Category: Nicht kategorisiert

Automotive Security: Connected vehicles require new security concepts!

The number of fully networked cars is growing. Every new car already has potential Internet access. On the one hand, this opens up extensive possibilities, but on the other hand, the attack surface for cyberattacks is also growing. Accordingly, the focus is shifting to the relatively new field of “automotive security”, in which only a few service providers have specialized to date.

Cyberattacks in the automotive environment are becoming more likely

Today’s drivers have high expectations when it comes to intelligent functions and communication. But the safety of these features is also a decision criterion when buying a vehicle. Functional safety is less of a challenge here. It has been enshrined in law since 2011 in the form of ISO 26262. More problematic for the automotive industry is the area of cybersecurity, which is becoming a success factor to be taken seriously. The reason: networked and autonomous vehicles have numerous entry points for cyberattacks. These include interfaces to the outside world, diagnostic interfaces and control units, as well as the growing amount of stored, customizable data. Criminals could use these points of attack to manipulate cars or gain access to user data, among other things. Automotive Security aims to minimize risks of this kind.

What exactly is Automotive Security?

First, a distinction must be made between the terms “safety” and “security” in the automotive environment. Safety refers to functions that are intended to protect our lives when using vehicles. Security, on the other hand, is generally concerned with the protection of business-critical and personal information as well as the prevention of unwanted manipulation from outside. Automotive Security can be described as Functional Security considering Cybersecurity.

For automotive companies, the challenge currently lies in particular in the integration of established information technologies while maintaining automotive-specific quality and security standards. At the same time, costs must be kept low and innovations must be realized in ever shorter periods of time. Finally, external cooperations are often necessary to tap the required know-how. But especially when working with third parties, a high level of automotive security should be ensured. In combination, these factors represent an enormous challenge, which is why consulting by experts such as RMTP is recommended.

Specialized consulting services for automotive security

RMTP’s range of services in the automotive security sector is unique in its form. It includes consulting on secure engineering, taking safety into account. Among other things, the experts implement a methodical secure engineering approach using established processes for safety management and Automotive SPICE. The consulting also covers the handling of security and safety in the entire product life cycle. The practical application of ISO 26262, SOTIF (ISO/PAS 21448), SAE J3061 and ISO/SAE 21434, which is currently being developed, as well as the operationalization of Common Criteria specifications round off the portfolio.

RMTP’s many years of experience in the application of engineering processes and numerous projects in the automotive environment – both nationally and internationally – speak for themselves. Another clear advantage is RMTP’s ability to transfer norms, standards, and frameworks into practical use. This applies to SMEs as well as to corporate groups.

 

ON THE TOPIC:

https://www.sp.se/en/index/research/dependable_systems/heavens/sidor/default.aspx

https://www.automotiveisac.com

Information security is a key issue in business. Data and knowledge are key competitive factors that must be protected comprehensively and sustainably.

Qualified consulting for effective hedging measures

It has always been important in politics and business to protect important and critical information from the eyes, ears and fingers of unauthorized third parties. More than ever before, corporate data, whether customer data, production and research data, or the entire body of knowledge, has become a central corporate resource and thus represents a considerable value. Its protection must be ensured on an ongoing basis to avoid suffering not only economic damage but also a loss of image as a result of an unauthorized data leak, for example. Ensuring a high and verifiable level of information security can also become a decisive competitive factor.

Information security is based primarily on qualified risk management

Information and its processing have become an essential part of the value chain. Whether optimizing business processes, dealing with Big Data, IoT or outsourcing more or less business-critical data and IT infrastructures to the cloud – the immense data streams also arouse desires that companies must actively counteract. The threat scenarios have become many times more complex and diverse, and increasingly difficult to navigate. Digital assets and their management require in-depth safeguards at all levels. This is not just about defining and implementing technical measures; at least as important is the ongoing sensitization and recurring training of employees on secure working and relevant threat scenarios.

Demonstrating the ability to guarantee resilient information security is also increasingly a decisive component, for example, in order to qualify as a supplier or other business partner. The ability to counter-attacks or, in the event of an emergency, even damage, with established risk management conveys the robustness of one’s own systems and the ability to act with foresight. A VDA audit or ISO 27001 certification not only protects the company and its assets, it can also serve as a competitive factor and as a key to opening up new business areas.

Information security is much more than compliance with the GDPR

The establishment of an independent security architecture requires individual developments that also incorporate the provisions of the GDPR. Realization, introduction, and operation of an ISMS touch all company areas and should be part of the future strategic company development. RMTP IT-Beratung und Service GmbH stands for qualified consulting on essential topics of information technology and information security – from short-term individual measures to balanced multi-projects, from medium-sized companies to large corporations.

Information security by RMTP IT-Beratung und Service GmbH – support and assistance is available in all relevant processes and issues of the company, as well as in the preparation for audits and assessments. In addition, RMTP offers consulting on IT strategy/IT governance, IT service management, risk management, information security, cybersecurity, functional security, automotive security and AUTOMOTIVE SPICE.

 

TO THE TOPIC:

– Portal of the German IT Security Association (Bundesverband IT-Sicherheit e. V.)

– ISACA CyberSecurity Information

 

Not only talk about how a company obtains a certification, but go through the process itself.

This year, too, we have had our quality management system certified according to ISO 9001 and our information security management system according to ISO 27001 again.