so without further Ado um we'd like to
welcome our next speakers to the stands
so please welcome back to vanesh and
Giuseppe Celio
[Applause]
thanks hi everyone uh Welcome to our
presentation
Automotive three intelligence product
versus ID cyber security
my name is Peter Venice I am a threaten
thousands manager from distant group
that's by the way are really old picture
so sorry for that uh I've been touring
Europe for the last couple of years as a
three intelligence person
and my friend here is
yeah my pleasure to be with you today my
name is Jose pizero I'm the VP of Market
development at Upstream being in the
Auto industry for more than 20 years
um although all over the places but
predominantly in connective vehicle and
Automotive cyber security
just to tell you a couple of words about
uh our company
so I work for testing group and this
will be very important in the later
stages so as you can see we are a
manufacturing company and we basically
manufacture everything that has a
connection to Steel so you can see some
still things on the screen submarines we
have a submarine Division and of course
as you might have seen my colleague's
presentation in the morning we are also
producing
car parts
so you can see ourselves there our
employees so you can see we are a huge
company and we have partnered with
Upstream
yeah and a few words about Upstream so
Upstream is an Israeli company that was
established in 2017 in Israel and we do
cyber security and data management
tooling but also services in the threat
intelligence space where we collaborate
with our partner Tusan Krupp as well as
these days it's really important to have
vehicle security operations centers so
we operate also vehicle security
operations centers for our customers
and as you can see maybe just a quick so
um some of our investors are from the
automotive domain
um we are where automotive industry is
located in the big three regions and
today we have more than 12 million
connect the vehicle on our platform that
we're monitor day by day
I'm here
to deliver
a very important message today
this message is that the automotive
industry doesn't care about past
Tuesdays
I can see some frowns
yeah because uh basically this is false
the automotive industry does care about
patch Tuesdays so uh I have uh brilliant
colleagues in the I.T space who are
betting their uh software and our
software in fact so that everything's up
to date and everything works
and that's great but I am a product
cyber security person
so
I don't care about past Tuesdays
and again this is
untrue
we in the automotive industry use a lot
of software which is open source these
are batch regularly so if we didn't
patch our tools and our tooling used
then uh and production or in the
products then we would be in a very bad
space and we'd have vulnerabilities
which we wouldn't want
so that's why this is partially false
while we do care that uh the
infrastructure our development is uh
running on is up to date
my Christmases usually aren't ruined by
uh extreme vulnerabilities like log4j or
the solarwinds vulnerability which was
which happened about two years ago
however
there is one thing I'm really concerned
about
and that's something I don't see in the
automotive industry uh B it's uh oems so
car manufacturers or suppliers
I'm really concerned that there is
or there are no past Tuesdays in the
automotive sector you see some
vulnerabilities released for
um a large American
self-driving cars so there are CVS for
that brand
but they're it's not common for the
industry to release their
vulnerabilities in a way you can see
that in the I.T space
which from one standpoint makes sense
because you
you if you would make your
vulnerabilities public that would open a
whole can of worms that would be
um unfortunate for car manufacturers and
uh tier one suppliers such as ourselves
so what we are doing is that we need to
better understand the threat landscape
so we need to understand who is
targeting us who is targeting the car
makers who is targeting the automotive
suppliers
and the fact who will Target Us in five
years
what will be used to Target us what kind
of uh tools uh protocols and techniques
will be used to Target us
currently
thankfully
most of the targeting is uh from
with security researchers and white hat
hackers but Giuseppe will talk about
targeting in a minute
but what will happen in five years when
there will be smart cities and connected
ecosystems that's something we need to
work for diligently to be able to
predict
beforehand what will be used to attack
us
however
there are the cyber security of car
manufacturing is still a new thing I
hope you haven't seen any uh
self-driving cars that have been hacked
on your way here
I haven't so uh that means this is still
not as prevalent
as we
assume it to be in the near term
but if there are rumors
that there's a vulnerability out there
or if there is an attack out there that
could be
as damaging as the vulnerability itself
because people would Panic people want
wouldn't want to sit in their cars and
that would be bad for everyone
so we needed to find a new approach to
find relevant threat intelligence
