Presentation Title
Total Page:16
File Type:pdf, Size:1020Kb
Intrusion Detection and Prevention Solution A Global Legal and Technological Perspective Intrusion Detection and Prevention Solution (IDPS) Agenda ASRG Webinar: A Global Legal and Technological Perspective 1. Welcome and Introduction 4.OEM IDPS Strategies Subline Typical challenges 2.Legislation and Standards Another strong argument for IDPS? 5.Conclusion and Outlook 3.In-Vehicle IDPS Technologies In a nutshell Public | ETAS-SEC/PRM-IDS | 8/20/2021 2 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] Welcome and Introduction Public | ETAS-SEC/PRM-IDS | 8/20/2021 3 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] ASRG: IDPS - A Global Legal and Technological Perspective Welcome & Introduction – Presenter Dr. Jan Holle Lead Product Manager IDPS (Stuttgart) ▪ Passionate about IoT (incl. automotive) security ESCRYPT – Trusted Security Solutions ▪ Joined ESCRYPT team in 2013 ▪ More than 10 years of automotive security expertise ▪ (Security Researcher, Consultant/PjM/GrL, Product 16+ years experience in automotive Manager) cybersecurity Dr. Siddharth Shukla ▪ 400+ employees in 19 locations Product Manager for Ethernet Firewall and IDS (Stuttgart) ▪ Passionate about embedded security, real time systems and ▪ Industry pioneer in cybersecurity wireless sensor networks ▪ Leading provider of IT security ▪ 11+ years experience (developer, architect, security analyst, product manager) solutions in embedded systems, Niclas Will consulting and services for enterprise Trainee in Product Management for IDPS (Stuttgart) security and IT-protected production ▪ Passionate about IT-Security in general and embedded ▪ Working for major OEM’s and Tier’s security in particular ▪ After his first rotation in consulting now for 5 months part of the IDPS product management team Public | ETAS-SEC/PRM-IDS | 8/20/2021 4 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] ASRG: IDPS - A Global Legal and Technological Perspective Welcome & Introduction – Increasing threat landscape (remote attack examples) 2016 2018 2019 2015 Key relay attack on 19 Volkswagen Tesla Model 3, Jeep Cherokee OEMs, 24 cars (Infotainment), BMW JIT (Just in time) 2018 2016 2017 2020 Tesla Model S, Tesla Model X, HMC Mercedes-Benz Mitsubishi Outlander (Bluelink) (Black Hat 2020) “As much as possible, we use network segregation… More importantly, there needs to be real time detection and reaction on vehicle.” Public | ETAS-SEC/PRM-IDS | 8/20/2021 5 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] ASRG: IDPS - A Global Legal and Technological Perspective Welcome & Introduction – Classification of IDPS components IDS Distribution Framework Multiple IDS sensors might be deployed in a vehicle. The IDS Distribution Framework offers components to collect, aggregate and manage security events from a ECU, a domain, or the complete vehicle locally before reporting them to the VSOC. Intrusion prevention system (IPS) IDS with the ability to respond to IDS Distribution detected intrusions are typically Host-based intrusion detection system (HIDS) Framework referred to as an intrusion prevention A host-based IDS monitors the characteristics of a systems. single system and the events occurring within that system for suspicious activity. Backend Link Log upload, Host-based IDS command & control Vehicle Security Operations Center (VSOC) Vehicle Security A Vehicle Security Operations Network intrusion Operations Center is a managed service for detection system (NIDS) Center (VSOC) monitoring vehicle fleets to identify possible cyber attacks A network-based IDS or security intrusions. monitors network traffic for particular network segments or devices and analyzes Network IDS for Firewall for network, transport, and CAN/CAN-FD and Automotive Ethernet/IP application protocols to Ethernet/IP identify suspicious activity. Public | ETAS-SEC/PRM-IDS | 8/20/2021 6 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] Legislation and Standards Another strong argument for IDPS? Public | ETAS-SEC/PRM-IDS | 8/20/2021 7 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] UNECE Regulations UN R155 and R156 The automotive sector is undergoing a profound transformation