Description

This curriculum spans the technical and organizational rigor of a multi-workshop automotive cybersecurity advisory engagement, addressing threat modeling, secure communication, key management, OTA updates, intrusion detection, diagnostics, and compliance as practiced across OEMs and Tier-1 suppliers during vehicle development and post-deployment operations.

Module 1: Threat Modeling for In-Vehicle Networks

Selecting between data flow-centric and attack tree-based modeling approaches based on vehicle E/E architecture complexity and supplier collaboration constraints.
Defining trust boundaries between domain controllers (e.g., ADAS, infotainment) when shared buses like CAN FD or Ethernet are used for cross-domain messaging.
Determining attacker capabilities (e.g., physical port access, remote OBD-II) during STRIDE analysis to prioritize threats relevant to production vehicle deployment.
Integrating threat model updates into variant management processes when regional differences (e.g., telematics modules) introduce unique attack surfaces.
Aligning threat model assumptions with OEM-defined vehicle lifecycle phases (e.g., manufacturing, service, end-of-life) to scope protection needs.
Documenting mitigations for high-severity threats (e.g., spoofed sensor data) in a format consumable by both software teams and functional safety assessors.

Module 2: Secure Communication Protocols in Automotive Networks

Choosing between MAC-based (e.g., SecOC) and encryption-based protection for CAN signals based on real-time performance requirements and ECU processing limits.
Configuring IEEE 802.1AE (MACsec) parameters on in-vehicle Ethernet switches to balance latency and cryptographic overhead in time-sensitive domains.
Implementing secure session establishment between ECUs using TLS variants (e.g., TLS-Psk) when PKI deployment is impractical due to memory constraints.
Mapping communication matrices to cryptographic key distribution groups to minimize key management complexity across vehicle variants.
Handling message fragmentation and reassembly securely when transmitting authenticated payloads over protocols with limited MTU (e.g., CAN).
Designing fallback mechanisms for secure communication during ECU firmware updates where temporary key unavailability may disrupt message authentication.

Module 3: Key Management and Cryptographic Infrastructure

Defining key hierarchy structures (e.g., root keys, variant keys, session keys) to support secure boot, communication, and diagnostics across vehicle fleets.
Integrating HSMs or secure elements into ECU designs to protect long-term keys while meeting automotive environmental and cost targets.
Establishing key provisioning workflows at Tier-N suppliers to ensure secure key injection without exposing secrets to assembly line systems.
Designing key revocation mechanisms for compromised ECUs using certificate status protocols or group key updates without requiring OTA campaigns.
Specifying key rotation intervals based on vehicle usage patterns and threat intelligence, balancing security and system availability.
Implementing secure audit logging of key usage events for forensic analysis while preserving privacy and minimizing storage overhead.

Module 4: Over-the-Air (OTA) Update Security

Validating dual-signature schemes for OTA packages to ensure both OEM authenticity and supplier integrity without introducing deployment bottlenecks.
Designing rollback protection mechanisms that prevent downgrade attacks while allowing legitimate reversion for regulatory compliance.
Segmenting update packages by domain (e.g., powertrain vs. infotainment) to enforce least-privilege access during installation.
Implementing secure update coordination across dependent ECUs to avoid inconsistent states during partial rollouts.
Configuring secure communication channels between OTA backend and vehicle using mutual authentication with short-lived session credentials.
Monitoring update success rates and failure modes to detect potential tampering or supply chain compromises.

Module 5: Intrusion Detection and Response Systems (IDPS)

Deploying signature-based vs. anomaly-based detection rules on ECUs based on available memory and acceptable false positive rates.
Correlating alerts from multiple domains (e.g., CAN, Ethernet, wireless) in a central vehicle security manager without introducing single points of failure.
Configuring response actions (e.g., bus isolation, ECU reset) that comply with functional safety requirements under ISO 26262.
Designing secure logging mechanisms that preserve attack evidence while minimizing storage and transmission costs.
Integrating IDPS event reporting with backend SIEM systems using encrypted and authenticated telemetry channels.
Updating detection rules via secure OTA channels while maintaining system availability during rule deployment.

Module 6: Secure Diagnostics and Service Interfaces

Implementing UDS security access levels (e.g., Level 3, Level 4) with dynamic seed-key algorithms resistant to replay and brute-force attacks.
Enforcing physical presence checks (e.g., brake pedal press) during high-risk diagnostic sessions to prevent remote exploitation of service tools.
Isolating diagnostic gateways from safety-critical networks using hardware-enforced firewalls with configurable access policies.
Managing service tool authentication through short-term certificates tied to technician roles and vehicle VINs.
Auditing diagnostic session logs for anomalous command sequences indicative of unauthorized reprogramming or data extraction.
Disabling diagnostic services in production vehicles post-manufacturing while retaining access for authorized repair networks.

Module 7: Compliance and Cross-Organizational Governance

Mapping technical controls (e.g., SecOC, IDPS) to UN R155 and R156 requirements for audit readiness and type approval.
Establishing cybersecurity clauses in supplier contracts that mandate secure development practices and vulnerability disclosure timelines.
Coordinating vulnerability disclosure processes with third-party researchers while maintaining vehicle fleet integrity.
Conducting red team exercises on production-intent vehicles to validate defensive controls without disrupting manufacturing schedules.
Integrating cybersecurity risk assessments into change management workflows for ECU software updates and feature additions.
Defining incident response playbooks for vehicle-related cyber events with clear escalation paths between engineering, legal, and PR teams.