but first let's talk about threat
intelligence in the automotive sector
it's similar to the it threat
intelligence
so uh we have our priority
intelligence requirements which for me
number one is to protect and predict
what kind of attacks will impact our
products
my second priority is to protect the
local company and additionally if I find
anything that's useful for the group
then I will act upon it
we work uh according to the Australian
intelligence life cycle
and what research is uh open source
intelligence
human intelligence this could be any of
you so sometimes security researchers
come to me describing a vulnerability
and sometimes internal colleagues come
to me when they find something which is
great
and we also
get a closed Source intelligence this
would be if I was a
if this was five years ago I would say
the deep and dark web but we all know
that the deep and dark web is not so
deep and so dark as it it we believed so
five years ago
however
there are certain risks coming from the
uh let's call it dark web for Simplicity
and
one of the reasons
we partnered with Upstream is to get a
better understanding on uh what kind of
threats are impacting us and what kind
of threats will impact Us in the near
medium or long term
yeah so this brings Upstream into the
conversation so I don't know how many of
you who are in the Auto industry but if
you are or you happen to come across the
yearly report that we publish you may be
acquainted with the risks that are in
the automotive industry so we do this
every year and 90 pages long and we
discuss and talk what's new what are the
new threats that companies need to care
about and what needs to be addressed in
order to stay resilient
now
when we look at the things it's not just
for the sake of hacking or the attacks
that we are seeing obviously have a
monetary aspect to it the sentence
follow the money is always true and as
you can see from the slide the Auto
industry is suffering big losses from
Cyber attack now arguably this is
everything cyber
but more and more we are getting into
the main where not only the I.T is
affected but more importantly the
products the services of the customers
so the OM and the supply chain is
affected and to stress that point as you
can see from the graph
the activities in cyber have been
skyrocketing so there's a 344 percent
increase in cyber incidents over the
last 10 years and it's really
significant so that's why it's important
to be sensitive be aware of this
scenario and I will elaborate later more
on the specifics of the types of attack
for now maybe Peter you can talk about
why it's important for the other
industry what what use cases yeah thank
you very much so uh I've put a couple of
uh use cases together which might be
important in the medium to long term
uh and that might impact the industry as
a whole so the first risk we expect is a
vehicle as a service use case
so uh you all know there is um
very well-known uh brand of car makers
who have recently
um
created a service where they charge a
set number of money for to enable their
uh seat Heating
and um
so this is a well-known uh we expect
other car makers to follow suit and
there were already
dissatisfied customers
who have looked for alternative
Solutions
to prevent paying money so that means
if I want to speak plainly is they were
looking for uh
patches or should I say cracks
to um
to enable their
heat seating for free
we expect that there will be a demand
from not only from these customers but
once
there will be an increase in uh in this
type of service offering by other car
makers the demand will likely Drive the
hacking market so to speak
this means if there's a demand then
there will be a Solutions providers who
operate either clenda Stanley or or
openly and these people will sell these
patches or cracks to individuals but you
only need the small logical step
to see what if these patches or cracks
uh wouldn't help the customer the
dissatisfied customer
but what if this would uh include uh
ransomware or other types of attacks
that would open up the car industry to
uh similar threats that the IT industry
is facing today
so this is one of the uh use cases we
are looking at
and the other one is the uh elephant in
the room
of course I'm talking about the
self-driving cars so these are
a very long way out if someone was
expecting to uh
have a self-driving car very soon and
I'm not talking about that specific
brand of cars which the automotive
industry doesn't regard
as a full self-driving car at the moment
but
these cars will happen and when these
cars will happen it's uh logical to say
that these will be more complex
than uh regular cars
normal cars today are very complex have
a lot of I.T equipment as you have again
seen from my colleague in the morning
but uh self-driving cars will be more
complex than uh regular cars and we all
know from the IIT industry is that
the more complex systems are they will
be more harder to secure
and
we need to be aware of
what's happening in the self-driving car
space
and what their security flaws are
because there will be security flaws and
these flows will likely increase by time
So speaking of risks I will give the
