Automotive Cybersecurity: Protecting Connected Vehicles

Connected vehicles and the explosion of embedded software have transformed the automotive industry. A modern car now carries dozens of interconnected ECUs running millions of lines of code. This shift toward smart mobility opens up huge opportunities for comfort and performance, but it also brings new cybersecurity risks. Every connectivity interface becomes a potential entry point for malicious actors.

As threats to road transport safety multiply, automotive engineering must build cybersecurity into every stage of product design. The growing importance of cybersecurity standards now requires OEMs and suppliers to adopt rigorous security management methods.

As a recognized expert in embedded systems, telematics and electronic architectures for the automotive sector, DUNASYS helps players across the ecosystem secure their operations. Automakers must now integrate automotive cybersecurity throughout the vehicle lifecycle, in line with the ISO/SAE 21434 standard.

What Is Automotive Cybersecurity?

Automotive cybersecurity covers all the measures, technologies and processes designed to protect a vehicle’s electronic systems, embedded software, ECUs, CAN network and communication channels against intrusion or malicious tampering.

In a connected vehicle, embedded system security is no longer limited to functional safety, which prevents physical or hardware failures. Embedded software security is now just as vital: a vulnerability can exploit the vehicle’s connectivity to remotely take control of critical systems such as braking or steering. Protecting a connected vehicle means ensuring both passenger safety and data privacy.

Why Are Modern Vehicles Exposed to Cyberattacks?

The massive integration of new technologies is turning the car into a computer on wheels. This added complexity expands the attack surface.

Connected Vehicles

Connected vehicles use Bluetooth, Wi-Fi, 4G/5G and keyless entry. Every access point is a potential vulnerability.

OTA Updates

Over-the-air (OTA) updates make it possible to fix or improve software remotely. If poorly secured, they can become a vector for injecting malicious code into multiple ECUs.

Mobile Apps

Companion apps let users lock the vehicle or turn on the heating remotely. A breach in the app gives hackers direct access to the vehicle.

Cloud and Telematics

Data sent to servers for fleet management or smart services creates a dependency on cloud infrastructure, exposing the system to external cyberattacks.

V2X Communication

V2X (vehicle-to-everything) communication connects the vehicle to other vehicles and to road infrastructure. Intercepting these data streams can disrupt traffic as a whole.

Top Cybersecurity Threats in the Automotive Industry

CAN Network Intrusion

The CAN bus orchestrates communication between vehicle components. Weak CAN bus security allows an attacker to inject fake messages and spoof engine or braking commands.

ECU Compromise

By taking control of a secondary ECU, such as the infotainment unit, cybercriminals try to pivot toward more critical ECUs in order to tamper with the vehicle’s vital functions.

OTA Attacks

A man-in-the-middle attack during a software update can compromise an entire vehicle fleet.

Data Theft

Vehicles collect personal data: geolocation, trips, phone contacts. This sensitive information is a prime target.

Communication Spoofing

Spoofing a V2X signal or a diagnostic tool can deceive ECUs and trigger dangerous behavior.

Attacks on Connected Fleets

A vulnerability exploited at scale can paralyze an entire fleet of delivery, transport or managed vehicles, bringing a company’s operations to a halt.

The Most Sensitive Systems in a Connected Vehicle

• ECUs: The vehicle’s electronic brains require strict validation through dedicated test environments (see our article on ECU testing).
• ADAS: Driver assistance systems rely on critical sensors and algorithms that demand airtight ADAS cybersecurity.
• Telematics systems: They link the internal architecture to the outside world through telematics units, essential for fleet management and car sharing services.
• Infotainment: Highly exposed to the outside world, it is the number one entry point for attackers.
• Network gateways: They segment the vehicle’s various buses and safeguard embedded system security.

These components form the core of the embedded systems developed by our engineering teams.

ISO/SAE 21434: The Benchmark Standard for Automotive Cybersecurity

ISO/SAE 21434 defines the universal methodological framework for structuring cyber risk analysis and mitigation. It covers all engineering activities, from design to decommissioning.

The standard requires a TARA (Threat Analysis and Risk Assessment) method to identify vulnerabilities, prioritize threats and apply appropriate countermeasures. Internal training on this standard is now essential for development teams.

• Risk analysis: Identifying and prioritizing vulnerabilities.
• Secure design: Building security in from the engineering phase.
• Testing and validation: Rigorous ECU assessment before deployment.
• Continuous monitoring and OTA updates: Post-production monitoring and remote patches.

UNECE R155: New Regulatory Requirements

Adopted by the UN World Forum for Harmonization of Vehicle Regulations (WP.29), UNECE R155 turns these recommendations into legal requirements. It requires automakers to implement a certified CSMS (Cyber Security Management System). Without it, no new vehicle can obtain type approval. UNECE R156 complements this framework by regulating the security of software updates.

Cybersecurity and Software-Defined Vehicles

The emergence of software-defined vehicles (SDVs) is shifting vehicle intelligence to ultra-powerful central computers. This major change means:

• A centralized architecture with fewer ECUs, but a higher value for each target.
• Greater reliance on OTA updates to evolve vehicle features.
• Integration of embedded AI, requiring stronger protection of algorithmic models.

The opportunities created by the SDV put connected vehicle cybersecurity at the center of automotive innovation.

How to Secure an Automotive Embedded System

Effective protection relies on a defense-in-depth approach:

• Risk analysis: Conduct a rigorous TARA from the very start of the project.
• Encryption: Secure CAN bus communications and data stored in ECUs.
• Authentication: Verify source code and software signatures before any execution.
• Continuous monitoring: Integrate an IDPS (Intrusion Detection and Prevention System) into the in-vehicle network.
• Security testing: Perform penetration testing and validation with Dunadiag and Dunalog.
• ECU validation: Automate qualification procedures through ECU testing.

DUNASYS Expertise in Automotive Cybersecurity

A leading player in automotive technology, DUNASYS helps you secure your complex architectures. Specializing in diagnostics, communication buses and embedded data acquisition with solutions such as the DCar-E, our engineers provide cutting-edge technical assistance to secure your systems.

Whether for a custom project or the integration of secure protocols, our experts deliver the quality and compliance required by current standards.

Key Takeaways

• Automotive cybersecurity aims to protect vehicle electronic systems, software and networks.
• The rise of connected vehicles and OTA updates expands the attack surface and the risk of cyberattacks.
• ISO/SAE 21434 governs cyber risk management from product design to decommissioning.
• UNECE R155 makes vehicle type approval conditional on an effective CSMS.
• ECUs, ADAS and telematics systems are the top targets for threats.