[Insight column] Kwon Dong-hoon, 'Cybersecurity Testing Methodology to increase reliability'
Charlie Miller,
the legendary hacker famous for hacking into a Jeep Cherokee, said eight years
ago that computer hacking became boring and that hackers would turn their focus
to devices such as cars, trains, power plants, and traffic signals. We are in the
age of IoT (Internet of Things), a market of interconnected devices through the
Internet. The V2X (vehicle-to-everything) era is just around the corner. The
significance of cybersecurity testing cannot be overstated, as it serves as a
foundational safeguard against scenarios like the "zombie car action
sequence."
Author | Kwon Dong-hoon, Security
Vulnerability Analysis Team leader, FESCARO
Kwon Dong-hoon, Security Vulnerability Analysis Team Leader
Began professional
journey in security information sector back in 2001. Over the years, he
dedicated countless nights as a security threat analysis/response specialist at
AhnLab. Throughout various cybersecurity incidents, he's been actively involved
in analyzing and addressing security breaches and malware (V3). This was part
of his activities in the Threat Response Public-Private Council, collaborating
closely with entities such as KISA, the police, and the prosecution. During the
IT paradigm shift, he engaging in strategic planning at SK Shielders to improve understanding on cloud security. One day, he chanced upon the
powertrain ECU of a Nordic car brand that no longer exists, and the car engine
control mechanism captivated him. This interest persisted discreetly, leading
him to join FESCARO as the leader of the red team.
Figure 1. Still
Image from ‘Fast and Furious: The Extreme’ (Source=Naver Movie)
Downtown New York, overrun By ‘Zombie
Cars’
Hundreds of cars equipped with
self-driving software were hacked, paralyzing traffic in downtown New York.
Fortunately, this is just a famous scene from the 2017 movie 'Fast and Furious:
The Extreme'. A movie reviewer, identifying himself as a 'security enthusiast,',
likened it to "a zombie car action sequence that visualizes a DDoS
(Distributed Denial of Service) attack." As a 'security enthusiast' also,
I wholeheartedly concurred with this depiction.1)
‘Upgrade (2018)’, an Australian film I
recently enjoyed on Netflix, is also set in a near future where AI-based fully
autonomous driving is the norm. The film showcases the use of autonomous
driving technology to move a car to a crime scene, and hacking another to avoid being chased by the police.
Some scenarios from these movies have
already become a reality. A famous example is when Charlie Miller and Chris Valasek, well-known pioneers in automotive security research, succeeded in remotely hacking a Jeep Cherokee driving on the highway in 2015. Their successful demonstration highlighted the
potential to control various vehicle functions, from steering and braking to
temperature and lock regulation. As a consequence, Fiat Chrysler had to recall 1.4
million vehicles impacted by this vulnerability.2)
Just over a year ago, David Colombo, a
19-year-old cybersecurity expert from Germany, revealed that he could remotely
compromise 25 Tesla vehicles across 13 countries by using automotive software system vulnerabilities. This quickly gained traction on Twitter and
became a hot topic in major news globally, underscoring the heightened cyber
risks associated with technological advancements.3)
The automotive industry is experiencing
a transformative shift as traditional hardware-focused technologies merge with
software-centric ICT technologies. Spearheaded by Tesla, global automakers are vying to showcase their visions for autonomous and connected vehicles, with
electric vehicles (EV) at the forefront. Moreover, major tech giants, both
domestic and international, such as Google, Microsoft, and Kakao, are actively
participating in this evolution.
Governments around the world are not
standing idle. As the mobility industry becomes a key determinant of future
competitiveness, countries are competing for leadership. They're implementing
policies that align with their own interests and goals.4) For instance, in
2018, the Korean government established 'K-City' (Figure 2) in Hwaseong,
Gyeonggi-do. This 5G communication network-based city for autonomous vehicle
testing replicates real-world environments. It aims to spearhead and
commercialize global autonomous driving technologies. Proactively, K-City has
embraced digital twin technology5) and entered into a
partnership agreement with 'M-City' at the University of Michigan, USA, which
is the world's inaugural experimental city devoted to autonomous driving.6)
Figure 2. Bird's
Eye View of K-City (Autonomous Driving Experimental City), (Source=KATRI)
As a security
enthusiast, I hope that K-City will also feature a ‘cybersecurity demonstration
center.’
