Critical cyber security risks in the automotive industry

The study found that 84% of automotive professionals have concerns that their organisations' cyber security practises are not keeping pace with evolving technologies. The survey also found that 30% of organisations do not have an established cyber security program or team, and 63% test less than half of the automotive technology they develop for security vulnerabilities.

Jack Pokrzywa, SAE International director of Ground Vehicle Standards, stated: "SAE, in partnership with Synopsys, is pleased to present the findings of this study, as it provides real-world data to validate the concerns of cyber security professionals across the industry and highlights a path forward.

“SAE members have sought to address cyber security challenges in the automotive systems development lifecycle for the last decade and worked together to publish SAE J3061, the world's first automotive cyber security standard. Armed with the findings of the study, SAE stands ready to convene the industry and lead development of targeted security controls, technical training, standards, and best practises to improve the security, and thus the safety, of modern vehicles."

Synopsys and SAE commissioned the Ponemon Institute, an IT security research organisation, to examine current cyber security practises in the automotive industry and its capability to address software security risks inherent in connected, software-enabled vehicles. Ponemon surveyed 593 professionals from global automotive manufacturers, suppliers and service providers.

To ensure knowledgeable responses, all respondents are involved in assessing or contributing to the security of automotive technologies, including infotainment systems, telematics, steering systems, cameras, SoC-based components, driverless and autonomous vehicles, and RF technologies such as WiFi and Bluetooth, among others.

Andreas Kuehlmann, Co-General Manager of the Synopsys Software Integrity Group, added: "The proliferation of software, connectivity, and other emerging technologies in the automotive industry has introduced a critical vector of risk that didn't exist before: cyber security. This study underscores the need for a fundamental shift, one that addresses cyber security holistically across the systems development lifecycle and throughout the automotive supply chain. Fortunately, the technology and best practises required to address these challenges already exists, and Synopsys is poised to help the industry embrace them."

Other key findings from the survey highlight:

• Lack of cyber security skills and resources. More than half of respondents say their organisation doesn't allocate enough budget and human capital to cyber security, while 62% say they don't possess the necessary cyber security skills in product development.
• Proactive cyber security testing is not a priority. Less than half of organisations test their products for security vulnerabilities. Meanwhile, 71% believe that pressure to meet product deadlines is the primary factor leading to security vulnerabilities.
• Developers need cyber security training. Only 33% of respondents reported that their organisations educate developers on secure coding methods. Additionally, 60% say a lack of understanding or training on secure coding practises is a primary factor that leads to vulnerabilities.
• Cyber security risk throughout the supply chain. Seventy-three percent of respondents expressed concern about the cyber security of automotive technologies supplied by third parties. Meanwhile, only 44% say their organisation imposes cyber security requirements for products provided by upstream suppliers.