Master of Ceremony Summit MC
Total Page:16
File Type:pdf, Size:1020Kb
Master of Ceremony Summit MC Jeff Stewart Assistant Vice President, Global Public Policy – AT&T Chairman of the Affiliate Advisory Board of the Auto-ISAC Education Master of Business Administration with a concentration in Technology Innovation and Strategy from Georgia Institute of Technology Bachelor of Arts from University of Chicago TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 1 Keynote Speaker Featured Speaker William R. Evanina Director of the National Counterintelligence and Security Center Office of the Director of National Intelligence Past Positions Chief of the Central Intelligence Agency’s Counterespionage Group Senior Executive Service TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 2 Keynote Speaker Featured Speaker Shigeru UEHARA In-Vehicle-LAN System Design Engineer, E/E Architecture Development Division at the Toyota Motor Corporation Chairman of Japan Auto ISAC Past Positions Director of Electronics design area of Toyota Motor Europe TLP Green: May be shared within the Auto-ISAC Community. 11 October 2018 3 Outline of J-AUTO-ISAC Activities Sep.26th, 2018 Japan Automobile Manufacturers Association, Inc. © Japan Automobile Manufacturers Association, Inc. Contents 1.Background of establishment 2.Organization and members 3.Roadmap 4.Activities in peacetime 5.Details (1) – (5) 6.Summary (for future actions) 5 1. Background of establishment U.S. Auto-ISAC was established in January 2016, Overseas led by US government agency Participants include from various industries such as suppliers, telecommunications and IT companies as well as OEMs Considering Japanese domestic particular situation such as the limited models and Trend K-Cars, thought of being better to have our own ISAC has been growing for taking quick actions against unique incidents in Japan ISACs of some sector’s have been established such as Finance and ICT led by JPN government agency Japan Improvement of info sharing system of critical infrastructure was focused For the “automotive sector” which must be just next to critical infrastructure, Recognition of the necessity of information sharing system and Expectation for establishment of Auto-ISAC have increased in the automotive sector Japan Auto-ISAC was established in Jan.2017 voluntary, modeling the U.S. system 6 2. Organization and members Establish J-Auto ISAC under JAMA for speedy launch inevitably, the members are all Japanese OEMs J-Auto-ISAC US A-ISAC Collaborations with suppliers, and IT companies are the 2nd step Secretariat:Deloitte Tohmatsu Member to do TOYOTA 〆 HONDA 〆 NISSAN 〆 MAZDA 〆 SUBARU 〆 SUZUKI MITSUBISHI 〆 DAIHATSU ISUZU HINO Primary suppliers MITSUBISHI FUSO HITACHI, CALSONIC KANSEI, YAMAHA PANASONIC, DENSO, AISIN, Suppliers 〆 SUMITOMO, MITSUBISHI Elec. 7 3. Roadmap J-AUTO-ISAC Roadmap FY2017 FY2018 FY2019 - Information sharing activity Technical analysis activity Continuous development Cooperation and functional Launch operation reinforcement and be in place Establish Cooperation Promote the cooperation Small start focusing on system covering with other relevant information sharing overall supply-chain parties for information which is just a basic (OEM, suppliers, software sharing and technical function in ISAC vendors etc.) for Tokyo analysis Olympic - Paralympic in 2020 8 4. Activities in peacetime 1 Research on cyber threats on vehicles Identify Analysis of security weakness with security 2 check sheet Analysis of vulnerability information in Protect 3 / technical task force Detect Analysis of US Auto-ISAC B.P. in a task force 4 to share the common understanding Respond / Recover 5 Case exercise for cyber attack on vehicles Details of each activity are introduced on the following pages 9 5. Details [①Threat investigation] Detect dangerous threats-information in advance in order to take quick actions (e.g. information communicated within hackers) Theme “How to build a virtual environment against car hacking” Palad1n : 2016/4/7 “…I know there are some tools out there, but not all are great. I think it would be worthwhile to develop such a virtual environment for being able to learn/test attacks against cars virtually from single machine… Is anyone interested in tag- teaming on developing such a tool/systems?” NSA (Forum administrator) : 2016/5/10 “CANToolz is a framework for analysing CAN networks and devices…CANToolz can be used for ECU discovery, MitM testing, fuzzing, brute-forcing, scanning or R&D, testing and validation. More can easily be implemented with a new module.” Palad1n : 2016/4/7 “I threw together a quick vagrant image that will create a Debian box that’s set up for some car hacking. It is really basic right now, but it will enable all the relevant modules, create