Technological
progress is a double-edged sword. As autonomous driving technologies evolve, so
will hacking techniques. Consider the future commercialization of V2X
(vehicle-to-everything) technology7). Vehicles will engage in high-density
communication with a variety of things, including other vehicles, pedestrians'
mobile devices, and transportation infrastructures like roads and traffic
lights. Beyond just the potential for vehicular hacking, this opens the door to
the possibility of large-scale cyber-terrorism targeting networks and
infrastructures. Such attacks could result in societal disruption far exceeding
any prior incidents.
By proactively
implementing technological solutions to address and preempt vehicle-related
hacking, which poses significant risks to numerous lives, we can move closer to
presenting a more well-rounded autonomous driving technology
to the world.
R155: The first international automotive
cybersecurity regulation
As autonomous
driving and connectivity technologies progress, vehicles see a rise in
electronic control units (ECUs) and heightened communication intricacies. This
inevitably amplifies the potential for cybersecurity vulnerabilities and the
risk of hacking. Recognizing this, an international consensus emerged on the
importance of automotive cybersecurity, culminating in the establishment of the
inaugural global regulations. In June 2020, UNECE WP.29 (World Forum for
Harmonization of Vehicle Regulations under the United Nations Economic
Commission for Europe) introduced UN Regulation No. 155 ("UN R155")
addressing Cybersecurity and Cybersecurity Management System. This regulation officially
took effect in January 2021.8)
Figure 3. UN R155 (Source=UNECE)
Per this regulation,
automakers are mandated to implement a Cybersecurity Management System
(CSMS) across the development, production, and post-production phases, and
secure the necessary certification. Furthermore, as illustrated in Figure 4,
they must achieve Vehicle Type Approval (VTA) by conducting cybersecurity
assessments and validations, both at the individual controller and overall
vehicle levels. This ensures that the vehicle models they intend to market
adhere to CSMS standards.9)
Figure 4. VTA(Vehicle Type Approval)
Process in UN R155 (Source=FESCARO)
All 27 EU member
nations have either adopted this automotive cybersecurity regulation or
integrated it into their domestic laws.10) As a result, starting from July 2022,
every new vehicle model sold in these countries must conform to these
stipulations. From July 2024, every new vehicle manufactured and sold will fall
under this regulatory umbrella. Consequently, automakers will need to
successfully undergo cybersecurity evaluations and validations for any new
vehicle models they intend to market in Europe.
The provisions
concerning cybersecurity testing and validation can be found in Section 5
and 7 of UN R155. The key aspects of these articles are outlined below.11)
Section 5 Approval
1.2 The Approval Authority or the Technical Service shall verify by testing of a vehicle of the vehicle type that the vehicle manufacturer has implemented the cybersecurity measures they have documented.
1.3 The Approval Authority or Technical Service shall refuse to grant the type approval with regard to cyber security where the vehicle manufacturer has not fulfilled one or more of the requirements referred to in paragraph 7.3., notably.
Section 7 Specifications
3
Requirements for vehicle types
3.1 The manufacturer shall have a valid Certificate of Compliance for the Cyber Security Management System relevant to the vehicle type being approved.
3.2
The vehicle manufacturer shall identify and manage, for the vehicle type being
approved, supplier-related risks.
3.3 The vehicle manufacturer shall identify the critical elements of the vehicle type and perform an exhaustive risk assessment for the vehicle type and shall treat/manage the identified risks appropriately. While assessing the risks, the vehicle manufacturer shall consider the risks related to all the threats referred to in Annex 5, Part A, as well as any other relevant risk.
3.4 The mitigations implemented shall include all mitigations referred to in Annex 5, Part B and C which are relevant for the risks identified. (A related example is depicted in Figure 5
below.)
3.6 The vehicle manufacturer shall perform, prior to type approval, appropriate and sufficient testing to verify the effectiveness of the security measures implemented.
3.7 The vehicle manufacturer shall implement measures for the vehicle type to a) Detect and prevent cyber-attacks against vehicles of the vehicle type b) Support the monitoring capability of the vehicle manufacturer with regards to detecting threats, vulnerabilities and cyber-attacks relevant to the vehicle type c) Provide data forensic capability to enable analysis of attempted or
successful cyber-attacks.
