SD Elements | 
Research
Upcoming Events
Resources
While the attack was carried out merely to demonstrate the vulnerability, it cast a deep shadow across the entire automotive industry and raised serious questions about vehicle safety. As automobiles become more high tech, more connected, and more reliant on applications for their everyday functions, just how reliable and safe are they? What can automakers do to stem the growth of new application security risks in automobiles?
Auto danger
There’s little doubt that technology has made cars safer, more comfortable, and more efficient. The transition from mechanical buggy to sophisticated wheeled robot, however, was performed at almost breakneck speed as today’s motor vehicles, like the computers and mobile devices we use every day, are almost entirely reliant on software.
Consumer demand for safety and convenience has long pushed cars toward greater complexity and sophistication, but where before this meant seatbelts and airbags, now it means computerized and connected systems like navigation systems, entertainment centers, remote key fobs, and more. While the features on vehicles have kept pace with modern demands, many manufacturers have failed to scrutinize the security of these new systems and the software they use.
This lack of security has raised red flags by consumer groups and the government. In 2016, the FBI went so far as to issue a PSA, warning drivers that their cars can become the next target of a cybersecurity attack.
Safety first
The modern car revolves around its computer and these systems require an extensive number of complex applications. For example, IEEE noted that premium vehicles perform their technical ballet around a staggering 100 million lines of code (much more, incidentally, than an F-22 Raptor, which only uses a paltry 1.7 million lines).
While vehicle systems may undergo testing after development, they are rarely designed with security in mind from the start. This is a problem, since some software vulnerabilities may not even be identified in the post-development stage.
These vulnerabilities can be broad-ranging and expensive to address. For example, many drivers now connect their cell phones to the onboard computer, making them vulnerable to identity theft. Sudden blasts of the radio or entertainment system can startle and distract drivers, creating dangerous driving conditions. Or, as noted above with the Jeep, a vehicle can be locked and rendered inert in the middle of an extremely hazardous stretch of road — or worse.
Corporate blowback
While manufacturers are particularly concerned about driver safety and vehicle reliability, their business demands require them to produce cars at a quick rate, and this can mean overlooking application security. While this might serve immediate goals and drive profits in the short term, the long term consequences of producing vulnerable automobiles will be much more costly and damaging to both the companies and their customers.
The cost of a recall can be particularly damaging to a company’s bottom line. Consider Chrysler, which had recall costs of over $660 million. Now imagine how many exploitable vulnerabilities exist those 100 million lines of code and the consequent number of recalls necessary to correct a laundry list of issues with an entire fleet of vehicles.
This is a problem for corporate image, too, as well as the entire industry of highly technical and (eventually) self-driving cars. No automotive company needs an incident like the Target data breach in 2013, which resulted in the stolen identities of millions of shoppers who had to scramble to protect their savings and credit. These shoppers were among the legion of consumers who began to close their wallets to Target, which ended up costing the company more than $160 million in the year following the breach.
While automotive companies might think of themselves as immune to these kinds of headline-making breaches, their growing reliance on software means it’s just a matter of time before they start happening unless they start building secure software now.
Fixing it fast
There is, however, a solution to the complex application security problems facing vehicle manufacturers and designers. That solution begins with a “security first” mentality.
Security must be designed into automotive applications from day one, and this means enforcing software development processes that identify and fix vulnerabilities during coding rather than testing and repairing vulnerabilities later. The standard practice at most organizations—automotive or otherwise—is to rely on code scanners like Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST) tools, but these only catch 46% of application-level risks.
46% is not safe enough when there are people behind the wheel.
In order to minimize application security risks, automotive companies should take their cue from many large financial institutions and tech companies and use Application Security Requirements and Threat Management (ASRTM) platforms. ASRTM helps organizations manage the entire Software Development Life Cycle (SDLC) to ensure that developers build in security requirements from the start, without wasting valuable on fixing vulnerabilities or risking a recall later. ASRTM platforms also leave an auditable trail of security requirement enforcement so organizations can identify errors easily and rest assured they’re taking the right steps to prevent breaches.
Incorporating security into their software development processes to stop attacks and boost driver safety is a win-win situation for vehicle manufacturers and customers alike. Go here to learn more about the emerging field of ASRTM tools.