Effective management of cyber risk requires full supply chain visibility, strong supplier relationships, and actionable data, writes Sumit Vakil
With the accelerating development of new technologies, cyber security is quickly becoming a growing threat to organisations in all industries. And the automotive industry is no different, as more and more cyber criminals seek to exploit the sector’s many vulnerabilities. The connectivity of modern vehicles—with their numerous onboard systems and external connections—as well as the complexity of the global auto supply chain, make the automotive industry a perfect target for such attacks.
Growing concern in the auto industry
As reported by Resilinc, a global leader in supply chain mapping, disruption sensing, and data analytics, there was a 32% surge in the global number of cyber attacks targeting the automotive industry between 2021 and 2022. This increasing trend is set to continue in the coming months, as Resilinc has already documented 255 cyber attacks this year so far.
What’s more alarming, according to research based on interviews with C-level executives in large automotive enterprises, almost two-thirds (64%) of industry leaders believe the automotive supply chain is currently vulnerable to cyber attacks. Having been the fourth most impacted industry by cyber breaches last year, as shown by Resilinc’s data, a highly complex, interconnected network of automotive manufacturers, suppliers, and service providers faces an unprecedented challenge.
The visibility problem is real, given that 85% of supply chain disruptions originate from indirect Tier 2+ suppliers
Fortunately, there is a growing awareness of the urgent need for effective risk management in this area. Particularly when considering the UN Economic Commission for Europe’s new vehicle safety regulations, which will come into force in July 2024. Under this legislation, all automotive original equipment manufacturers (OEMs) and their supply chains will have to put in place multi-level cyber security provisions to guard against current and future cyber threats, at the risk of having to cease production of non-compliant models. These regulations provide a robust framework for cyber security management systems and software updates and require any vehicles already in development for production from mid-2022 to be compliant.
To make sure software-based components meet these requirements, OEMs will need to have full visibility into their entire supply chains. And it is safe to say that the visibility problem is real, given that 85% of supply chain disruptions originate from indirect Tier 2+ suppliers.
How serious is the risk?
A group of researchers investigating potential gaps in the automotive digital infrastructure made headlines earlier this year. They found critical vulnerabilities of varying degrees in cars produced by some of the world’s biggest automakers including Porsche, Ferrari, Rolls-Royce, Mercedes, and BMW. For instance, the ethical hackers were able to successfully access networks and find the owners’ personal information and live GPS data as well as start and stop certain vehicles remotely. Although all the flaws found have already been fixed, it is alarming evidence of the clear danger to customers’ privacy and safety. Even the largest manufacturers with seemingly best practices in place haven’t been able to avoid it.
Another example further demonstrates that even the highest cyber security standards may be insufficient at times, putting drivers at risk. A few months ago, security vulnerabilities came to light at Tesla, a manufacturer known for investing heavily in cyber security and working closely with ethical hackers. The researchers, who showcased the issues at a conference, were able to hack Tesla cars and, among others, turn off the lights, honk the horn, open the trunk, and interfere with the infotainment system. Tesla has since made patches to address these problems, but the risk remains.
It’s not only the customers who are directly threatened but also the manufacturers, their production, and employees. In 2022, one of Toyota’s critical suppliers was hacked, forcing the carmaker to halt operations at 14 factories and losing around 13,000 cars of output at a cost of about US$375mn. As reported, it took months to get the vendor’s operations back to normal. And in a more recent incident, the data of more than 75,000 Tesla employees was compromised in an employee-targeted attack, leading to an ongoing lawsuit.
Despite the evident risk, as many as 42% of C-suite respondents admit they do not currently have a plan in place ahead of the upcoming UN regulations mentioned above. Even more worrisome, almost a third of them claim they don’t see the value of investing in cyber intelligence at the moment.
What can be done to fortify auto supply chains?
Given the risk of enormous financial losses and reputational damage, what can organisations do to minimise cyber threats and strengthen their operations and supply chains?
The foundation of minimising disruption and ensuring a steady flow of products and services is having full transparency and visibility into the entire supply chain. To proactively safeguard against cyber attacks and the potential disruption they cause, automakers need to have a full understanding of all the links in their supply networks. There are several ways to achieve this.
A crucial first step is to map the entire supply chain through multiple tiers. To ensure business continuity in the event of a disruption, it’s essential to know every supplier and how their cyber security processes work. Importantly, the mapping needs to go beyond the high-volume, first-tier suppliers, given that it is often the sub-tier vendors where the issues originate. Mapping provides the information and visibility needed to identify those with vulnerable processes and systems and then work together to close the gaps and regularly remedy emerging security issues.
Another recommended practice is to carry out comprehensive and continuous cyber assessments of systems. These can reveal vulnerabilities that need to be addressed and pave the way for improved security measures. Through assessing and refining processes, organisations can keep their systems up to date and effectively counter hackers’ attempts.
AI is also set to play a pivotal role in combating and mitigating cyber attacks
What enables businesses to respond quickly is real-time visibility into events potentially threatening their supply chain. This is why—after having mapped all of their suppliers and sub-tier suppliers—automakers should also invest in monitoring tools. The way to achieve the best monitoring results is by harnessing the power of AI that provides continuous 24×7 screening of cyber security and other potential threats. These tools, equipped with predictive analytics capabilities, can bring a new level of efficiency and rapidity, crucial for risk mitigation.
Lastly, any effective cyber-resistant strategy should include a backup plan. What should companies do in the event of a cyber breach? How will they communicate a cyber attack to customers? Is there an alternative if production is halted by a cyber attack? A company’s playbook should include answers to such questions with detailed guidelines to follow in the event of a cyber breach.
The answer to cyber risk—artificial intelligence
While today’s supply chain remains primarily reactive, it is transitioning towards a proactive approach. With AI so central to the future operations of the automotive sector, the risk of exploiting vulnerabilities and disrupting operations is very real. Despite this, AI is also set to play a pivotal role in combating and mitigating cyber attacks, especially as breaches are becoming increasingly sophisticated and widespread. The risk within the automotive industry has never been this serious, but at the same time, businesses have never had access to such effective AI-powered tools to improve supply chain visibility and build resilience.
Just as advancing technology in the automotive sector enables further innovations, enhancing the comfort and experience of driving, its rapid development also brings increased risk for companies, their supply chains, and customers. The only way to combat these growing threats is for automotive manufacturers to understand all the links in their supply networks, including the people, processes, and technology involved. Effective management of cyber risk requires a multi-level strategy encompassing full supply chain visibility, strong supplier relationships, and actionable data.
About the Author: Sumit Vakil is the Chief Product Officer and co-founder of Resilinc