Figure 5. Schematic Diagram of
Automotive Cybersecurity Threats (Source=KATRI)
Response to Automotive Cybersecurity Regulations
As per KATRI, Korea
actively engaged in the development discussions and validation tests for
cybersecurity standards within the UNECE WP.29 Cybersecurity Expert Technical
Group (CS/OTA IWG, Informal Working Group on Cyber Security & OTA).
Moreover, through a series of meetings and feedback sessions involving various
stakeholders and experts, including prominent domestic and international automakers, it formulated the 2020 Automotive Cybersecurity Guidelines.
Korea is currently
updating its domestic regulations in alignment with international standards
like UN R155. These changes are anticipated to take effect by the end of July
2023 and be enforced from the end of July 2024. Nonetheless, based on the fit
with existing structures, it is expected that the current self-certification
approach will continue, rather than adopting the type approval (VTA) method as
seen in UN R155.
Looking at the
stances of major countries, the United States is contemplating a
self-certification system12)while Japan has adopted UN R155 like the EU13)
ISO/SAE 21434: International Standard
for Automotive Cybersecurity Engineering
ISO/SAE 21434 serves
as the international benchmark for automotive cybersecurity engineering. This
standard outlines cybersecurity processes spanning the full product lifecycle
of a vehicle—from planning and development to production, maintenance, and eventual
disposal. It can be used by a diverse group of stakeholders, including automakers, component suppliers, and software companies.14)
The UNECE recommends
referring to ISO/SAE 21434 when setting up and managing the cybersecurity
management system (CSMS) as stipulated by UN R155. Essentially, ISO/SAE 21434
can be employed to implement a CSMS encompassing cybersecurity risk management
and governance for automotive electrical/electronic controllers and their
associated interfaces. Figure 6 depicts the comprehensive structure of ISO/SAE
21434.15)
Figure 6. Comprehensive Structure of
‘ISO/SAE 21434 Cybersecurity Engineering' (Source=ISO)
The ‘cybersecurity
testing’ process based on ISO/SAE 21434 is shown in Figure 7. It is similar to
the typical regulations/standards response processes of automotive
cybersecurity companies. Once a professional consulting team finishes
consulting for CSMS certification, white hat hackers from the red team carry
out TARA, security tests on ECUs and vehicles(penetration testing, fuzzing
testing, and vulnerability scanning), and security function test. This rigorous
testing ensures compliance with security standards, leading to the creation of
a final validation report.
Figure 7. ISO/SAE 21434 Based
‘Cybersecurity Testing’ Process (Source=FESCARO)
Section 15
TARA(Threat Analysis, Risk Assessment)To begin with, a
range of modeling techniques are utilized to analyze threats and evaluate risks
associated with the vehicle's ECU. While the ISO/SAE 21434 standard suggests
modeling approaches such as EVITA, TVRA, and STRIDE, STRIDE modeling tends to
be the preferred approach.
Section 9 Concept
After completing
TARA, the next step is to identify the cybersecurity requirements of the
designated ECU, referencing Section 9. Subsequently, a security control concept
should be devised to fulfill those requirements. Common cybersecurity control
measures implemented for automotive ECUs include:
1) Access Control:
Secure boot, Secure access, Secure flash, Secure debug, Memory protection, etc.
2) Hardware
Security: Implementing HSM, eliminating JTAG/UART debug ports, utilizing BGA
type chips, bonding, etc.
3) Software
Security: Secure coding, encryption, OS security, etc.
*
Here I’ll focus on cybersecurity testing and will not
delve into detailed descriptions of each individual cybersecurity control.
Section 10 Product Development
Section 10 outlines
the product development phase, which implements the cybersecurity requirements
specified in Section 9. This section encompasses activities to verify whether
the requirements have been properly implemented, and also highlights four verification
test methods, as detailed below:
1) Security function
test to ensure the implemented security features function correctly
2) Penetration test
from a hacker’s perspective
3) Vulnerability Scanning to determine if potential vulnerabilities have been adequately reduced
4) Fuzzing Test,
which assesses for irregularities by inputting random values
Section 11 Cybersecurity Validation
Section 10 details
verification activities performed on individual ECUs, while Section 11 is about
the cybersecurity validation process applied to actual vehicles. Assessing
cybersecurity within the vehicle's operational environment, combined with its
mass production setup, is vital. This ensures that the primary cybersecurity
objectives are met and that no outstanding undue risks remain.