word back to Giuseppe who will talk
about these risks
right so every one of us is uh affected
so in fact everyone either drives a car
if you don't drive a car you maybe
happen to rent the car or you use
Mobility Services which are very common
these days so we are all affected at the
end of the day and the point that we
want to stress out is this is not just
Theory this is not just thinking that we
need to protect something which is
pictures actually it's really happening
today and as you can see from those
charts what I want you to take away is
two things one
more than 57 or 57 of the attacks are
actually carried out by the bad guys so
it's no longer the researchers which was
the case in uh the 2015
2016-17 but now
there is a monetary interest as Peter
explained so all the use cases the the
services that we expect from our cars or
from our Mobility provider to unlock uh
customer centricity and for the
customers or for the ums unlock new
revenue streams actually is pretty much
affected so the other thing to note is
that in the industry and Peter you
mentioned it's still somewhat in the
infancy
Automotive cyber security is not a big
things in terms of years like we know in
the IT industry it's like 2014 2015 even
there was one pivotal moment with the
famous gpac in 215 where it was proven
that you could do something to vehicles
on the road as they drive so if you see
on the left hand side of the chart
it's about 60 percent of the C Eves in
the outer space from 2016 to 21 actually
were medium or high severity and that
tells you something that we need to do
something about it and another number
that I want to share with you is
um
253 percent it's skyrocketing from last
year to this year the increase by the
incidents that we have been able to
unlock and understand that are happening
out in the wild so it's really important
to look not only at this exposure and
the use cases and to give you another
flavor
you see a chart so what are attackers
today carrying out what what is the talk
what what is the interest and um as you
can see from from the chart here is
it's uh the Privacy so it's a service on
one hand on the other hand stolen cars
key fobs that's a big thing you hear
that all over the places but more
importantly and this is the number on
the left hand side so the 7.3 percent of
all new incidents
are because of the interaction within
mobile app think for a moment about that
it doubled in the last year alone
meaning that while we try to protect and
you see the attacks on the right hand
side so this is the embedded stuff
infotainment OBD2 ports Wi-Fi networking
Bluetooth you name it we know there is
issues but from a percentage perspective
they're lower than the new things and
it's true that the industry is going a
massive shift from becoming an
engineering company
mechanical engineering towards a
software company
and it said that software is eating up
Hardware
now apis the mobility is eating up the
software that's the next big thing
because we all expect the same usage
with our smartphones that we know in
other domains yeah doing shopping
banking you you have this interaction
that will become the next wave of
attacks as we see it and in that context
we need to be very careful what we need
to to do and protect now
Peter you talked about
[Music]
um
complexity I think it's benefit if you
are not in the Auto industry you might
say well what's what's the difference
between protecting a cyber physical
system like a vehicle and the I.T space
I would summarize there are four major
differences so one is
you need to look at the vehicle
complexity
um I will have a quiz with you later on
I'm curious to see your response so wait
for that
um the car as I mentioned is becoming a
software product in software we know
it's a it's complex and there's
vulnerability inherently in uh what we
built so humans are just bad at coding
so uh that's the fact so we need to keep
up with with security but also the back
end system that we are adding the car
was not
used to be connected it was
built and sold
and there was a little bit of
aftermarket servicing but that's it
today it's connected and it stays
connected for the entire life cycle so
that's adding complexity and we want to
do those Services which need to interact
with the backend System payment billing
information sharing
we want the car to become the center of
our Digital Life like we used with a
smartphone so we're transferring
information the backend system is really
really important the connected services
around it are exposed
and then the supply chain and we know
exactly what we're talking about
the supply chain if you think for a
moment today there is this chip crisis
it's very easy to have counter fight
products if you don't really pay
attention to your products and follow
the entire chain where it's coming from
is there anything that you need to be
aware of in in that chain and I
mentioned the lifetime is really
important and we'll talk about that in a
minute and last but not least the threat
landscape
is exploding
again the car used to be just the car
you drive from A to B and that's it
today you can do even
