we collected from ten thousand companies and across 50 countries over the past three years. We will then demonstrate by using the Purdue model, how non-ICS malwares can exploit and propagate through the ICS system. 

First, we will show that ICS/OT industries have become the new top target for many national-state adversaries and cyber criminals. This conclusion is based on an extensive technical analysis of recent exploits. We found that the rate at which exploits targeting ICS/OT industries far surpasses the exploit rate as to all other industries in both quantity and growth trend. Another data-driven analysis indicated that in 2022, the industry most impacted by ransomware and extortion attacks was manufacturing.

The second finding is that, contrary to popular belief, ICS malware centric is not the top threat for ICS/OT industries.  Rather, as our analyses revealed, approximately 99.99% of malware impacted the ICS/OT industries were exploiting IT technology/protocols, such as Emotet, Coinminers, or AgenTesla.  Only 0.001% of malware targeting ICS/OT industries were exploiting ICS/OT protocols (e.g., Havix, Shamoon, or BlackEnergy). 

The final finding concluded that ICS/OT industry detection time of compromised devices lags far behind the industry standard.  In the most extreme example of delayed detection, we found an unattended compromised device that communicated with C2 for a period of ten months.  

The totality of the above findings confirms why ICS/OT leaders need to update their defense plans to protect our critical infrastructure. To this end, we will demonstrate how to create a zero-trust defense strategic solution by applying Game Theory to risk assessment and by mapping threats to MITRE TTPs. This approach incorporates Game Theory modeling and the ICS ATT&CK framework to conquer the adversary in this new landscape.

October 2023: Pwn2Own for Automotive @ Automotive World Tokyo, January 2024

When
October 4th, 2023 11:00 AM EST

Who
Brandon Barry, CEO, Block Harbor; Niraj Kaushik, MD North America, VicOne; Brian Gorenc, VP Threat Research Trend Micro

What
“Pwn2Own for Automotive @ Automotive World Tokyo, January 2024”

Description
“Tesla hacked in under 2 minutes” is one of the major headlines. Researchers prepared for months, and they flew to Vancouver to take home a Tesla Model 3 and $100,000 in cash. 21 more zero day vulnerabilities were discovered across many industries at the same event. Pwn2Own.

What if we had a $1.5M pool to pay researchers to demonstrate some of the most creative exploits of vehicles in Tokyo, January of 2024? An automotive-specific Pwn2Own. It’s happening. In this talk, we’ll overview what Pwn2Own is, and we’ll ask you to provide components or vehicles to access some of the world's top research. The catch? There is none. We’ll handle the bug bounty payouts and there is no cap. One lucky Auto ISAC member will get a free sponsorship for the event!

September 2023: “Cyber Policy Developments Affecting the Auto Industry”

When
September 6th, 2023 11:00 AM EST

Who
Stephen Lilley, Partner, Mayer Brown

What
“Cyber Policy Developments Affecting the Auto Industry”

Description
This presentation will discuss recent cybersecurity policy developments that could have significant implications for members of the Auto-ISAC, including: the SEC’s final rules on cybersecurity disclosures; the Biden Administration’s implementation of its cybersecurity strategy; Version 2.0 of the NIST Framework; and implementation to-date of the Cyber Incident Reporting for Critical Infrastructure Act. This presentation will provide key takeaways from these recent policy developments, including how they may inform NHTSA’s expectations for members of the Auto-ISAC.

August 2023: “Towards Deployment of a Zero-Trust Architecture (ZTA) For Automated Vehicles (AV)”

When
August 2nd, 2023 11:00 AM EST

Who
Victor Murray, Assistant Director, CISSP, Southwest Research Institute

What
“Towards Deployment of a Zero-Trust Architecture (ZTA) For Automated Vehicles (AV)”

Description
The advancement of Automated Vehicle (AV) technology is critical to maintaining military superiority. AV development historically placed a significant focus on functionality and less on security. Ongoing cybersecurity programs such as Cybersecurity for Robotics and Autonomous Systems Hardening (CRASH) are working to implement a holistic approach to applying security to AVs while simultaneously supporting the developer focus on functionality. This task is challenging as previous research has demonstrated vulnerabilities in AV systems due to their continuous physical interaction with the environment through sensors and actuators, command and control, and remote connectivity. This paper presents an approach to balance functionality and security through a Zero-Trust Architecture (ZTA) for AV which leverages authentication, cyber policy enforcement, and monitoring to detect and mitigate cyber-attacks. This approach is traceable to guidance provided in NIST 800-207 for applying zero trust concepts to Information Technology (IT) networks.

