Application Security

6/12/2018
02:30 PM
Rohit Sethi
Rohit Sethi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

'Shift Left' & the Connected Car

How improving application security in the automotive industry can shorten product development time, reduce costs, and save lives.

The public's sense of security was shattered when, in 2015, white hat hackers remotely attacked a Jeep vehicle through its computer system. The infiltration seemed harmless at first —  loud music blared and windshield fluid erupted uncontrollably. What first seemed nothing more than annoying turned more ominous as the engine was forcibly turned off on the highway with traffic coursing by at 70 mph.

While the attack was carried out merely to demonstrate the vulnerability, it cast a deep shadow across the entire automotive industry and raised serious questions about vehicle safety. As automobiles become more high-tech, more connected, and more reliant on applications for their everyday functions, how reliable and safe are they? What can automakers do to stem the growth of new application security risks in automobiles?

Technological Advancements Improve Safety and Present New Dangers
There's little doubt that technology has made cars safer, more comfortable, and more efficient. Today's motor vehicles, like the computers and mobile devices we use every day, are almost entirely reliant on software.

Consumer demand for safety and convenience has long pushed cars toward greater complexity and sophistication. In the past, this meant seatbelts and airbags; now, it means computerized and connected systems including navigation systems, entertainment centers, remote key fobs, and more. While the features on vehicles have kept pace with modern demands, many manufacturers haven't scrutinized the security of these new systems and the software they use.

This lack of security has raised red flags by consumer groups and the government. In 2016, the FBI went so far as to issue a PSA warning drivers that their cars can become the next target of a cybersecurity attack.

Safety First Means Security from the Start
The computer is the epicenter of the modern car responsible for function, comfort and entertainment. These systems require an extensive number of complex applications. For example, IEEE noted that premium vehicles perform their technical ballet around a staggering 100 million lines of code.

While vehicle systems may undergo testing after development, they are rarely designed with security in mind from the start. This is a problem, because some software vulnerabilities may not even be identified in the post-development stage. These vulnerabilities can be broad-ranging and expensive to address. (For example, many drivers connect their cellphones to the on-board computer, making them vulnerable to identity theft.)

Although manufacturers are concerned about driver safety and vehicle reliability, business demands require them to produce cars quickly, and this can mean overlooking application security. This might serve immediate goals and drive profits in the short term, but the long-term consequences of producing vulnerable automobiles will have damaging consequences to the car manufacturers, their supply chain partners, dealers, and customers.

The cost of a recall can be particularly damaging to a company's bottom line. Consider Chrysler, which had recall costs of over $660 million in 2016. Now, imagine how many exploitable vulnerabilities exist within those 100 million lines of code and the consequent number of recalls necessary to correct a laundry list of issues with an entire fleet of vehicles.

This is a problem for corporate image, too, as well as the entire industry of highly technical and (eventually) self-driving cars. No automotive company needs an incident like the Target data breach in 2013, which resulted in the stolen identities of millions of shoppers. These shoppers were among the legion of consumers who began to close their wallets to Target, which ended up costing the company more than $160 million in the year following the breach.

Although automotive companies might think of themselves as immune to headline-making breaches, their growing reliance on software exposes them to a multitude of threats. Unless they start building secure software now, it's just a matter of time before we see automakers fall victim to attacks resulting in data breaches or, even worse, safety issues.

Shifting Security Left
Addressing the complex application security problems facing vehicle manufacturers begins with a "security first" mentality. Software security must be designed into automotive applications from day one, and this means enforcing software development processes that identify and fix vulnerabilities during design and coding rather than testing and repairing vulnerabilities later. The standard practice at most organizations — automotive or otherwise—is to rely on code scanners like Static Analysis Security Testing and Dynamic Analysis Security Testing tools, but these only catch 46% of application-level risks. And 46% is not safe enough when there are people behind the wheel.

In the world of agile development, continuous delivery, and DevOps, the concept of "shift left" has emerged. "Shift left" is a mindset that considers security from the onset and is pervasive throughout the software development process. This is what it means to "build security in" from the start.

When software development teams start far left, organizations can embed the appropriate security considerations into the requirements phase. Starting with solid security requirements as early as possible allows organizations to make sound design decisions up front that will help eliminate technical debt and reduce the cost to maintain software.

To minimize application security risks, organizations should manage the entire software development life cycle to ensure that developers build in security requirements from the start, without wasting valuable time on vulnerability remediation or risking a recall later. Incorporating security into the software development processes to stop attacks and boost driver safety is a win-win situation for vehicle manufacturers and customers alike. It's time for the auto industry to change gears and shift left when it comes to software security.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

 

Rohit Sethi, COO of Security Compass, is responsible for setting and achieving corporate objectives, company alignment, and driving strategy to execution. He specializes in software security requirements management (SSRM), working with large companies in various industries to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Patrick Ciavolella
50%
50%
Patrick Ciavolella,
User Rank: Author
7/23/2018 | 8:34:30 AM
Remove it entirely from cars
Vulnerabilities are there not because they were not thuroughly thought out at the beginning but because it was not known at the time. Good guys cant spend the same amunt of time trying to break into items like the bad guys do. If we did we would live in a perfect world where there were no vulnerabilities. We all know this can never be the case, where there is a will there is a way, be it good or bad.
Only real solution is remove this data from cars entirely. It is not essential, people are just becoming lazier and reliant upon them to focus on the task at hand, Driving.
SchemaCzar
100%
0%
SchemaCzar,
User Rank: Strategist
6/13/2018 | 9:51:14 AM
Agile can't "Shift Left"Security has no "story points"
Security is something that simply cannot be addressed with Agile methodologies.  Security has no story points or other demo-able pieces that you can put at the end of a sprint, for example.  Security doesn't have the visibility needed for Agile's all-important feedback loop. Most importantly, security requires DESIGN.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15769
PUBLISHED: 2018-11-16
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is...
CVE-2018-18955
PUBLISHED: 2018-11-16
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resour...
CVE-2018-19311
PUBLISHED: 2018-11-16
Centreon 3.4.x allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
CVE-2018-19312
PUBLISHED: 2018-11-16
Centreon 3.4.x allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
CVE-2018-19318
PUBLISHED: 2018-11-16
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.