Description

This curriculum spans the technical and organizational challenges of securing modern vehicle systems, comparable in scope to a multi-phase advisory engagement with an automotive OEM, addressing architecture design, cross-supplier coordination, and compliance integration across the vehicle lifecycle.

Module 1: Threat Modeling and Risk Assessment in Vehicle Systems

Conducting STRIDE-based threat modeling on ECU communication paths within a CAN FD network, identifying spoofing and tampering risks at gateway interfaces.
Selecting appropriate risk scoring methodologies (e.g., DREAD vs. CVSS) for vulnerabilities in telematics control units, considering OEM-specific severity thresholds.
Integrating threat modeling into Agile sprints for domain controller development, ensuring alignment with ISO/SAE 21434 requirements for continuous risk assessment.
Managing scope trade-offs between comprehensive vehicle-wide threat modeling and resource-constrained project timelines during pre-production phases.
Documenting attacker capability assumptions (e.g., physical access vs. remote over-the-air) to justify mitigation priorities in supplier threat model reviews.
Coordinating threat model updates across multiple Tier 1 suppliers integrating ADAS and infotainment systems into a shared zonal architecture.

Module 2: Secure Vehicle Network Architecture Design

Designing VLAN segmentation and firewall policies for Ethernet-based domain architectures to isolate safety-critical systems from infotainment domains.
Implementing secure gateway routing rules between CAN, LIN, and Automotive Ethernet networks, including payload inspection for diagnostic services.
Evaluating the performance impact of encryption on real-time communication in time-sensitive networking (TSN) environments with deterministic latency requirements.
Defining message authentication mechanisms (e.g., MAC using AES-CMAC) for critical CAN signals without exceeding bus load thresholds.
Selecting between centralized vs. distributed firewall placement based on E/E architecture scalability and OTA update feasibility.
Establishing secure communication channels between vehicle and cloud backend using mutual TLS, including certificate lifecycle management at scale.

Module 3: Secure Boot and Runtime Integrity Verification

Configuring hardware-rooted secure boot chains on microcontrollers with HSMs, ensuring cryptographic verification of bootloader and OS images.
Implementing measured boot with TPM-like functionality to log firmware states for remote attestation by backend security operations.
Designing rollback protection mechanisms to prevent downgrading to vulnerable firmware versions during OTA updates.
Integrating runtime integrity checks for critical ECUs using memory protection units (MPUs) and periodic hash validation of code segments.
Handling failure modes during secure boot (e.g., corrupted image) with fallback strategies that maintain vehicle operability without compromising security.
Coordinating key management for secure boot across multiple ECU suppliers using a centralized key vault with role-based access controls.

Module 4: Over-the-Air (OTA) Update Security

Designing end-to-end signed and encrypted update packages with per-vehicle key derivation to prevent replay and cloning attacks.
Implementing atomic update mechanisms with rollback capabilities for domain controllers to avoid bricking during power loss.
Enforcing least-privilege access in the OTA backend, segregating roles for package creation, signing, and deployment approval.
Validating update package dependencies across interdependent ECUs to prevent version skew and communication failures post-update.
Monitoring OTA traffic patterns for anomalies indicating compromised update servers or man-in-the-middle attacks.
Establishing update authorization workflows requiring multi-factor approval for safety-critical system updates in production fleets.

Module 5: Intrusion Detection and Response Systems (IDPS)

Deploying in-vehicle anomaly detection on CAN bus using statistical models of message frequency and timing, tuned to minimize false positives.
Integrating ECU-generated security events (e.g., failed authentication attempts) into a centralized security log with time synchronization.
Configuring response actions for detected intrusions, such as disabling non-critical functions or entering a reduced-attack-surface mode.
Designing secure export of forensic data to backend systems using encrypted and authenticated channels with privacy-preserving anonymization.
Calibrating detection thresholds during vehicle commissioning to account for hardware-specific CAN timing variations.
Ensuring IDPS logic is updatable via OTA to adapt to newly discovered attack patterns without requiring hardware changes.

Module 6: Supply Chain and Third-Party Component Governance

Enforcing SBOM (Software Bill of Materials) requirements for third-party middleware used in infotainment systems, including vulnerability disclosure timelines.
Validating cryptographic module compliance (e.g., FIPS 140-2) in supplier-provided security libraries for use in regulated markets.
Conducting security audits of Tier 2 software components embedded in ECUs, particularly open-source libraries with known CVEs.
Negotiating contractual security obligations with suppliers, including incident response coordination and liability for vulnerabilities.
Managing firmware update responsibility boundaries between OEMs and suppliers for shared components like telematics modules.
Implementing secure integration of third-party apps in IVI systems using sandboxing and API gateways with strict permission models.

Module 7: Compliance and Security Certification Alignment

Mapping architectural controls to ISO/SAE 21434 attack scenarios to demonstrate coverage during certification audits.
Preparing evidence artifacts for UNECE WP.29 R155 compliance, including threat model documentation and IDPS test reports.
Aligning security architecture decisions with GDPR and similar privacy regulations when designing data collection for security monitoring.
Integrating cybersecurity verification into vehicle type approval processes, coordinating with test labs and notified bodies.
Documenting security assumptions and residual risks in the cybersecurity case for executive sign-off and regulatory submission.
Updating architectural documentation to reflect field-observed threats and incorporating lessons into future platform designs.

Module 8: Incident Response and Forensic Readiness

Designing secure, tamper-resistant logging mechanisms on ECUs with write-once storage characteristics for post-incident analysis.
Establishing data retention policies for security logs that balance forensic utility with storage constraints and privacy regulations.
Creating ECU-level containment procedures, such as disabling diagnostic services or isolating compromised nodes from the network.
Developing playbooks for coordinating response between OEM security operations, suppliers, and regulatory agencies during a recall event.
Implementing secure remote diagnostics access for incident investigation with time-limited credentials and audit trails.
Validating forensic data collection procedures through red team exercises to ensure chain-of-custody and evidentiary integrity.

Software Architecture in Automotive Cybersecurity