Cybersecurity Best Practices for Aftermarket Electronics and Telematics in Heavy Vehicles
Goal:
To develop a set of best practices and guidelines focused on minimizing cyber risks for aftermarket electronic systems intended for use in the commercial motor vehicle (CMV) industry.
Background:
Heavy vehicle fleet operators routinely integrate a variety of aftermarket electronic systems into the trucks and buses they operate. Such systems include telematics units, navigation, infotainment, vehicle diagnostics, cargo monitoring and vehicle anti-theft systems, as well as a variety of driver monitoring, crash avoidance and other systems that may aid in compliance or operation of the vehicle. Often, these devices and systems are integrated into the vehicle’s electrical architecture including potential linkages with the vehicle’s CAN databus, driver display systems, or other electronic sub-systems on the vehicle. Further, the aftermarket/telematic devices themselves will often incorporate a wireless or wired connection, (or perhaps a manual input interface) that allows for connecting the device to its intended interface entity. Such interfaces, with their integration into the vehicle’s electronic systems, offer a potential cyber vulnerability or a “point of entry” that may allow “bad actors” to gain access first to the aftermarket system, and then subsequently to the vehicle’s control sub-systems, including driver interface, braking, throttle and or steering systems. Such connections may possibly be “hacked” to allow malicious attacks such as retrieving propriety data stored on the vehicle, or creating congestion on the vehicle networks such that normal and safe operation of the vehicle is compromised. As telematic and related aftermarket electronic devices and systems continue to proliferate the heavy vehicle marketplace, such cyber threats are of a growing concern to the Federal Motor Carrier Safety Administration (FMCSA), the National Highway Traffic Safety Administration (NHTSA) and the heavy vehicle industry.
Summary:
For this joint project with NHTSA, the contractor will build on existing heavy vehicle cybersecurity research to more narrowly focus on cyber threats and vulnerabilities associated with the integration and use of a variety of aftermarket and telematic systems intended for heavy vehicle application. The output of this research will be a set of best practices and guidelines for both the design and integration of aftermarket electronic systems focused on minimizing cyber risks. To this extent, the output of this work may be used by both the suppliers of such systems as well as by end users.