um emails you can do payments you have
services that come with the car but more
importantly we now enable a feature
which is good but bad in the same time
meaning we enable over-the-air update
which is a new attack Vector we go into
electrification now we hook up our cars
to the grid and the charging station
there are exposing so all of that new
technology and all new features all new
um capabilities they're bringing a
plethora of new attack vectors to the
industry
and again I mentioned it's important not
to look just at the product because the
product
is just a small part out of a smart
Mobility ecosystem
in other words if you have the highest
barrier you do all the right things in
the vehicle
all the security elements that we know
from the it they have been more or less
passed and transported and embedded by
now into the vehicle but that's not
enough
it's like if you just care in a bank to
protect the safe
while the robber is already in front of
the door of the safe obviously you want
to protect even people from getting into
the building meaning you need to
understand the entire ecosystem and
exposure and I challenge on this very
much the industry telling
it's difficult to Define what is a cyber
security use case
and what not
for a simple reason we have some use
cases which we want to happen on purpose
like you want to open the car with a
smartphone
do a transaction
that is a very normal use case there's
no cyber in it but if the car is opened
with a command that comes from the other
side of the world that's suspicious
that's something you want to look into
and you need that intelligence that's
inside in order to able to connect the
dots context is key and it's just not
about the product because that's only
raising the bar and I used to say
between the bar as high as it is there's
still the sky and between there there's
always room for hackers to get in and we
know it's a daily thing now more on to
it if you are in the
I.T industry and not so much acquainted
with Automotive I'd like to share four
areas of thinking now
we all understand in the industry that
attacking is always easier but you
mentioned complexity and complexity is a
big thing
um we'll have the quiz on that in a
moment
and there are new vulnerabilities in the
interconnections we know this from I.T
as well but think for a moment in the
automotive domain 90 of innovation in
the outer industry is driven out of
software
if you build a car that's 30 000 on
average
pieces components
coming from two dozen of different
suppliers
that's complexity how do you build that
and to make things work worse
a product the very same car and model
that you drive they may look from the
outside identical
but they're not
it's not like having a same computer a
Mac or a a HP that you replicate with
the same components and then you look
into the security now because of
diversification strategies sourcing
strategies availability different
markets different regulation
carmakers there is no one car that is
equal to the other that is complexity
and that's important to keep in mind the
third thing is the internet we know this
as well very much in the IT industry it
empowers attackers because now things
can scale in an
organization how many laptops or devices
can you have it's uh very much analogous
to the number of employees maybe that
you have in service so that number stays
more or less stable
if you are Toyota or Volkswagen or
General Motors you add 10 million new
devices on the road every year that's
skyrocketing and you need to protect
them over the life cycle and again the
life cycle in the automotive industry is
probably one of the most difficult thing
to handle because
think of commercial vehicle tractors
buses they are out on the road for 40
years
eventually
has ever anyone in the IT industry tried
to keep something secure for more than
eight ten years think of Microsoft and
XP eight nine years and out or the
economics as I mentioned here don't
trickle down because if you think in
terms of your smartphone for instance
every three four years you change it you
have a whole new system with new
Hardware security mechanism etc etc
that's the challenge in the Auto
industry it's really really hard in that
complexity to to thrive and survive and
and and keep that also economically uh
safe
now I promised you the quiz
so a few numbers just because otherwise
everything seems like Theory
Let's Talk About Numbers they don't lie
so
how many human brain cells do you think
we have don't look to your neighbor I'm
asking a general question
tell me numbers so it's 11 zeros
two points the extension of 11.
if we look at the atoms
anyone wants to shoot how many zeros
just guess
no one
49.
let's go ahead
how many atoms in the universe do you
have
we have
88 zeros
and now you you would expect it
Automotive right it's a rhetorical
question
shoot me how many zeros do we have and
by the way I want you to know that this
is a Mercedes E-Class because that's one
of the single sources that we were able
to find from 2010 it's the complexity of
2010 which is
far beyond what we have today and
give me a number
come on don't be so shy
90. that's not bad
103.
