Goal is to provide car manufactures with guidelines for protecting modern vehicles against emerging cyber threats
The Automotive Information Sharing and Analysis Center (Auto-ISAC) has released a set of cybersecurity best practices for connected vehicles. The document, developed over the course of five months by a group of more than 50 cybersecurity experts from the auto industry, is designed to demonstrate the collective commitment by automakers to make modern cars safer against emerging cyber threats. The best practices cover seven broad areas, including governance and accountability, risk assessment and management, secure design practices, threat detection and mitigation, and incident response. In each case the guidance has been adapted for the car industry from established cybersecurity standards like NIST’s cybersecurity framework and ISO.
For example, the best practices pertaining to governance and accountability are based on ISO/IEC 27001 guidelines and cover topics like how to ensure proper executive oversight of vehicle security and how to ensure that adequate resources are allocated to cybersecurity.
Similarly, the risk assessment and management guidelines are based on the National Institute of Standards and Technologies’ 800-30 guide for risk assessments. Best practices covered under this section include establishing standard processes for identifying and prioritizing cyber risk, establishing a process for managing identified risks and monitoring and evaluating changes in risks as part of a continuous risk assessment process. Each of the best practices under the remaining categories is similarly based on existing cybersecurity guidelines such as NIST SP 800-61, NIST SP 800–150, and ISO/IEC 27010.
“Automakers are committed to being proactive and will not wait for cyber threats to materialize into safety risks,” said Toyota executive and Auto-ISAC chairman Tom Stricker in a statement. “The Best Practices initiative represents this commitment to proactive collaboration that our industry made when we stood up the Auto-ISAC last year.”
[su_box title=”About ” style=”noise” box_color=”#336588″][short_info id=’83800′ desc=”true” all=”false”][/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.