‘Non-functional testing’ for
proactive security
Automotive
cybersecurity validation testing primarily encompasses both functional and
non-functional testing. 'Security function testing' involves confirming that
the functions for automotive cybersecurity control measures (or security
solutions) are correctly implemented. 'Non-functional testing' consists of the
three methods outlined in the ISO/SAE 21434 standard.
1) Penetration Test
The test aims to
assess the implemented cybersecurity measures, identify gaps, and take
complementary measures by attacking target vehicle systems from a hacker's
perspective (ethical hacking). The primary focus is on uncovering unnoticed
vulnerabilities using a range of hacking methods.
2) Fuzzing Test
The test evaluates
the software's robustness by repeatedly sending random or adaptive inputs,
often at escalating frequencies.
3) Vulnerability Scanning
The test aims to
identify recognized security vulnerabilities in embedded operating systems like
Android/Linux and open sources utilized in application development,
subsequently implementing supplementary actions such as patches or hardening.
Cybersecurity testing methodology to
increase reliability (feat. five know-hows)
It has now been a
year since the first international cybersecurity regulations came into force.
Global governments are advancing legislative efforts, including enacting and
amending laws, while affiliated organizations strive to define more explicit
institutional benchmarks for specific regulatory prerequisites. The materials
presently available offer a general roadmap, but specifics concerning security
test design and execution often hinge on the discretionary interpretation and
strategy of cybersecurity-specialized companies.
I am leading the Red
Team at FESCARO, a company dedicated to automotive cybersecurity, and have a
track record of successfully navigating security tests to secure CSMS and VTA
certification for global automakers. FESCARO stands out as the sole automotive
cybersecurity company in Korea that has achieved a grand slam16) in cybersecurity-related certification
consulting, including CSMS, ISO/SAE 21434, SUMS, and VTA. Moreover, we've
garnered commendable reviews from global technical service assessors who handle
hundreds of cases. Now, let’s delve into the strategies to enhance
cybersecurity test reliability, spotlighting the “Five Know-Hows Learned by the
FESCARO Red Team” that facilitated this success.
1) Exploration in preparation for attack
Security testing
commences by pinpointing attack surfaces visible from the car's exterior and discerning
attack vectors. Typically, attack classification frameworks encompass the Cyber
Kill-Chain and the MITER ATT&CK Matrix, emphasizing the attacker's actions,
as well as Threat Hunting, which categorizes attacks from the defender's
perspective. The initial phases of security testing correspond to
Reconnaissance and Initial Access methods in the COMPROMISE category in the
MITER ATT&CK Matrix (Figure 8).
Figure 8. MITRE ATT&CK Matrix (Source=MITRE ATT&CK)
Figure 9 shows an
example of attack surfaces accessible from outside the car. “Attack surfaces”
refer to various contact points in a vehicle system or software where an
unauthorized user or attacker can exploit potential vulnerabilities to gain
unauthorized access or control of the system. These contact points are
categorized into Network, Adjacent, Local, and Physical based on their points
of access. For instance, cellular networks for OTA (Over The Air)
updates, Wi-Fi for Car-to-Home or Home-to-Car
interactions, and GPS are categorized under “Network,”
LF/RF for keyless entry and Bluetooth for media connections, and NFC for
payment are classified as “Adjacent.” Meanwhile, the CAN and Automotive
Ethernet, which facilitate internal connections between car electronic ECUs,
are placed under “Local.”
Figure 9. Example of Attack Surfaces, (Source=FESCARO)
Once the attack
surfaces are identified, the next step is to pinpoint the attack vectors. An
'attack vector' refers to the means or method by which an attacker attacks a
target vehicle. Figure 10 summarizes attack vectors by attack surface.
While attackers
perceive these as their means and methods of assault, defenders view them as
security threats. ISO/SAE 21434 recommends using STRIDE explained above, for
threat modeling.
