What Are the UK's Automotive Cybersecurity Guidelines?

Automobiles carry more software and code than ever before. And automotive cybersecurity is a growing concern.

Why Automotive Cybersecurity Is Important

Today, cars have plenty of driver assistance features. These can deliver warnings to drivers. But they can also take control of vehicles.

So, the threat of a cyberattack is a real danger. A hacker could cause a car to crash on a public road. As the automotive industry continues its journey towards autonomy and self-driving cars, this threat will only increase. That's why cybersecurity guidelines are critical to vehicle safety. 

Learn more about automotive embedded software with these additional resources >>

Automotive Cybersecurity Guidelines in the UK

Awareness of the dangers of cybersecurity are on the rise. And it's nice to see that governments are also becoming aware and reacting.

We were particularly interested in the guidelines put out by the UK government in August 2017.

There are eight principles in “The key principles of vehicle cybersecurity for connected and automated vehicles”. These apply throughout the manufacturing supply chain, from designers and engineers, all the way up to senior-level executives.

Principle 1

Principle 1 states:

Organizational security is owned, governed, and promoted at board level

So, personal accountability for product and system security should be at board level. Obviously, this should be delegated appropriately.

Companies will also need to raise awareness and implement training to promote a culture of security. That will help engineers embrace the idea of security by design.

Principle 2

Principle 2 states:

Security risks are assessed and managed appropriately and proportionately, including those specific to the supply chain

It's important to take steps to stay up-to-date with current threats and implement appropriate risk assessment procedures, including in the supply chain.

Principle 3

Principle 3 states:

Organizations need product aftercare and incident response to ensure systems are secure over their lifetime

The problem doesn't end when the hardware or software leaves the company. Aftercare needs to be in place over the product’s lifetime. This includes after-sales support services and incident response plans.

Principle 4

Principle 4 states:

All organizations, including sub-contractors, suppliers, and potential third parties, work together to enhance the security of the system

Everyone should work together to ensure systems safely and securely interact with external devices. Suppliers should be able to provide assurance, such as independent certification.

Principle 5

Principle 5 states:

Systems are designed using a defense-in-depth approach

It's important to have security in-depth, with no single point of failure. This involves reducing the attack surface where possible.

Principle 6

Principle 6 states:

The security of all software is managed throughout its lifetime

Adopting secure coding practices is really important. These should be able to manage risk from known and unknown vulnerabilities in software, including existing code libraries. Procedures to manage, audit, and test code should be in place.

Secure coding practices can be extremely effective for reducing the risks from security vulnerabilities. Especially when paired with static code analysis tools. 

Principle 7

Principle 7 states:

The storage and transmission of data is secure and can be controlled

It's important to make sure the storage and transmission of data are secure. Your system should be able to respond to an attack and react appropriately if its defenses or sensors fail. This includes failing safe if safety-critical functions are compromised.

Principle 8

Principle 8 states:

The system is designed to be resilient to attacks and respond appropriately when its defenses or sensors fail

It's important that your system can respond to an attack and react appropriately if its defenses or sensors fail. This includes failing safe if safety-critical functions are compromised.

Next Steps for Automotive Cybersecurity

Automotive cybersecurity guidelines are a necessary step to vehicle safety. As the industry shifts further into autonomous vehicles and self-driving cars, guidelines will be critical.

Using an automotive coding standard is a smart next step to ensure security in the development of embedded systems.

There are two C and C++ coding standards widely used by automotive developers.

MISRA  AUTOSAR