Description

This curriculum spans the design and execution of a threat intelligence function tailored to automotive ecosystems, comparable in scope to a multi-phase advisory engagement supporting the integration of security intelligence across vehicle development, fleet operations, and regulatory compliance.

Module 1: Establishing a Threat Intelligence Program for Automotive Systems

Define scope boundaries between vehicle ECUs, backend services, mobile applications, and manufacturing systems when structuring the threat intelligence function.
Select internal stakeholders from engineering, product security, and compliance teams to formalize intelligence requirements and reporting cadence.
Develop criteria for classifying threat data relevant to automotive attack surfaces, such as CAN bus exploitation, telematics intrusion, or OTA update tampering.
Integrate threat intelligence workflows into existing automotive security incident response plans, ensuring alignment with ISO/SAE 21434.
Decide whether to centralize threat intelligence operations within a CISO office or distribute responsibilities across regional vehicle development centers.
Implement secure internal channels for sharing classified threat indicators among embedded systems teams without exposing sensitive vehicle architecture details.

Module 2: Sourcing and Validating Automotive-Specific Threat Data

Evaluate commercial threat feeds based on their coverage of automotive protocols such as UDS, DoIP, and SOME/IP, not just generic IT indicators.
Establish partnerships with OEMs, suppliers, and ISACs to exchange anonymized IoCs related to vehicle fleet anomalies and supply chain compromises.
Validate reported vulnerabilities in open-source vehicle stacks (e.g., Automotive Grade Linux) through controlled lab replication before dissemination.
Filter out false positives from generic scanning tools that misinterpret diagnostic message patterns as malicious CAN traffic.
Assess the reliability of underground forum intelligence on car theft tools or ECU reprogramming devices using attribution and corroboration techniques.
Monitor firmware updates from Tier 1 suppliers for embedded third-party components with known CVEs affecting automotive environments.

Module 3: Threat Modeling for Connected and Autonomous Vehicles

Map attack vectors across vehicle domains (powertrain, infotainment, ADAS) using STRIDE or PASTA, prioritizing remote exploitability and safety impact.
Identify trust boundaries between over-the-air update servers and vehicle ECUs, including rollback protection and signature validation mechanisms.
Incorporate physical access scenarios (e.g., OBD-II port exploitation) into threat models alongside remote attack paths.
Document data flows for V2X communications and assess risks associated with spoofed road infrastructure messages.
Update threat models when new vehicle features are introduced, such as biometric driver authentication or V2G (vehicle-to-grid) integration.
Use DFDs and attack trees to communicate risks to non-security engineering teams during ECU software design reviews.

Module 4: Operationalizing Intelligence in Vehicle Development Lifecycles

Embed threat intelligence outputs into requirement specifications for ECU software, mandating mitigations for active campaign tactics.
Integrate IoC scanning into CI/CD pipelines for telematics control units to detect known malicious domains in configuration files.
Configure static analysis tools to flag code patterns associated with recent automotive exploits, such as improper CAN message filtering.
Enforce secure boot and hardware security module (HSM) usage in designs based on intelligence about ECU cloning and firmware extraction.
Adjust penetration testing scope for new vehicle platforms based on observed attacker interest in specific communication buses or APIs.
Require suppliers to provide SBOMs and demonstrate threat-informed testing for components integrated into the vehicle network.

Module 5: Monitoring and Detection in Vehicle Fleets

Design telemetry collection from gateways and domain controllers to capture anomalous message rates or unauthorized mode changes.
Develop detection rules for IDS/IPS systems in vehicle networks using TTPs from real-world campaigns targeting fleet management systems.
Balance privacy regulations (e.g., GDPR, CCPA) with the need to collect diagnostic data that may contain threat-relevant artifacts.
Deploy network baselining for CAN and Ethernet segments to identify deviations indicating potential intrusion or malfunction.
Implement secure remote logging mechanisms that prevent tampering while minimizing bandwidth usage across cellular connections.
Coordinate with fleet operators to correlate ground-level incidents (e.g., failed starts, disabled ADAS) with backend threat intelligence.

Module 6: Incident Response and Threat Hunting in Automotive Environments

Define forensic data preservation procedures for compromised ECUs, considering limited storage and real-time OS constraints.
Conduct memory and flash dumps from affected vehicles in collaboration with field technicians using specialized automotive debugging tools.
Map observed attacker behaviors to MITRE ATT&CK for Vehicles (DRAFT) to identify gaps in detection coverage.
Initiate recall coordination protocols when intelligence confirms a scalable exploit affecting multiple vehicle VIN ranges.
Perform cross-vehicle analysis to determine if an isolated intrusion is part of a broader campaign targeting a specific ECU supplier.
Engage law enforcement and regulatory bodies when threat actors demonstrate intent to cause physical harm or mass disruption.

Module 7: Governance, Compliance, and Cross-Industry Coordination

Align threat intelligence activities with regulatory mandates such as UNECE WP.29 R155 and R156, documenting risk assessments and mitigation evidence.
Establish data retention policies for vehicle telemetry and threat logs that satisfy both forensic needs and privacy requirements.
Negotiate information-sharing agreements with suppliers that define liability and confidentiality for shared threat data.
Report coordinated vulnerability disclosures to third-party vendors using established automotive security coordination centers (Auto-ISAC).
Audit threat intelligence processes annually to verify integration with product security management systems (PSMS).
Participate in cross-OEM working groups to standardize indicators and classifications for automotive-specific threats.