Figure 10. Major Attack Vectors (Source=FESCARO)
Figure 11. STRIDE-Based
Identification of Security Threats (Source=Institute of Energy Efficient
Mobility)
2) ‘Continuous
management,’ the valid standard of security testing
Before delving into
the detailed design of test cases for launching an attack, it is necessary to derive cybersecurity test
items that serve as a higher standard. Over the years, FESCARO's Red Team has
set robust benchmarks for cybersecurity testing by conducting tests under a
variety of conditions. By consistently crafting and executing hundreds of test
cases, we've continually enhanced and fortified these benchmarks while refining
our test cases. This has endowed us with a stereoscopic and dense cybersecurity
testing framework. In scenarios where explicit guidelines are lacking, the effective
benchmarks we've established to date offer a significant competitive edge.
Cybersecurity is
closely related with instability, making it challenging to lay down clear and
specific guidelines. As a result, it's vital to maintain a continuous cycle of
learning and deriving insights through research and development such as data collection,
and analysis, and subsequently incorporating those insights into the workflow for
enhancement. In other words, it's crucial to apply the CD (Continuous
Development) cycle, often referred to as CI (Continuous Integration), CT
(Continuous Testing), and CX (Continuous Exploration), to security testing.
3) Integrated environment testing (different results with the same test
case)
What we believe is
most important in security testing to obtain UN R155 certification is
“conducting verification within an integrated environment, including the actual
vehicle-based driving environment.” I stress the importance of this, having
personally witnessed its impact on outcomes. Even if the same test case is
used, different results appear depending on the test environment, such as individual
ECUs and actual vehicle-based stationary and driving environment. While each
test environment holds its own value, a synergy emerges when testing is
performed in an integrated environment, expanding the scope and depth of the
verification process. Let's delve into two illustrative examples to see how
cybersecurity test results affect in driving environments such as driving,
steering, and braking.
First, Figure 12
shows the results of an actual vehicle-based driving test in a graph. The solid
green line represents the engine speed (RPM) measured without any attack, while
the orange dashed line indicates the engine speed recorded during an attack.
For testing, fuzz data was input to Powertrain CAN while the vehicle was in
motion. As a result, an abnormal shift timing led to a deviation from the
standard engine speed. Yet, when the fuzz data was input in a stationary
setting after the IGN was turned ‘ON’, there were no disruptions in CAN
communication or any other effects. Despite all other test conditions remaining
consistent, the outcomes varied with the driving environment.
Figure 12. Driving Test Results (Source=FESCARO)
Recently, in
preparation for a global automaker's demonstration of VTA evaluation for
electric vehicles slated for mass production, FESCARO conducted mock
evaluations under various conditions to identify and address security
vulnerabilities. However, during testing in a driving environment, an issue
arose: when an abnormal message was input to the E-PT (electric vehicle
powertrain), driving halted and the accelerator pedal became unresponsive.
Under the same conditions but in a stationary environment, the only observed
effect was a minor communication delay. This information was immediately
relayed to the ECU developer company and after thorough technical discussions
with the relevant stakeholders, it was agreed that mass production would
commence after applying a software patch. By conducting a comprehensive test in
an integrated environment and ensured the effectiveness of security measures
before the final evaluation, we proactively identified and rectified potential
vulnerabilities, and ultimately successfully completed the VTA certification
demonstration.
4) Design and implementation of customized test cases
After establishing
the criteria such as direction for security testing and cybersecurity test items, it's time to draft a test case for the attack.
Over the past few
years, FESCARO has designed and implemented more than a hundred custom test
cases. The test case template example shown in Figure 13 encompasses factors
commonly acknowledged in the industry, along with the "essential elements"
I've identified based on our success stories. With a well-tailored test case
that considers the unique features of both the automakers and vehicle
models, we anticipate positive feedback when undergoing CSMS and VTA
certification processes. For reference, details of the test case design may be
reflected in the validation report when the test is completed.
Figure 13. Example of Testcase
Template (Source=FESCARO)
5) Internal Penetration (INFILTRSTION) and complete control
By performing non-functional
penetration tests based on various attack vectors targeting the attack
surfaces, white hat hackers can successfully gain access and execute both local and
remote code. This phase corresponds to the Execution and Persistence steps in
the COMPROMISE category of the MITER ATT&CK Matrix (Figure 8).
The ultimate
objective is lateral movement for infiltration and dissemination. Once internal
control is secured, the desired outcome is realized through data gathering, command and control mechanisms. During this phase, techniques like Privilege
Escalation, Defense Evasion, Credential Access, and Discovery from the
INFILTRATION category of the MITER ATT&CK Matrix are employed.
