4 Cybersecurity Risks for Automotive Manufacturers

PB 25 Rockwell newlogo 400

August 19, 2022

By Joe Agee, Leader, Global Network & Security Services, Rockwell Automation

Several high-profile cyber attacks in recent years have put a spotlight on growing levels of cybersecurity risk in the automotive sector. The industry needs to quickly increase awareness of the current attack surface, which is often through the installed base of network assets, including machines and devices on plant floors.

The Risks

Successful attacks create not only financial risks in terms of ransomware shutdowns, data loss and expensive recovery processes, but also can create physical safety risks on automotive plant floors, lengthy supply chain disruptions – even litigation.

Fortunately, there are steps every automotive manufacturer can take to close common cybersecurity gaps. And it’s much more cost efficient to strengthen cyber resiliency up front than to allow high priority, curable gaps to remain unresolved.

This article outlines some frequently seen installed base vulnerabilities targeted by today’s threat actors.

OT/ICS Network and Asset Security

Over the last decade, automotive manufacturers opened up communications protocols and enabled plant floor data collection with an IoT ecosystem of sensors and actuators. Data sharing from OT to IT has greatly facilitated plant floor efficiencies and cost reductions through detailed analysis of this data within enterprise systems.

The explosion of data-driven insights from increased connectivity across the OT/IT boundary, however, has increased risk with the rise of sophisticated threat actors. Effective cybersecurity starts with knowing exactly what’s on networks to enable proactive securing of what’s legitimate, while removing and blocking what isn’t.  

Without proper security, threat actors can potentially breach the system with the potential of locking up controllers for ransom, controlling the physical actions of machines, altering recipe data, and even creating worker safety hazards.

Automotive manufacturers require a current and up-to-date understanding of all install base assets with visibility to known or unknown vulnerabilities, and a thorough risk assessment methodology within their OT environments to understand and mitigate the security vulnerabilities associated with increased data flow across the OT/IT boundary. This risk assessment can flag poor hygiene practices such as a lack of incident detection capabilities in IDMZ’s, communication protocol risks (e.g. Modbus, PROFINET), or unsecured (or unauthorized) IoT devices.

Poor Patch Management

Weak patch management of the installed base is hugely problematic⁠— 71 percent of automotive companies score poorly on patch management. From industrial plant floor PCs to PLCs, devices running outdated versions of operating systems or software are highly susceptible to cyber attacks. Patches often address critical security vulnerabilities in software, and not applying them on time carries high cybersecurity risk by making it relatively trivial for malicious actors to exploit outdated versions with known security flaws.

While poor patch management poses automotive cybersecurity risks, it’s also understandable in the context of production-critical plant floor devices. In the IT world, it’s straightforward to establish a patching routine for servers and workstations resulting in minimal business disruption.

On plant floors, patching means the potential for downtime on production machines that keep things ticking, and those responsible for OT environments are understandably adverse to any level of downtime. The statistics show that just one minute of halted plant floor production costs can cost automotive manufacturers $22,000. Risk increases when production environments operate with physical servers and have not yet been migrated to virtual compute infrastructures with 24×7 monitoring and administration of OT data centers.

Addressing OT patch management calls for a structured strategy with a minimal production disruption footprint. An asset inventory is critical in this process to provide an overview of every plant floor device, the software versions running on them, and their unpatched vulnerabilities. Also useful is a cybersecurity advisor who’s experienced in production operations to avoid common pitfalls and to quickly reach the right balance between effective security and production uptime.

OT Security Knowledge Gaps

OT security knowledge gaps are another source of vulnerabilities – because you can’t protect what you don’t know about.

For example, startups in the electric vehicle space may cover all the bases for IT cybersecurity to an extremely high degree, yet neglect OT vulnerabilities. Viruses, worms, and vulnerabilities at the automation level may propagate through the network and pose threats to physical equipment. The most infamous example is Stuxnet, which targeted PLCs via Windows exploits.

Increasing OT security starts with tested and validated reference architectures such as Converged Plantwide Ethernet (CPwE). CPwE provides a solid foundation for securing automotive plants. Assistance from experts in such architectures can help smartly deploy firewalls and establish industrial IDMZs to bolster plant floor security.

