Cybersecurity breaches represent an inevitable risk associated with modern vehicles. With a growing number of incidents, stakeholders in the automotive sector need to construct cultures, frameworks and processes for identifying and addressing risks continually and proactively. Explore the fundamentals of a risk management framework is and why building trust in your brand helps you achieve your goals in the automotive sector.
The 2021 Global Automotive Consumer Study from Deloitte revealed that the majority of more than 24,000 consumers surveyed are concerned about someone hacking into their connected cars and risking their personal safety. With 66% of consumers in India, 64% in the United States and 58% of respondents in China indicating in the survey that they had concerns, it is clear that automotive cybersecurity is top of mind for many.i
Yet connectivity acts as an integral part of modern vehicles, bringing unparalleled convenience, comfort and safety features. Unfortunately, this level of connectivity introduces cybersecurity risks, which can result in consequences ranging from inconvenience to monetary loss, harm to human health and life, and certainly erosion of brand trust. With the speed of innovation, regulatory bodies are challenged to keep pace with the volume of possible cybersecurity breaches that may originate from one of hundreds of electronic control units embedded in modern vehicles today. Yet automobile manufacturers must deliver safe products and maintain the trust of consumers in a highly competitive industry. According to the 2018 Nielsen Auto Marketing Report, 75% of all car buyers reported that they intend to purchase their preferred brand, highlighting the importance of brand trust.
Given the rapidly growing complexity of connected vehicles, it is simply impossible to eliminate cybersecurity risks. As a result, emerging regulations — like the R155 regulations established by the World Forum for Harmonization of Vehicle Regulations (WP .29) and ISO/SAE 21434 — prescribe the development of a risk management framework designed to assess risk early in the development phases, address cybersecurity challenges as they present themselves and track progress over time.
ISO/SAE 21434 requires the implementation of a cybersecurity risk management framework designed to evaluate risks through the individual components that make up the vehicle and assess risk throughout the design, development, production, operation, maintenance and decommissioning of the vehicle. This approach does not specify technical criteria for individual components or outline specific cybersecurity countermeasures. Rather, it provides a unified nomenclature and a framework for identifying and managing cybersecurity risks in road vehicle design, construction and operation. By constructing a threat assessment and risk assessment framework, manufacturers of automotive vehicles and components have the flexibility to respond to cybersecurity threats and advance countermeasures as issues present themselves. Consider some of the benefits of a risk assessment framework.
- This flexible approach allows for the growth and expansion of specific cybersecurity measures based on risks or incidents that present themselves.
- These practices naturally focus attention and resources where solutions are most urgently required, which represents a critical need in a world of limited time or experience.
- By assessing risk throughout the complete product life cycle, manufacturers can identify problems early in the design phase, prior to realizing issues in the final product.
- The requirement for tracking metrics of actual breaches provides a benchmark against which to measure ongoing trends and progress.
- This framework requires the constant attention of the organization rather than simply receiving focus for a once-a-year audit. This helps develop a culture of cybersecurity.
For all stakeholders in the value chain, cybersecurity risk management proves critical to successfully delivering quality automotive components and connected vehicles in both commercial and passenger segments. In today’s world, security is intrinsic to quality. Cybersecurity risk
management frameworks empower manufacturers to demonstrate that they prioritize cybersecurity and have mitigation measures in place in case of incidents or breaches. This type of proactive approach builds trust among buyers, which is fundamental to building valued brands.
With over 500 security experts worldwide, UL services customers globally with industry-leading, working knowledge of automotive regulations and compliance. Our comprehensive cybersecurity solutions for the automotive industry include training, verification and validation, gap analysis and advisory services to build road maps and regulatory compliance. Secure your brand’s reputation for innovation, safety and cybersecurity with UL’s help. Learn more about UL’s automotive cybersecurity capabilities at UL.com/automotive-cybersecurity.