Outlook of virtualization technology for security testing
Cybersecurity
testing in a real vehicle driving environment also has drawbacks. Given
considerations such as weather conditions, safety, testing duration, and costs,
integrating virtualization technology into cybersecurity testing can be a
viable approach.
Virtual simulation
systems called HIL17) and SIL18) are already being used for software development and testing of vehicle
electronic ECUs. With recent advancements in digital twin and virtualization
technologies, the introduction of the Vehicle-in-the-Loop (VIL) simulation
concept, which allows for the virtual simulation of vehicles, is gaining traction. It is able to create an integrated vehicle simulation system by virtualizing the
vehicle's sensor and actuator system, vehicle dynamics system
(driving-steering-braking), and even the driving environment.19)
To add cybersecurity
testing here, it’s essential to further develop security testing tool linkage
interfaces and test case integration etc. Depending on the stakeholders,
consideration of cost, usability, and versatility will clearly be necessary.
Nevertheless, cybersecurity testing in a VIL environment emerges as a
compelling alternative that could partially supplant some aspects of vehicle
testing in an actual driving environment.
Test automation to improve efficiency
Test automation is
also receiving as much attention as virtualization technology.
Even if minor
functions are changed in the vehicle, it is essential to re-verify the
cybersecurity effectiveness through security testing to ensure there are no
side effects or newly discovered vulnerabilities. Since no one knows what kind
of butterfly effect it could have. Given that automated testing is more
efficient than manual checks by engineers or white hat hackers for every minor
alteration, this technology is undoubtedly valuable for companies aiming to
optimize the use of their skilled workforce.
Block Harbor in the
United States is often referenced as a good example of cybersecurity test
automation. They provide cybersecurity design and operation services such as
TARA and Vehicle Security Operation Centers(VSOC), as well as the 'UNR155
Mitigation Test Suite System' tailored for UN R155-related testing of vehicles
and individual ECUs.20) Additionally, they are collaborating with the American Center for Mobility
(ACM) to develop cybersecurity solutions for future vehicles.21)
Block Harbor
collaborates with FESCARO, the cybersecurity company I work for in Korea.
Together, we are engaged in multiple national cybersecurity projects promoted
by the Korea Transportation Safety Authority under the Ministry of
Land, Infrastructure and Transport. As we approach the enforcement of the
Automobile Management Act in July 2024, projects like 'Establishment of
Cybersecurity Support and Response System' and 'Test Automation for
Cybersecurity Verification and Evaluation' are underway concurrently, all
intricately connected to optimize operational synergy.
Conclusion
As the shift towards
Software Defined Vehicle (SDV) gains momentum, issues of recalls stemming from
software defects often make the news. In San Francisco, having recently earned
the title of the ‘world’s first 24-hour robotaxi city’, is witnessing various challenges.
According to
automotive cybersecurity trends reported by UPSTREAM, an international security
specialist, the incidence of automotive breaches has surged over the past three
years. Additionally, new vulnerabilities are emerging at a rate two to three
times higher annually.22)23) Cybersecurity is a vital field. To address the escalating and increasingly
sophisticated hacking threats, white hat hackers persistently and, at times,
sporadically evaluate the robustness of cybersecurity measures, continually
refining and bolstering existing countermeasures.
Charlie Miller, the legendary hacker famous for hacking into a Jeep Cherokee, said eight years ago that computer hacking became boring and that hackers would turn their focus to devices such as cars, trains, power plants, and traffic signals. 24)
We live in the
Internet of Things (IoT) era where all devices are connected to the Internet,
and the era of Vehicle-to-everything (V2X) communication is on the horizon.
Cybersecurity testing holds immense value and impact, serving as a bare minimum
to prevent the “zombie car action sequence” from becoming a reality.
Global automakers tend to internalize technologies, including cybersecurity, but
continue to partner with specialized companies for cybersecurity testing. I
hope that automotive technology will continue to advance within a stable
environment, based on reliable cybersecurity testing.
