Master of Ceremony Summit MC

Jeff Stewart  Assistant Vice President, Global Public Policy – AT&T  Chairman of the Affiliate Advisory Board of the Auto-ISAC

Education  Master of Business Administration with a concentration in Technology Innovation and Strategy from Georgia Institute of Technology Bachelor of Arts from University of Chicago

TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 1 Keynote Speaker Featured Speaker

William R. Evanina Director of the National Counterintelligence and Security Center Office of the Director of National Intelligence

Past Positions  Chief of the Central Intelligence Agency’s Counterespionage Group  Senior Executive Service

TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 2 Keynote Speaker Featured Speaker

Shigeru UEHARA  In-Vehicle-LAN System Design Engineer, E/E Architecture Development Division at the Toyota Motor Corporation  Chairman of Japan Auto ISAC

Past Positions  Director of Electronics design area of Toyota Motor Europe

TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 3 Outline of J-AUTO-ISAC Activities

Sep.26th, 2018

Japan Automobile Manufacturers Association, Inc.

1．Background of establishment 2．Organization and members 3．Roadmap 4．Activities in peacetime 5．Details (1) – (5) 6．Summary (for future actions)

5 1. Background of establishment

U.S. Auto-ISAC was established in January 2016,

Overseas led by US government agency  Participants include from various industries such as suppliers, telecommunications and IT companies as well as OEMs

Considering Japanese domestic particular situation such as the limited models and

Trend K-Cars, thought of being better to have our own ISAC has been growing for taking quick actions against unique incidents in Japan

ISACs of some sector’s have been established such as Finance and ICT led by JPN government agency Japan  Improvement of info sharing system of critical infrastructure was focused

For the “automotive sector” which must be just next to critical infrastructure, Recognition of the necessity of information sharing system and Expectation for establishment of Auto-ISAC have increased in the automotive sector

Japan Auto-ISAC was established in Jan.2017 voluntary, modeling the U.S. system

6 2. Organization and members

 Establish J-Auto ISAC under JAMA for speedy launch inevitably, the members are all Japanese OEMs J-Auto-ISAC US A-ISAC  Collaborations with suppliers, and IT companies are the 2nd step Secretariat:Deloitte Tohmatsu Member to do TOYOTA 〆 HONDA 〆 NISSAN 〆 MAZDA 〆 SUBARU 〆 SUZUKI MITSUBISHI 〆 DAIHATSU ISUZU HINO Primary suppliers MITSUBISHI FUSO HITACHI, CALSONIC KANSEI, YAMAHA PANASONIC, DENSO, AISIN, Suppliers 〆 SUMITOMO, MITSUBISHI Elec.

7 3. Roadmap

J-AUTO-ISAC Roadmap

FY2017 FY2018 FY2019 -

Information sharing activity Technical analysis activity

Continuous development Cooperation and functional Launch operation reinforcement and be in place

Establish Cooperation Promote the cooperation Small start focusing on system covering with other relevant information sharing overall supply-chain parties for information which is just a basic (OEM, suppliers, software sharing and technical function in ISAC vendors etc.) for Tokyo analysis Olympic - Paralympic in 2020 8 4. Activities in peacetime

1 Research on cyber threats on vehicles Identify Analysis of security weakness with security 2 check sheet

Analysis of vulnerability information in Protect 3 / technical task force Detect Analysis of US Auto-ISAC B.P. in a task force 4 to share the common understanding Respond / Recover 5 Case exercise for cyber attack on vehicles

Details of each activity are introduced on the following pages

9 5. Details [①Threat investigation]

Detect dangerous threats-information in advance in order to take quick actions (e.g. information communicated within hackers)

Theme “How to build a virtual environment against car hacking”

Palad1n : 2016/4/7 “…I know there are some tools out there, but not all are great. I think it would be worthwhile to develop such a virtual environment for being able to learn/test attacks against cars virtually from single machine… Is anyone interested in tag- teaming on developing such a tool/systems?”

NSA (Forum administrator) : 2016/5/10 “CANToolz is a framework for analysing CAN networks and devices…CANToolz can be used for ECU discovery, MitM testing, fuzzing, brute-forcing, scanning or R&D, testing and validation. More can easily be implemented with a new module.”

Palad1n : 2016/4/7 “I threw together a quick vagrant image that will create a Debian box that’s set up for some car hacking. It is really basic right now, but it will enable all the relevant modules, create two vcan interfaces, and install the SocketCAN tools so you can start creating virtual car networks to learn how to do this , etc”

10 5. Details [② Weak point analysis]

Improve each OEMs’ organizational concerns (e.g. tackling systems and rules required for automotive security management)

Analysis result Analysis result (per participating companies) (per survey questions)

11 5. Details [③ Technical task force]

Technical discussion and opinion exchange regarding the theme with practical engineers of OEMs (Not ISAC member)

Theme 「Spectre」「Meltdown」 / 11th Apr.

12 5. Details [ BP task force]

Analyze④ “Auto-ISAC Best Practice Guides” to have common understanding of them within Japanese OEMs

AUTO-ISAC Best Practice Guide Now discussing

 Incident response  Collaboration and engagement with appropriate third parties  Governance and accountability  Risk assessment and management  Vehicle security by design  Threat detection and protection  Awareness and training

13 5. Details [ Case exercise 1/3]

Reinforce⑤ the cyber security preparation through simulated exercise for supposed advanced cyber-attacks around 2020

Summary of a story (fiction)  X Motor Corporation (HQ:Tokyo) is a global automotive manufacturer with more than 100,000 employees  They have released a minivan at 2016, which became favorite for a wide range of generations and recorded more than 500,000 sales  A certain cyber criminal organization targeted X Motor Corporation and successfully attacked the minivan after intense research  X Motor Corporation is going to share the initial report of the incident information to J-Auto-ISAC

14 5. Details [ Case exercise 2/3]

Case⑤ exercise shows us our common and particular weaknesses concerns and issues to be treated

⇒ Legend ◎ ○ △ ×

Point 1 Validity of temporal axis 観… 2 6 1 2 Point 2 Validity of TLP 観… 8 3

Point 3 Validity of information weakness classification 観… 6 5 Point 4 Processing status of information to be provided 観… 2 9 Point 5 Validity of incident 観… classification 5 6 Point 6 Validity of impact recognition 観… 5 4 2 Point 7 Consistency of sharing information 観… 1 9 1

0 1 2 3 4 5 6 7 8 9 10 11 （Unit:Company） 15 5. Details [ Case exercise 3/3]

⑤ Explanation of point 1 to 7

Validity of temporal axis Validity of incident classification Point 1  Consistency of urgency Lv. and Point 5  Method to determine status of incident detection to notification time classification

Validity of impact recognition Validity of TLP  Influence on “user(owner)”, “vehicle”, Point 2  Method to determine the scope of Point 6 and ”society” information sharing  Quantitative influence

Consistency of sharing information Validity of information classification  Time consistency on notified data and Point 3  Selection of “incident”, “threat”, Point 7 reported contents “vulnerability”, “technical measures”  Inconsistency of reported contents Processing status of information to be provided  Appropriateness of personal data Point 4 anonymization  Abstraction status of technical and supplier information

16 6. Summary（for future actions）

Our short term goal is to ensure the tackling system and 1 operational know-how of the Japanese automotive industry towards Tokyo Olympic and Paralympic in 2020.

In the long term, Contribute to keep timely and reliable 2 response system for global automotive industry, considering introduction of autonomous driving technology into a market shortly.

3 To build “smart mobility society in cyber-safe”, we need to try to have the collaborated system by JPN/US/EU ISACs.

We’d like to start a regular session with US Auto-ISAC to 4 achieve the collaboration above.

17 Thank you for your time！

18 Effective Cybersecurity In A Rapidly Evolving Automotive Landscape – A Tier One Perspective

Sandip Ranjhan SR VP and GM of Automotive BU, Harman Connected Services

Tier One Suppliers complete the Picture

Develop Manage the Software Supply Chain

Provide Manage the Expertise in Integration the Systems

Tier One Suppliers Help

Complete the link

PAST NOW FUTURE

10M LOCs ~100M LOCs 100M-200M LOCs

Restricted electronics Active Safety – All car systems are operated by (Head-unit, A/C, key fob, door lock/unlock, broad access of user to safety systems software windows)

Number of attack vectors High Size of attack surface Large Magnitude of cyber physical space High

Process & Internal Staffing Security Practices (Architecture, Hardening, etc.) Visibility & Active Protection On-going Threat Management from Supply Chain to Post Production

Security Design Lifecycle

Threat HW/SW Security System Strategy Requirements HW/SW Security Security SYSTEM HW/SW Design Testing PRODUCTION Concept DESIGN Review INTEGRATION

Gateway Gateway Gateway Review Review Review HW/SW CONSTRUCTIONS

Gateway Gateway Gateway Review Review Review SW Code Review System Security HW/SW Final CONCEPT Requirements HW/SW Security SYSTEM Assessment System Design DESIGN Testing INTEGRATION Security Review Signoff

SECURE HW PLATFORM TAMPER RESISTANCE

HYPERVISOR DOMAIN SEPARATION

OS ACCESS CONTROL AUTHORIZATION POLICY

APPLICATION SANDBOXING APPLICATION ISOLATION

NETWORK PROTECTION INTRUSION PROTECTION

Full visibility to all possible harmful activities

Assessment and investigation

Response, mitigation and initiation of software update campaigns (OTA)

Integration-ready with SIEM and Incident Management systems

Improved Increased Greater Global Reach Expertise Collaboration

More Effective Information Sharing

The history of Tier One Suppliers 1 playing an active role in cybersecurity has not been long

An Incredible amount of action 2 has been taken in just a few short years

3 Tier One Suppliers are making a difference

Tier One Suppliers will and have to 4 play a big role in the future.

Kathleen Nuccetelli  Critical Infrastructure Analyst with the U.S. Department of Homeland Security (DHS)  Supports the Department of Defense, Department of Health & Human Services, and Department of Transportation

Education  Master of Science in Management  Master of Business Administration  Bachelor of Arts in Journalism

TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 33 The Office of Infrastructure Protection

National Protection and Programs Directorate U.S. Department of Homeland Security

The Critical Manufacturing Sector – Securing Your Organization Through Partnership

September 2018 Presidential Policy Directive - 21

Sector-Specific Agencies

. Sector-Specific Agencies (SSAs) are the primary Federal entities responsible for coordinating critical infrastructure security and resilience efforts at the national level. . Primary responsibilities: – Sustain effective and representative public-private partnerships; – Develop strategic goals to mitigate physical and cyber risks and improve resilience; – Support education, training, information sharing, and outreach; – Provide support to identify vulnerabilities and mitigate incidents; and – Develop and implement sector-specific plans in support of the National Infrastructure Protection Plan. Partnership Collaboration Structure

Sector and cross-sector structures include: – Sector Coordinating Councils – Government Coordinating Councils – Regional Consortium Coordinating Council – Critical Infrastructure Cross-Sector Council – Federal Senior Leadership Council – State, Local, Tribal, and Territorial Government Coordinating Council – Information Sharing Organizations Legal Frameworks

. Critical Infrastructure Partnership Advisory Council (CIPAC)

– DHS established CIPAC in 2006 under the authority of the Homeland Security Act of 2002, as a partnership framework exempt from the Federal Advisory Committee Act (FACA). – CIPAC enables private sector and government stakeholders to work in partnership and meet during joint Sector Coordinating Council (SCC) and Government Coordinating Council (GCC) meetings. – CIPAC provides the legal framework for cross-sector collaboration.

. Protected Critical Infrastructure Information (PCII)

– Congress created the Protected Critical Infrastructure Information (PCII) Program under the Critical Infrastructure Information (CII) Act of 2002 to protect private sector infrastructure information voluntarily shared with the government for the purposes of homeland security. Critical Manufacturing Sector Profile

− Primary Metals Manufacturing

− Machinery Manufacturing

− Electrical Equipment, Appliance, and Component Manufacturing

− Transportation Manufacturing

Map Courtesy of DHS Critical Manufacturing Sector Components

Primary Metals Manufacturing

Primary metals manufacturers convert raw materials into assemblies, intermediate products, and end products. These products can include sheet metal, bar stock, I-beams, slabs, or pipes. The 4,556 manufacturers in this component area were responsible for $270.9 billion in U.S. shipments.

Iron and Steel Mills & Alumina and Aluminum Non-ferrous Metal Production Ferro-Alloy Manufacturing Production & Processing & Processing

Pictures Courtesy of DHS Critical Manufacturing Sector Components

Machinery Manufacturing

Machinery manufacturers produce engines, turbines, and power-transmission equipment. These large, specialized products support infrastructure and primary operations in a number of critical U.S. industries. The 24,124 manufacturers in this component area were responsible for $407.6 billion in U.S. shipments.

Engine & Turbine Power Transmission Earth Moving, Mining, Manufacturing Equipment Agricultural, & Construction Equipment

Pictures Courtesy of DHS Critical Manufacturing Sector Components

Electrical Equipment, Appliance, and Component Manufacturing

Electrical equipment manufacturers produce specialized equipment, assemblies, intermediate products, and end products for power generation. The 5,765 manufacturers in this component area were responsible for $123.9 billion in U.S. shipments.

Electric Motor Transformer Generator Manufacturing Manufacturing Manufacturing

Pictures Courtesy of DHS Critical Manufacturing Sector Components

Transportation Manufacturing

Transportation manufacturers produce cars and trucks, aircraft and component parts, aerospace products and parts, railroad cars and other railroad products, and other transportation equipment. The 11,814 manufacturers in this component area were responsible for $792.9 billion in U.S. shipments.

Vehicle & Commercial Ships Aerospace Products and Locomotives, Railroad and Parts Transit Cars, and Rail Track Equipment

Pictures Courtesy of DHS Critical Manufacturing Sector Partnership Councils

Government Coordinating Council Sector Coordinating Council Members: Executive Committee Members:

− Department of Homeland Security − Aptiv, Chairman − Department of Defense − NCR Corporation, Vice Chairman − Department of Justice − The Boeing Company, Secretary − Members-At-Large: − Nuclear Regulatory Commission − Aerojet Rocketdyne − Environmental Protection Agency − Cisco Systems, Inc. − Department of Commerce − PACCAR − State, Local, Tribal, and Territorial Government − Schweitzer Engineering, Inc. Coordinating Council − ABB Ltd. − Kohler Company − AGCO Corporation Critical Manufacturing Sector Resources

. Critical Infrastructure Stakeholder Training Program:

– Wide array of web-based independent study courses, instructor-led courses, and associated training materials addressing critical infrastructure security and resilience topics.

– Independent study courses available through FEMA’s Emergency Management Institute. Critical Manufacturing Sector Resources

. Stakeholder Readiness and Exercise Program: Active Shooter – Works with critical infrastructure Incidents stakeholders to plan, develop, and Complex Natural Coordinated facilitate a wide range of exercises to Hazards Attacks /IEDs test plans and procedures, identify gaps, and recognize lessons learned and best practices.

Cyber- Physical Threats to – Supports the National Exercise Integrated Faith-Based Program. Incidents Organizations

Radiological, Biological, & Chemical – More than 20 large exercises typically Incidents conducted each year, with more than 4,700 participants. Critical Manufacturing Sector Resources

. Critical Manufacturing Road Show – Introduce members of industry to Federal departments, agencies, and National Labs. – Demonstrates government capabilities in mitigation, response, and recovery. – Provides an opportunity for classified briefings. – One of two annual in-person joint council meetings. – 2018 Meeting to held September 18-19, 2018 in Seattle. Critical Manufacturing Sector Resources

. Security Conference – The Security Conference hosts several briefings requested by industry partners, and have in the past explored the following topics:

. Insider Threat . Cybersecurity . Risk Management . Social Media Monitoring . Geopolitical Events

– Other briefings at the 2018 Conference included two classified briefings held at the Secret Level. – Provides Networking opportunity with industry partners. • 2018 No-Host Voluntary Social at the U.S. Space & Rocket Center. Critical ManufacturingEducation Sectorand Outreach Resources Resources

. Business Continuity – Developed in partnership between the U.S. Department of Homeland Security and the Critical Manufacturing Sector Coordinating Council. . Designed to assist businesses in maintaining normal operations and providing resilience during a disruption. – Available at: https://www.ready.gov/business- continuity-planning-suite – Business Continuity Planning Suite Offers: • Business Continuity Training • Business Continuity Plan Generator • Disaster Recovery Plan Generator (IT Recovery) • Business Continuity Plan Table Top Exercise Critical Manufacturing Sector Information Sharing

. Homeland Security Information Network – Critical Infrastructure

− HSIN-CI Critical Manufacturing portal refresh completed in May 2018.

− Resources available on Critical Manufacturing Portal include analysis, “peer to peer” collaboration, alerts, bulletins, and training.

− For more information on requesting a HSIN-CI account; https://www.dhs.gov/hsin-critical- infrastructure

Picture Courtesy of DHS Programs, Capabilities, and Resources

. Sector-Specific Resources: – Commercial Facilities Sector Protective Measures Guides for various industries, Patron Screening Best Practices Guide, Sports Venue Credentialing and Bag Search Procedures Guides, Suspicious Activity Awareness Videos and Posters, Commercial Facilities Cybersecurity Framework Implementation Guidance. – Nuclear Industry Reactors, Materials & Waste Sector Nuclear Sector Information Sharing Standard Operating Procedure, Nuclear Sector Security Awareness Guide, Roadmap to Enhance Cyber Systems Security in the Nuclear Sector. – Critical Manufacturing Sector Critical Manufacturing Partnership Road Show, Critical Manufacturing Security Conference, Sector Security Awareness Guide. Programs, Capabilities, and Resources

. Sector-Specific Resources: – Dams Sector Security Guidelines, Cybersecurity Capability Maturity Model, Information Sharing Resource Guide. – Emergency Services Sector Emergency Services Personal Readiness Guide for Responders and Their Families, Emergency Services Sector Cybersecurity risk identification and mitigation resources, responder focused resilience and continuity tools and practices. – Chemical Sector Chemical Sector Industrial Control Systems (ICS) Security Resource DVD, Chemical Sector Security Awareness Guide, Chemical Facility Security Best Practices Guide for an Active Shooter Incident, Sector-Specific Tabletop Exercise (Cyber and Domestic Terror). Programs, Capabilities, and Resources

. Active Shooter Preparedness Program: – Active Shooter Workshops Since its inception in 2011, DHS has conducted over 230 workshops across the country with more than 25,000 participants. Programs, Capabilities, and Resources

. Active Shooter Preparedness Program: – Online Training More than 800,000 individuals have completed the “Active Shooter: What You Can Do” independent study course. – Active Shooter Resources Online repository of valuable products and resources available at https://www.dhs.gov/active-shooter-preparedness, with more than 2,000,000 website views to date. A Typical Year… For more information visit: www.dhs.gov/critical-infrastructure

Contact: - Kathleen Nuccetelli - [email protected] Featured Speaker Speaker

Education  Master of Science in Management  Master of Business Administration  Bachelor of Arts in Journalism

TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 56 The Office of Infrastructure Protection