The presented example AV architecture begins with a non-self-driving baseline, adding sensors, actuators, command/control, and remote connectivity. The seven (7) principles from NIST 800-207 are distilled into three (3) components: 1. Authentication 2. Policy Enforcement and 3. Monitoring. Authentication includes verifying that software is authentic prior to booting, and a combination of public/private key encryption, symmetric key encryption, and Message Authentication Codes (MACs) are used to secure all networked communication. Policy Enforcement occurs at every node on the AV system and is overseen by the central gateway. The gateway also monitors traffic and logs issues. Together, these combine into the ZTA for AV.

Several recent programs have implemented portions of the ZTA for AV outlined. For example, the CRASH program has implemented authentication for ethernet communication, security policy enforcement for control code base, process separation, monitoring autonomy communication, and securely updating software. Other programs are tackling related pieces in parallel including monitoring automotive CAN and ethernet busses and improving resiliency through sensor redundancy and fusion. To fully implement ZTA for AV, there are pieces that still need to be addressed in future efforts.

July 2023: “Driving a Cyber-Secure Culture in Auto Manufacturing: The Essential Role of the Human Factor”

When
July 5th, 2023 11:00 AM EST

Who
Roy Zur, Founder & CEO, ThriveDX

What
“Driving a Cyber-Secure Culture in Auto Manufacturing: The Essential Role of the Human Factor”

Description
In the increasingly digitized landscape of auto manufacturing, the Human Factor plays a pivotal role in cybersecurity.
This session will explore the profound influence of advanced cybersecurity training that extends beyond basic awareness, alongside the value of secure coding practices and the skill sets of IT and security analysts. We'll also highlight the instrumental role of the C-suite in spearheading these initiatives and the crucial importance of fostering a cyber-secure culture within your organization. We'll delve into methods for equipping your workforce with advanced cybersecurity skills, thereby transforming them into your organization's most potent cybersecurity asset. Come join us as we discuss how to harness your human factor effectively to counteract cyber threats and thrive amidst the ever-evolving cyber landscape.

June 2023: “What is the Car Hacking Village (CHV)?”

When
June 7th, 2023 11:00 AM EST

Who
Justin Montalbano, President, Car Hacking Village

What
“What is the Car Hacking Village (CHV)?”

Description
Ever wonder what all those nerds in Vegas are doing every year at DefCON? Join Justin Montalbano in his firsthand experience of the event at DefCON he orchestrates, the Car Hacking Village. Throughout this presentation, Justin will go over the basics of DefCON then dive into more details of what the Car Hacking Village is, their activities, previous events and how to get involved.

May 2023: Cybersecurity Challenges in the Electric Vehicle Market

When
May 3rd, 2023 11:00 AM EST

Who
Nalindrani Malimage, Cybersecurity Consultant at Burns and McDonnell

What
"Cybersecurity Challenges in the Electric Vehicle Market”

Description
Electric vehicle market is a small market in the larger automotive industry. The electric vehicles is growing than ever before. This is also owing to factors such as, political factors, growing demand, the need for environmentally friendly solutions and increased focus on sustainability. The question arises if the electric vehicle market is addressing the emerging cyber threats in the industry at the same time and how prepared the industry is. The key areas to look into with regard to this would be, OEM security, network security, cloud security, IOT and charging methods. It’s important to look at a few past security incidents in this phase and discuss challenges to predict what the future holds for the EV (electric vehicle) market. The topic is focused on mainly understanding the cybersecurity challenges in the EV market.

April 2023: NIST Auto Cybersecurity Community of Interest”

When
April 5th, 2023 11:00 AM EST

Who
Suzzanne Lightman, Senior Advisor, NIST; Nakia Grayson, IT Security Specialists, NIST

What
"NIST Auto Cybersecurity Community of Interest”

Description
NIST covers a wide range of topics in cybersecurity and many of these topics directly relate to the transportation sector and automotive in particular. To facilitate outreach to the automotive sector, NIST has created a Community of Interest. This presentation will introduce the community, its purpose and some of the activities that NIST will be communicating to the community over the coming year.

March 2023: Introducing the CyberAuto Challenge – a Tool for Talent Development and Engaging the Next Generation Workforce

When
March 1st, 2023 11:00 AM EST

Who
Karl Heimer, Principal, Heimer & Associates LLC

What
"Introducing the CyberAuto Challenge – a Tool for Talent Development and Engaging the Next Generation Workforce”

Description
This session describes the model and mission of the CyberAuto Challenge (and sibling events), its history of engaging students, observed outcomes, what the event is like to attend, and then intent for the 2023 year and future years.