References
1) “Cars in movies turned into 'zombies'
by hacking. Is this possible?”,< OhmyNews>, 28.11.2017
2) ““Automotive information technology
security, if breached, it’s over”... Jeep Cherokee ‘recalled’ due to hacked
driving, <Sports Kyunghyang>, 26.07.2015
3) “19-year-old claims he hacked into
over 25 Teslas in 13 countries”, 12.01.2022
4) Take the lead in the future mobility
competition based on ‘electrification and autonomous driving, <New Daily
Economy>, 22.06.2023
5) Digital Twin: A technology to create
objects (twins) identical to the real things in virtual space and verify them
through various simulations
6) [Analysis] “Tesla had 424
self-driving accidents last year alone”...K-City drawing attention to virtual
space integration’, <Daily Korea>, 12.06.2023
7) Vehicle-to-everything (V2X)
communication : The act or technology of a vehicle exchanging information by
communicating with various objects such as other vehicles, pedestrians, and
infrastructure
8) Automotive cybersecurity is becoming
important with the increase in advanced vehicles, Press release from the
National Assembly Research Service, 28.12.2022
9) UN Regulation No. 155
(E/ECE/TRANS/505/Rev.3/Add.154), UNECE, 04.03.2021
10) Automotive cybersecurity is becoming
important with the increase in advanced vehicles, Press release from the
National Assembly Research Service, 28.12.2022
11) UN Regulation No. 155
(E/ECE/TRANS/505/Rev.3/Add.154), UNECE, 04.03.2021
12) Automotive cybersecurity guidelines,
Korea Transportation Safety Authority & KATRI, 12.2020
13) Automotive cybersecurity is becoming
important with the increase in advanced vehicles, Press release from the
National Assembly Research Service, 28.12.2022
14) Hankyung Economic Terms Dictionary:
ISO/SAE 214347, Naver Knowledge Encyclopedia, 02.2023
15) ISO, 2021.08, ISO/SAE 21434:2021
Road vehicles - Cybersecurity engineering
16) Grand slam in cybersecurity
certification: Originally, it refers to sweeping all major competitions in
sports, but here, it refers to having success stories for all four
cybersecurity certifications (CSMS, ISO/SAE 21434, SUMS, VTA).
17) Hardware in the Loop: Software is
included in the ECU, but the environment surrounding the ECU is virtualized (in
a simulation environment).
18) Software in the Loop: Testing
software in a simulation environment without real hardware
19) Virtual verification technology for
vehicle SW quality innovation [Video], Hyundai Motor Group Developer
Conference, 2022
20) Breakwater, UNR 155 Mitigation Test
Suite for Common Interfaces in Vehicle Systems, Blockharbor, 09.2022
21) American Center for Mobility and
Block Harbor Collaborate to Develop Cybersecurity Offerings at ACM's Global
Development Center, 01.08.2023
22) Upstream's 2023 Automotive Cyber
Trend Report, Upstream, 2023
23) AutoThreat® Intelligence Cyber
Incident Repository, Upstream, 08.2023
24) [Special interview for the inaugural
special issue] Charlie Miller, a car hacker, “We must recognize the risks and deal
with them”, <Electronic Newspaper>, 21.09.2015
Source: AEM
(https://www.autoelectronics.co.kr)
24.03.19
![[Contribution] Key management systems: The next frontier in automotive cybersecurity](/data/bbsData/17441003489.png)
![[CTO Interview] Fescaro CTO stresses comprehensive approach to vehicle cybersecurity](/data/bbsData/17440981759.png)
![[CEO Interview] Ensuring the Competitiveness of Future Mobility Through Continuous SW-Based Service](/data/bbsData/17287296039.png)
![[Insight Column] Software-Defined Operation Management Leveraging the True Value of SDVs](/data/bbsData/17287247959.png)
![[Insight Column] In the SDV era, Should Tiers Adopt AUTOSAR?](/data/bbsData/17213855879.png)
![[CTO Interview] FESCARO, A Grand Slam Winner for Vehicle Security in the SDV Era](/data/bbsData/17186144179.png)
![[Insight Column] Key Focus to the Upcoming Motor Vehicle Management Act Amendment for OEMs](/data/bbsData/17183493819.png)
![[Insight Column] Three Hurdles Tiers Face in the Era of SDV](/data/bbsData/17156743539.png)
![[Insight column] Kwon Dong-hoon, 'Cybersecurity Testing Methodology to increase reliability'](/data/bbsData/17108400779.png)
