Description

This curriculum spans the breadth of physical security practices in automotive systems, equivalent in scope to a multi-workshop technical advisory program for OEMs establishing a secure vehicle lifecycle from manufacturing through service and incident response.

Module 1: Threat Modeling for Vehicle Physical Interfaces

Decide which physical attack vectors (OBD-II, USB, Ethernet, CAN FD, wireless key fobs) to prioritize based on vehicle class and deployment environment.
Implement threat modeling using STRIDE to evaluate risks associated with exposed service ports during vehicle maintenance.
Balance accessibility for authorized service technicians against protection from malicious firmware flashing via diagnostic tools.
Define trust boundaries between aftermarket devices and vehicle ECUs when allowing third-party tool connectivity.
Assess physical tampering risks at manufacturing and logistics stages where unsecured ECUs may be exposed.
Integrate physical security findings into the overall vehicle cybersecurity risk assessment required by ISO/SAE 21434.

Module 2: Secure Design of In-Vehicle Communication Interfaces

Select appropriate CAN FD message authentication mechanisms (e.g., MACs using HMAC-SHA256) without exceeding bandwidth constraints.
Implement secure gateway policies to restrict message forwarding between high-risk (e.g., infotainment) and safety-critical (e.g., braking) domains.
Configure ECU bootloaders to reject firmware updates lacking valid cryptographic signatures during dealer servicing.
Design fail-safe behavior for ECUs when detecting malformed or replayed messages on physical buses.
Evaluate trade-offs between message encryption overhead and data confidentiality for signals transmitted over internal Ethernet.
Define and enforce physical layer segmentation strategies to isolate safety-critical networks from less secure subsystems.

Module 3: Protection of Onboard Diagnostic Systems

Implement role-based access control for OBD-II services, differentiating between emissions testing and full diagnostic privileges.
Deploy time-limited authentication tokens for service tools instead of permanent access keys.
Log and monitor all diagnostic session initiations for anomaly detection, including source ECU and duration.
Disable non-essential diagnostic services in production vehicles to reduce attack surface.
Enforce secure pairing between diagnostic tools and vehicle using challenge-response protocols over the physical link.
Design fallback mechanisms for emergency towing or roadside diagnostics when primary authentication systems fail.

Module 4: Secure Key Management and Immobilizer Integration

Select between symmetric and asymmetric cryptographic schemes for vehicle key fob authentication based on cost and scalability.
Implement secure key storage in hardware security modules (HSMs) within door handle receivers and immobilizer ECUs.
Design revocation procedures for lost or stolen key fobs without requiring full ECU reprogramming.
Balance signal range limitations to prevent relay attacks while ensuring user convenience in real-world conditions.
Integrate rolling code mechanisms with timestamp validation to mitigate replay attacks on passive keyless entry systems.
Coordinate key lifecycle management across manufacturing, dealership provisioning, and end-user replacement workflows.

Module 5: Physical Tamper Detection and Response

Deploy tamper-evident enclosures on critical ECUs with sensors that trigger secure erase of cryptographic keys upon breach.
Configure intrusion detection thresholds to minimize false positives from environmental vibration or maintenance activity.
Implement secure logging of tamper events with time-stamping protected by trusted clock sources.
Define escalation procedures for tamper alerts, including ECU lockdown and remote notification to fleet operators.
Integrate tamper detection with vehicle immobilization systems without compromising safety during operation.
Select between active (e.g., mesh wires) and passive (e.g., seal integrity) tamper detection methods based on ECU location and cost targets.

Module 6: Secure Manufacturing and Supply Chain Controls

Establish secure bootstrapping of cryptographic identities during ECU production using trusted programming stations.
Enforce segregation between pre-certified and post-certified firmware flashing stations on the assembly line.
Implement audit logging for all programming and calibration activities involving physical access to vehicle systems.
Validate chain of custody for ECUs from supplier to final assembly to prevent insertion of malicious hardware.
Design secure provisioning of OEM-specific keys without exposing master key material at contract manufacturing sites.
Enforce physical access controls and visitor monitoring in areas where vehicles are stored with powered, unsecured ECUs.

Module 7: Aftermarket and Service Access Governance

Define technical and contractual boundaries for aftermarket device integration with vehicle CAN networks.
Implement secure APIs for third-party service tools that limit access to only required diagnostic data.
Configure ECUs to detect and alert on unauthorized parameter modifications during service events.
Balance regulatory compliance (e.g., right-to-repair) with cybersecurity requirements for open diagnostic access.
Deploy secure update mechanisms for service tools to prevent use of compromised or outdated software.
Establish audit trails linking service technician credentials to specific vehicle access and configuration changes.

Module 8: Incident Response and Forensic Readiness

Preserve physical layer communication logs with sufficient granularity to reconstruct attack sequences post-incident.
Design ECU memory structures to retain forensic artifacts (e.g., last authenticated tool ID) after power loss.
Implement secure dump procedures for vehicle bus data during post-crash or suspected compromise investigations.
Coordinate with law enforcement on chain-of-custody protocols for seized vehicles with suspected cyber tampering.
Define data retention policies for physical access logs that comply with regional privacy regulations.
Integrate physical security events into centralized automotive SOC monitoring with standardized alert formats.