NHTSA Issues Cybersecurity Best Practices For Automakers

The National Highway Traffic Safety Administration (NHTSA) has issued a set of cybersecurity best practices for connected cars.

Vehicle cybersecurity has captured the attention of safety experts in the wake of security researchers demonstrating how attackers can take advantage of vulnerable electronic components in modern connected cars to gain independent control of critical vehicle functions.

The most dramatic examples have been from security researchers Charlie Miller and Chris Valasek of Uber’s Advanced Technology Center, who as recently as this August demonstrated an attack in which they took over a 2014 Jeep Cherokee’s steering, accelerator, and braking system while the vehicle was moving.

Like the NHTSA's earlier research on the topic, the new recommendations contained in the 22-page report released this week are non-binding and meant to serve purely as guidance for automakers. 

But since the NHTSA’s recommendations are non-binding, it’s unclear how many automakers will implement them.

Many of the recommendations cover the things that automakers need to be focusing on during the manufacturing process like secure development practices, information sharing, vulnerability disclosure, and reporting, incident response, and self-auditing.

But a big section is focused on some of the fundamental cybersecurity precautions that automakers need to deploy in the vehicles themselves. The emphasis here is on restricting access to critical components in connected vehicles and on limiting what someone with access could do with it.

For example, the NHTSA wants manufacturers to consider limiting or even eliminating the access that developers have to the Electronic Control Units (ECUs) in their vehicles. Often such access is facilitated via a debugging port or serial console, the NHTSA said.  

"Any developer-level debugging interfaces should be appropriately protected to limit access to authorized privileged users," the NHTSA said. Merely hiding connectors, traces, or pins that enable debugging access does not provide security, the report noted.

Similarly, the NHTSA wants automakers to implement controls that limit the ability for anyone to modify firmware in a vehicle’s electronic components. For example, by using digital-signing technologies, manufacturers can make it much harder for attackers to make an unauthorized modification or to install rogue software.

Physical and logical segmentation and isolation of critical electronic components should be implemented to limit the damage from external threats, the NHTSA said.

Some of the proof-of-concept attacks against connected vehicles have involved researchers first exploiting a weakness in one component—like a vehicle’s entertainment system—and then using that entry point to try and access other components.

By separating processors, vehicle networks and external connections to the extent possible manufacturers can limit and control the pathways that an attacker might use to escalate privileges, the NHTSA said in its recommendations.

"Strong boundary controls, such as strict white list-based filtering of message flows between different segments, should be used to secure interfaces," it noted.

The NHTSA also wants automakers to consider include limiting access to vehicle maintenance diagnostics; controlling access to firmware via encryption, for example; and limiting the number of network ports, protocols, and services in vehicles.

Major automakers, cognizant of the concerns over cybersecurity at the government and regulatory levels, and anxious to stave off regulation, have already taken steps to address securing cars at the industry level.

For example, the 12-member Alliance of Automobile Manufacturers, comprised of companies like Ford, General Motors, Chrysler, and Toyota, is currently working on an industry-wide effort to identify emerging threats to connected vehicles and measures for mitigating them.

Related stories: