The United Kingdom has published a set of Key principles of vehicle cyber security for connected and automated vehicles outlining how auto-makers need to behave if they want computerised cars to hit Blighty's byways and highways. <\/p>\n
Penned by the UK's Department for Transport, with help from the Centre for the Protection of National Infrastructure, and launched by transport minister Lord Callanan, the principles suggest all participants in the auto industry's long supply chains must work together on security both in the design process and for years after vehicles hit the roads. <\/p>\n
The eight principles follow: <\/p>\n
Each principle has sub-principles and that's where the detail gets interesting. Principle 1.2, for example, suggests Personal accountability is held at the board level for product and system security (physical, personnel and cyber) and delegated appropriately and clearly throughout the organisation. <\/p>\n
Principle 2.4 expects Security risks specific to, and\/or encompassing, supply chains, sub-contractors and service providers are identified and managed through design, specification and procurement practices. <\/p>\n
Principle 3.4 may raise eyebrows as it suggests Organisations ensure their systems are able to support data forensics and the recovery of forensically robust, uniquely identifiable data. This may be used to identify the cause of any cyber, or other, incident. The combination of uniquely identifiable and other incident isn't spelled out, but suggests all manner of avenues to investigate driver behaviour, although those efforts could founder on Principle 7.3's insistence that Users are able to delete sensitive data held on systems and connected systems. <\/p>\n
There's some sound OpSec suggestions under Principle 5, with 5.3 calling for Design controls to mediate transactions across trust boundaries, must be in place throughout the system. These include the least access principle, one-way data controls, full disk encryption and minimising shared data storage. Principle 5.4 suggests Remote and back-end systems, including cloud based servers, which might provide access to a system have appropriate levels of protection and monitoring in place to prevent unauthorised access. <\/p>\n
Principle 8.1 sets out how a car should respond to malicious hacking attempts, by stating The system must be able to withstand receiving corrupt, invalid or malicious data or commands via its external and internal interfaces while remaining available for primary use. This includes sensor jamming or spoofing. <\/p>\n
To The Register's mind, the Principles are largely sound and could handily be applied to other Internet of Things devices. <\/p>\n
Lord Callanan's announcement suggests the Principles will be included in future legislation governing self-driving cars on British tarmac. <\/p>\n
Sponsored: The Joy and Pain of Buying IT - Have Your Say <\/p>\n
<\/p>\n
More here: <\/p>\n
UK publishes Laws of Robotics for self-driving cars - The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" The United Kingdom has published a set of Key principles of vehicle cyber security for connected and automated vehicles outlining how auto-makers need to behave if they want computerised cars to hit Blighty's byways and highways. Penned by the UK's Department for Transport, with help from the Centre for the Protection of National Infrastructure, and launched by transport minister Lord Callanan, the principles suggest all participants in the auto industry's long supply chains must work together on security both in the design process and for years after vehicles hit the roads. The eight principles follow: Each principle has sub-principles and that's where the detail gets interesting. Continue reading