Description

This curriculum spans the technical and organisational complexity of a multi-workshop automotive cybersecurity engagement, covering design, detection, response, and compliance activities comparable to those conducted by OEM security teams during real-world breach investigations and fleet protection initiatives.

Module 1: Threat Landscape and Attack Surface Analysis in Modern Vehicles

Conducting component-level attack surface mapping across ECU networks, including infotainment, telematics, and ADAS subsystems.
Identifying high-risk interfaces such as OBD-II, Bluetooth, Wi-Fi, and cellular modems that expose the vehicle to remote exploitation.
Evaluating third-party supplier components for undocumented backdoors or insecure default configurations.
Mapping CAN, LIN, and Ethernet (e.g., SOME/IP) protocols to determine message broadcast risks and spoofing vulnerabilities.
Assessing over-the-air (OTA) update mechanisms for potential downgrade attacks or unauthorized firmware injection.
Documenting real-world attack vectors from disclosed incidents (e.g., Jeep Cherokee 2015, Tesla Model S key fob relay).
Integrating threat intelligence feeds specific to automotive cybersecurity (e.g., ISO/SAE 21434, Auto-ISAC reports).
Performing red teaming exercises on parked and in-motion vehicles to simulate remote and physical access breaches.

Module 2: Secure Architecture Design for Vehicle Networks

Implementing zone-based network segmentation to isolate safety-critical systems from high-connectivity domains.
Selecting and configuring secure gateways between vehicle domains with hardware-enforced access control policies.
Designing secure boot chains using hardware security modules (HSMs) and cryptographic signatures for ECU firmware.
Specifying message authentication mechanisms (e.g., MACs, digital signatures) for critical CAN and Ethernet messages.
Choosing between symmetric and asymmetric encryption for inter-ECU communication based on performance and key management constraints.
Integrating secure debug interfaces with physical and logical access controls to prevent unauthorized ECU access.
Defining secure fallback modes and fail-operational behavior during cyberattacks on ADAS or braking systems.
Validating architecture resilience through fault injection and denial-of-service testing on network buses.

Module 3: Identity, Authentication, and Key Management

Designing certificate-based authentication for vehicle-to-everything (V2X) communication using PKI infrastructure.
Implementing secure key provisioning processes during vehicle manufacturing and component replacement.
Managing lifecycle of cryptographic keys across vehicle fleets, including revocation and rotation strategies.
Integrating secure elements (e.g., TPM, SE) into ECUs for tamper-resistant key storage.
Enforcing mutual authentication between mobile apps and vehicle telematics units using OAuth 2.0 with device binding.
Addressing risks of cloned or spoofed vehicle identities in fleet management and charging networks.
Designing secure pairing mechanisms for aftermarket devices (e.g., dongles, trackers) without compromising OEM systems.
Handling key recovery and secure deprovisioning during vehicle resale or decommissioning.

Module 4: Over-the-Air (OTA) Update Security

Implementing end-to-end signed and encrypted OTA update packages with rollback protection.
Designing differential update mechanisms that minimize bandwidth while preserving integrity checks.
Validating update authenticity at each ECU using hardware-backed verification before flashing.
Establishing secure communication channels between OTA backend servers and vehicles using mutual TLS.
Configuring update throttling and retry logic to prevent denial-of-service during failed rollouts.
Creating rollback procedures for corrupted or malicious updates while maintaining vehicle operability.
Integrating OTA update logs into SIEM systems for forensic traceability and anomaly detection.
Coordinating OTA release schedules across multiple ECU suppliers with conflicting update windows.

Module 5: Intrusion Detection and Response in Vehicle Systems

Deploying in-vehicle intrusion detection systems (IDS) that monitor CAN message frequency, content, and source anomalies.
Configuring real-time alerts for unauthorized diagnostic requests (e.g., UDS services 0x27, 0x31).
Implementing edge-based behavioral baselining for ECUs to detect deviations from normal operation.
Integrating vehicle IDS alerts with cloud-based SOAR platforms for centralized incident correlation.
Defining automated response actions such as network isolation of compromised ECUs or disabling remote features.
Storing forensic logs in write-once memory to preserve evidence during post-breach investigations.
Testing IDS efficacy against known automotive malware and fuzzing attacks on network protocols.
Managing false positive rates in IDS without degrading vehicle performance or user experience.

Module 6: Supply Chain and Third-Party Risk Management

Enforcing cybersecurity requirements in contracts with ECU and software suppliers using ISO 21434 clauses.
Conducting security audits of supplier development environments and CI/CD pipelines.
Validating software bill of materials (SBOM) for open-source and third-party libraries in vehicle firmware.
Requiring vulnerability disclosure agreements and patch SLAs from Tier 1 and Tier 2 suppliers.
Implementing secure firmware signing processes where OEM retains control of root keys.
Assessing risks of shared development tools and test equipment across multiple OEMs.
Monitoring supplier networks for indicators of compromise that could lead to supply chain attacks.
Establishing secure data exchange protocols for joint development projects with technology partners.

Module 7: Regulatory Compliance and Incident Reporting

Mapping vehicle cybersecurity controls to UN R155 and R156 regulations for type approval.
Documenting cybersecurity management system (CSMS) processes for audit readiness.
Classifying and reporting cybersecurity incidents to national authorities within mandated timeframes.
Implementing data retention policies for vehicle logs that balance forensic needs and privacy regulations.
Conducting risk assessments for new features to demonstrate due diligence under product liability laws.
Preparing technical documentation for regulators during investigations of real or suspected breaches.
Aligning internal policies with regional requirements (e.g., GDPR for connected vehicle data in EU).
Coordinating legal and technical teams during breach disclosure to avoid regulatory penalties.

Module 8: Forensic Investigation and Post-Breach Remediation

Preserving volatile memory and ECU logs from compromised vehicles using write-blocking tools.
Reconstructing attack timelines using timestamped events from telematics, gateway, and cloud logs.
Identifying initial access vectors such as phishing, compromised backend APIs, or insecure APIs.
Performing static and dynamic analysis of recovered firmware to detect backdoors or rootkits.
Coordinating with law enforcement and forensic labs for chain-of-custody handling of vehicle hardware.
Issuing targeted patches or mitigations for exploited vulnerabilities without disrupting safety functions.
Updating threat models and security controls based on lessons learned from the breach.
Conducting red team re-engagements to verify effectiveness of implemented countermeasures.

Module 9: Cybersecurity Operations Center (COC) for Automotive Fleets

Designing 24/7 monitoring workflows for detecting anomalous vehicle behavior across millions of units.
Integrating vehicle telemetry, IDS alerts, and cloud API logs into a unified SOC dashboard.
Developing playbooks for common incident types (e.g., mass OTA compromise, V2X spoofing).
Establishing escalation paths between SOC analysts, engineering teams, and executive crisis management.
Conducting tabletop exercises simulating coordinated attacks on connected vehicle fleets.
Implementing automated alert triage using machine learning models trained on historical attack data.
Managing secure communication channels for incident response coordination during active breaches.
Performing post-incident reviews to update detection rules and response procedures.