that is the takeaway that is why
Automotive cyber security is so complex
yeah that gives you an idea and a flavor
now just quickly what is the industry
doing are we just talking about it or is
there something that needs to be done
about it and in the industry uh since
this year in July there's a new
regulation which is uh the UNSC WP 29 or
it's the r155 156 that's the technical
term about it and what you need to do as
an oem if you're part of the unsce
countries which are 58 States
predominantly Europe Asia
some South African Japan
you have to have a cyber security
management system in place
a governance model and this is typically
done in the industry in a vehicle
security operations center
and on top of it for the software update
management if there is the ability to
update software uh no matter if it's uh
by the way over the air or you do it in
a service shop you need to have a
management system that would look into
versioning so all the stuff that we know
from traditional it so it's hating the
barrier because we as a consumer need to
expect safe cars at the end of the day
or at least we should strive to have
resilience in in the things that we
built so that's effective for new
vehicle types this year
2024 it will be effective for all
vehicle types and what it means is if a
comic doesn't comply with that
regulation they will not get the
homologation meaning they can not sell
cars which is a big thing if you are in
the Auto industry selling cars so what
does it mean for all the other countries
you may ask so like us and South America
obviously very much like gdpr this will
raise the bar
and if you want to sell American cars in
the US or cars that are built in the US
but sold in North Korea for instance
you have to abide to those regulations
so effectively although the other
countries are not part of the unsce it
raises the bar for the entire industry
so from a consumer perspective
there's a little bit of a relief
hopefully that I'm able to give you
something is being done but there's a
lot of work to do that's why in the
industry we partner together there's
different bodies and organization who
come together industry supplier OEM to
work together because this is something
that is affecting everybody and
everybody should care about it and be
prepared to stay resilient
yeah
yeah so uh
you're right this episode we need to be
prepared and we need to work together
but we also need to align uh
our intelligence activities so we need
to align threat intelligence
uh
need to align the Strategic and
operative goals
so if we go back to what I said a bit
earlier so pirs priority intelligence
requirements which are the heart and
soul of what threat intelligence team
does because it defines what our goals
should be when we are looking out
uh into the web so uh just a quick recap
I'm mostly focused on our products my
second focus is the
Hungarian part of the company and the
third focus is on the distant group
group
for getting intelligence
we need to do Trend research
we need to see what the threat text or
the repositories are and we need a
dedicated and good sources
to get the good intelligence however you
are familiar or you should be familiar
with the butterfly effect if you don't
there is a comic on it
so there might be instances of strategic
intelligence that could impact the
operations
so you might have heard that there was
no no rain in China for uh
a month I think
and what was the effect
some car making factories were shut down
because of the heat wave
and
you might be also familiar I hope you
are familiar with the war and uh in
Ukraine
so when Russia invaded Ukraine
there were a lot of uh
car suppliers
who were hit due to the war and they
weren't able to produce parts for the
car makers
if strategic intelligence like this
happens
and we find them then we can prepare for
for example uh if there are no car parts
coming in then the car makers won't
order uh car parts from us
that's something we need to predict this
is something we can't prevent but uh we
can predict this
um
winter is coming so uh
uh wind termite suppose also a challenge
to the car industry but we'll see about
that
so this was the Strategic intelligence
however
black hats or hackers or
still the main source of our
intelligence and that was my takeaway so
uh
there are two faces to each coin
strategic and operational is both
very much needed for uh effective
intelligence operations in the
automotive industry similarly to the I.T
as well
so
yeah and after talking about Theory
challenges issues resolution maybe just
the last two slides one slide is okay so
Hands-On under the hood what is it that
jointly we do in working together one is
bringing in the automotive expertise
that the teams have to understand the
automotive threat landscape on
integrating constantly day by day
understanding how this relates to the
Regulatory Compliance because uh tier
ones need to provide reporting to their
worms where they supplied the product on
the other side it's important to have
early detection Warning Systems being
really part of the deep and dark web to
hear those listening to those rumors be
aware what is at risk
and last but not least once we learn
about even if it is a rumor as you said
start investigating what can we do about
it is this something serious is this
something that we need to take an active
response do we need to do something
about it how do we prioritize it that's
the kind of day-to-day work and last
Slide the sources of where we get the
intelligence besides being the own
sources meaning the research team of
Upstream being part of that that
ecosystem looking in deep and dark web
but also the clear web I mentioned the
report obviously the report is based on
clear web data because otherwise it's
it's rumors so stating the fact is
the base for for the reporting but last
not at least I hope you enjoyed the
session and you had some takeaways and
you're curious about the industries and
the challenges and want to learn more
and with that I think we both I want to
say thank you for your attention your
time yeah
thank you
[Applause]
thank you gentlemen I'm sure you'll
agree that was very cool calm and
collected uh presentation full of
interesting facts and figures very well
done thanks for that pattern
um thank you