with the digitalization of in-car systems that are necessary to deliver vehicle automation, connectivity and shared mobility. This comes with significant cybersecurity risks. The two new UN Regulations require that measures be implemented across 4 distinct disciplines to tackle these risks by establishing clear performance and audit requirements for car manufacturers: 1) Managing vehicle cyber security 2) Securing vehicles by design to mitigate risks along the value chain 3) Detecting and responding to security incidents across vehicle fleet 4) Providing safe and secure software updates and ensuring vehicle safety is not compromised, introducing a legal basis for O.T.A. updates to on-board vehicle software Deadline for Jul. 2024 Deadline for Applied to first Aug. 2019 Jun. 2020 new vehicle Jul. 2022 registrations (EU) Vehicle all vehicle End of Adoption types Applied to new vehicle types must be developed registrations test phase by WP.29 types (EU) acc. to CSMS 2019 2020 2021 2022 2023 2024 Public | ETAS-SEC/PRM-IDS | 8/20/2021 8 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] IDPS - A Global Legal and Technological Perspective 7.2.2.2. Legislations and Standards - Relevant Requirements from UN R155 The vehicle manufacturer shall demonstrate that the processes used within their Cyber Security Management System […] include: How does an IDPS help in (g) The processes used to monitor for, detect and respond to cyber-attacks, cyber threats and fulfilling the requirements? vulnerabilities on vehicle types and the processes used to assess whether the cyber security ▪ Detect and monitor the attacks measures implemented are still effective in the “The vehicle manufacturer shall implement using in-vehicle IDS sensors light of new cyber threats and vulnerabilities that measures for the vehicle type to: have been identified. combined with backend data (h) The processes used to provide relevant data to aggregated in the VSOC (a) Detect and prevent cyber-attacks against support analysis of attempted or successful cyber- attacks. vehicles of the vehicle type; (b) Support the monitoring capability of the ▪ Prevent and respond to the attacks vehicle manufacturer with regards to using the expert knowledge in the The vehicle manufacturer shall report […] the detecting threats, vulnerabilities and VSOC to immediately find cyber-attacks relevant to the vehicle type; outcome of their monitoring activities, as defined adequate responses (e.g., software in paragraph 7.2.2.2.(g), this shall include relevant (c) Provide data forensic capability to enable updates) information on new cyber-attacks. The vehicle analysis of attempted or successful cyber- manufacturer shall also report and confirm to the attacks. Approval Authority or the Technical Service that ▪ The aggregated data allows data the cyber security mitigations implemented for forensic and the analysis of their vehicle types are still effective and any attempted of successful additional actions taken. cyberattacks 7.3.7. 7.4.1. IDPS is not explicitly required by R155, but the requirements are hard to fulfill without Public | ETAS-SEC/PRM-IDS | 8/20/2021 9 © 2021 ESCRYPT | All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights. | [email protected] ASRG: IDPS - A Global Legal and Technological Perspective Legislations and Standards - Mandatory Mitigations […] The mitigations implemented shall include all mitigations referred to in Annex 5, Part B and C which are relevant for the risks identified. However, if a mitigation referred to in Annex 5, Part B or C, is not relevant or not sufficient for the risk identified, the vehicle manufacturer shall ensure that another appropriate mitigation is Which IDPS component support the mitigation of which threat? implemented […].(7.3.4.) Network-based IDS and firewall Holistic solution Malicious Diagnostic access (e.g. Man in the Denial of service, for example … internal (e.g., dongles in OBD port) middle attack / this may be triggered on the CAN) messages used to facilitate an session internal network by flooding • Report security events attack hijacking a CAN bus from the mitigation measures via the distributed IDS approach • E.g., report violations to Host-based IDS and