February 2023: Cross-Sector Cybersecurity Performance Goals for Critical Infrastructure

When
February 1st, 2023 11:00 AM EST

Who
Peter Colombo, Senior Advisor, CISA

What
"Cross-Sector Cybersecurity Performance Goals for Critical Infrastructure”

Description
In October 2022, CISA published a set of Cross-Sector Cybersecurity Performance Goals (CPGs), which highlighted the most impactful actions critical infrastructure owner/operators can implement to meaningfully reduce cybersecurity risk.  These are of particular value to small and medium sized entities as a tool to aid in identifying potential gaps in their capability and assessing where resources should be applied in a manner to have a meaningful impact on improving the cybersecurity posture of an organization.  Rather than general investment in a broad cybersecurity program, the focus is on targeted investment in known areas of weakness.

January 2023: Auto-ISAC Automotive Cybersecurity Training (ACT) Program Overview

When
January 11, 2023 11:00 AM EST

Who
Tamara Shoemaker, Cybersecurity Training Lead, Auto-ISAC

What
"Auto-ISAC Automotive Cybersecurity Training (ACT) Program Overview”

Description
Join us to learn everything you every wanted to know about the Automotive Cybersecurity Training Program (ACT). 2023 signals the sustainment of the ACT program, so we’d like to take this opportunity to discuss the way forward and offer the community the time to ask questions about the program.

December 2022: CISCP to JCDC Transition

When
December 7, 2022 11:00 AM EST

Who
Dan Strachan, Senior Engagement Lead, Joint Cyber Defense Collaborative (JCDC)

What
"CISCP to JCDC Transition”

Description
CISA is pleased to announce plans to begin integration of the Cyber Information Sharing and Collaboration Program (CISCP) into the Joint Cyber Defense Collaborative (JCDC) model. Over the coming months, we will be working to integrate companies into the JCDC and establish specialized subgroups for real time information sharing.

November 2022: A Global Grassroots Community of 10,000+ Automotive Security Folks: The ASRG

When
November 2, 2022 11:00 AM EST

Who
Brandon Barry, CEO, Block Harbor Cybersecurity

What
A Global Grassroots Community of 10,000+ Automotive Security Folks: The ASRG”

Description
The Automotive Security Research Group is a non-profit grassroots organization focused on the workforce solving challenges in vehicle cybersecurity. Founded by John Heldreth in Stuttgart, Germany, with the next chapter being founded by Sean McKeever and Brandon Barry in Detroit, Michigan, the ASRG quickly grew to over 40 locations all over the world — from Africa to Australia — with over 12,000 people registering for a local chapter. The ASRG captures the interest of folks that want to discuss their day-to-day challenges in vehicle cybersecurity both with their local community and with the broader, global automotive security community. With an engaged academia community, strong membership, and passionate individuals donating their time to run local chapters, the ASRG is a platform to foster remarkable conversation, including hosting WORLD webinars where experts talk about topics in vehicle cybersecurity on YouTube and hosting the “Secure Our Streets” virtual conference in 2022.

October 2022: Auto-ISAC Education and Training Standing Committee (ETSC) 2022 Cybersecurity Awareness Project

When
October 5, 2022 11:00 AM EST

Who
Kristie Pfosi, Executive Director of Product Security, Aptiv- ETSC Chair

Christine Pelione, Cybersecurity Strategic Risk Manager, GM- ETSC Vice Chair

Tamara Shoemaker, ACT Program Manager, Auto-ISAC- ETSC Staff Lead

What
Auto-ISAC Education and Training Standing Committee (ETSC) 2022 Cybersecurity Awareness Project

Description
Cybersecurity is not a bolt-on solution. Like safety and quality, it needs to be designed from the concept phase and supported through the product’s end of life. In this modern vehicle ecosystem, cybersecurity is everyone’s responsibility. We are all in this together. We are all connected. Join this Community Call session to find out about our TLP White videos and posters the ETSC Awareness Tiger Team as put together for you to use during Cybersecurity month!

September 2022: Program SAE EV Charging Public Key Infrastructure Program

When
September 14, 2022 11:00 AM EST

Who
Tim Weisenberger, Program Manager, SAE International

What
SAE EV Charging Public Key Infrastructure Program

Description
EV Charging systems have crucial and growing interface points between the Automotive industry, EV drivers, and the Electric Grid/Energy industry. It is critical that these interfaces be secure and trusted. SAE has gathered global EV Charging Ecosystem members in a Cooperative Research Program, to create a solution by industry for industry. The SAE EV Charging PKI program has designed and is currently testing an inclusive, worldwide EV charging industry PKI platform that is secure, trusted, scalable, interoperable, and extensible. Once complete, the PKI design platform will be migrated to an industry consortium to field an operational industry PKI to strengthen electric vehicle charging system security industry wide.