Additionally, adopting cybersecurity solutions aligned with the five pillars of the NIST framework (Identify, Protect, Detect, Respond, Recover) can greatly mature both IT and OT cybersecurity.

Credential Compromise

Despite the complexity of modern cybersecurity solutions and the sophisticated tactics used by malicious actors, many attacks initially exploit shockingly simple vulnerabilities. The most high-profile example recently was the 2021 Colonial Pipeline hack, in which intruders used a password stolen from a previous dark web data leak to access a VPN account and gain network access.

In an automotive installed base context, credential compromises could result in malicious parties accessing plant floor computers and devices with default or weak username-password pairs. Shared passwords and remote access, more common in our Covid-19 era, can introduce compromises where attackers gain control of machines and/or confidential data.

Zero Trust, an approach that hardens cybersecurity by removing excess or assumed trust from prioritized data, assets, application, and services (DAAS), emphasizes strong identity and access controls as a critical protection. Multi-factor authentication, regular password changes, least privileged access and other techniques can be used to grant access to authorized users, for authorized reasons, and at authorized times only.

Getting Started

At Rockwell Automation, we have a complete range of OT cybersecurity solutions that protect your networks, installed base and ultimately your operations against common cybersecurity vulnerabilities. These solutions include risk assessments and asset inventory services that help you understand vulnerabilities and build the right plan for greater resilience.

Important_Links_Bar.jpg

https://www.rockwellautomation.com/en-us/company/news/blogs/auto-cybersecurity-risks.html

 

Related Articles

Network Infrastructure Featured Product Spotlight

PBUS 14 Panduit logo 400

This webinar presented by Beth Lessard and Keith Cordero will be highlighting three Panduit solutions that will optimize network equipment and cabling to ensure that your spaces are efficiently and properly managed to support ever-evolving business needs of today and beyond. Products that will be featured include PanZone TrueEdge Wall Mount Enclsoure, Cable Managers, and Adjustable Depth 4-Post Rack.

REGISTER HERE


Editor’s Pick: Featured Product News

Siemens: SIMOVAC Non-Arc-Resistant and SIMOVAC-AR Arc-Resistant Motor Controllers

The Siemens SIMOVAC medium-voltage non-arc-resistant and SIMOVAC-AR arc-resistant controllers have a modular design incorporating up to two 12SVC400 (400 A) controllers, housed in a freestanding sheet steel enclosure. Each controller is UL 347 class E2, equipped with three current-limiting fuses, a non-load-break isolating switch, and a fixed-mounted vacuum contactor (plug-in type optional for 12SVC400). The enclosure is designed for front access, allowing the equipment to be located with the rear of the equipment close to a non-combustible wall.

Read More


Sponsored Content
Explore the Benefits of Industrial Control Panel Certification

The growth of industrial machinery and automation is driving a growing need for industrial control panels (ICPs) globally. The UL 508A Industrial Control Panel Shop Program is part of UL’s General Coverage Program, which offers control panel manufacturers flexibility in applying UL Certification Marks to a wide range of industrial control panel designs. Our Industrial Control Panel Program covers multiple requirements like proper component usage, enclosure environmental ratings, wiring and motor protection, safety markings, and conformance to the National Electric Code® (NEC) and Canadian Electrical Code (CEC).

Learn more HERE.


Products for Panel Builders

  • Mitsubishi Electric: MELSOFT Gemini 3D Simulator Software

    Mitsubishi Electric: MELSOFT Gemini 3D Simulator Software

    Mitsubishi Electric Automation, Inc. has recently released its MELSOFT Gemini 3D Simulator Software to allow users to expedite the design and construction of manufacturing projects as they introduce new automation components to their facility. By connecting to a variety of software and factory devices, Gemini provides visualization, simulation, and the streamlining of work processes. Read More…

  • CIMON: Xpanel Hybrid Expandable HMI + PLC Combo Unit

    CIMON: Xpanel Hybrid Expandable HMI + PLC Combo Unit

    Why pay for HMI and PLC products separately when you can save on cost and space by using a single, self-contained solution? This was CIMON’s philosophy when designing the Xpanel Hybrid: convenience, reliability, and practicality. Based on decades of knowledge and experience in the automation industry, CIMON has combined two of their most popular devices into one convenient package. Read More…