two vcan interfaces, and install the SocketCAN tools so you can start creating virtual car networks to learn how to do this , etc” 10 5. Details [② Weak point analysis] Improve each OEMs’ organizational concerns (e.g. tackling systems and rules required for automotive security management) Analysis result Analysis result (per participating companies) (per survey questions) 11 5. Details [③ Technical task force] Technical discussion and opinion exchange regarding the theme with practical engineers of OEMs (Not ISAC member) Theme 「Spectre」 「Meltdown」 / 11th Apr. 12 5. Details [ BP task force] Analyze④ “Auto-ISAC Best Practice Guides” to have common understanding of them within Japanese OEMs AUTO-ISAC Best Practice Guide Now discussing Incident response Collaboration and engagement with appropriate third parties Governance and accountability Risk assessment and management Vehicle security by design Threat detection and protection Awareness and training 13 5. Details [ Case exercise 1/3] Reinforce⑤ the cyber security preparation through simulated exercise for supposed advanced cyber-attacks around 2020 Summary of a story (fiction) X Motor Corporation (HQ:Tokyo) is a global automotive manufacturer with more than 100,000 employees They have released a minivan at 2016, which became favorite for a wide range of generations and recorded more than 500,000 sales A certain cyber criminal organization targeted X Motor Corporation and successfully attacked the minivan after intense research X Motor Corporation is going to share the initial report of the incident information to J-Auto-ISAC 14 5. Details [ Case exercise 2/3] Case⑤ exercise shows us our common and particular weaknesses concerns and issues to be treated ⇒ Legend ◎ ○ △ × Point 1 Validity of temporal axis 観… 2 6 1 2 Point 2 Validity of TLP 観… 8 3 Point 3 Validity of information weakness classification 観… 6 5 Point 4 Processing status of information to be provided 観… 2 9 Point 5 Validity of incident 観… classification 5 6 Point 6 Validity of impact recognition 観… 5 4 2 Point 7 Consistency of sharing information 観… 1 9 1 0 1 2 3 4 5 6 7 8 9 10 11 (Unit:Company) 15 5. Details [ Case exercise 3/3] ⑤ Explanation of point 1 to 7 Validity of temporal axis Validity of incident classification Point 1 Consistency of urgency Lv. and Point 5 Method to determine status of incident detection to notification time classification Validity of impact recognition Validity of TLP Influence on “user(owner)”, “vehicle”, Point 2 Method to determine the scope of Point 6 and ”society” information sharing Quantitative influence Consistency of sharing information Validity of information classification Time consistency on notified data and Point 3 Selection of “incident”, “threat”, Point 7 reported contents “vulnerability”, “technical measures” Inconsistency of reported contents Processing status of information to be provided Appropriateness of personal data Point 4 anonymization Abstraction status of technical and supplier information 16 6. Summary(for future actions) Our short term goal is to ensure the tackling system and 1 operational know-how of the Japanese automotive industry towards Tokyo Olympic and Paralympic in 2020. In the long term, Contribute to keep timely and reliable 2 response system for global automotive industry, considering introduction of autonomous driving technology into a market shortly. 3 To build “smart mobility society in cyber-safe”, we need to try to have the collaborated system by JPN/US/EU ISACs. We’d like to start a regular session with US Auto-ISAC to 4 achieve the collaboration above. 17 Thank you for your time! 18 Effective Cybersecurity In A Rapidly Evolving Automotive Landscape – A Tier One Perspective Sandip Ranjhan SR VP and GM of Automotive BU, Harman Connected Services © 2018 HARMAN INTERNATIONAL INDUSTRIES, INCORPORATED 19 Copyright ⓒ 2018 HARMAN All Rights reserved. Intro Tier One Suppliers complete the Picture 20 Copyright ⓒ 2018 HARMAN All Rights reserved. Cybersecurity Role of a Tier One Supplier Develop Manage the Software Supply Chain Provide Manage the Expertise in Integration the Systems 21 Copyright ⓒ 2018 HARMAN All Rights reserved. Intro Tier One Suppliers Help Complete the link 22 Copyright ⓒ 2018 HARMAN All Rights reserved. The Threat Continues to Grow PAST NOW FUTURE 10M LOCs ~100M LOCs 100M-200M LOCs Restricted electronics Active Safety – All car systems are operated by (Head-unit, A/C, key fob, door lock/unlock, broad access of user to safety systems software windows) Number of attack vectors High Size of attack surface Large Magnitude of cyber physical space High 23 Copyright ⓒ 2018 HARMAN All Rights reserved. Industry Average: 15-50 errors per 1000 lines of delivered code 24 Copyright ⓒ 2018 HARMAN All Rights reserved. Cybersecurity as