You’re cruising down the highway, entrusting your connected car’s sophisticated software to navigate, optimize fuel consumption, and guarantee a smooth ride. Your vehicle, a marvel of modern engineering, relies on a complex interplay of software systems seamlessly working together. But what if I told you that a minor compromise in just one line of code could disrupt this harmony, turning your drive into a potential hazard? A single programming oversight, a flawed algorithm, or a compromised software component can swiftly transform the joy of driving into a precarious situation, underscoring the critical significance of proper software management processes for automotive software development.
This predicament shares striking similarities with the challenges already faced by the automotive industry. Car manufacturing started as an arduous process, consuming hours upon hours of work. However, the advent of the assembly line segmented work into discrete, repetitive tasks thereby enhancing the efficiency of output and reducing manufacturing timing. This paradigm shift wielded a profound influence not just for the mass production of automobiles but also for the advancement of automotive safety protocols. The assembly provided room for standardization and stringent quality control measures.
Car Software Risks – and Emerging Regulations
Just as the assembly line revolutionized car manufacturing, the automotive industry now grapples with managing the intricate web of software components essential for modern vehicles. Similar to the assembly line’s dependence on standardized parts, software developers often use popular open-source libraries as the building blocks of their applications. Software developers must strictly manage and document the open-source components they use, like engineers during the manufacturing process.
Regulatory frameworks are crucial, as highlighted by the most recent CarUNCyberRule, which will take effect in July 2024 and requires manufacturers to demonstrate effective mitigation strategies for emerging threats. Recent examples show automakers like Porsche and Volkswagen would rather discontinue a model than deal with the complexities of software security and the mandatory updates needed for compliance. Not surprising, since most organizations don’t know ‘what’s in their software?’
Bad actors can exploit vulnerabilities in automotive software, posing significant risks to vehicle safety and security. With over 70 percent of software being open source, there is an increased risk of software supply chain tampering. Attackers can introduce malicious code into the supplier’s software or firmware, which could be subsequently exploited to breach the vehicle’s systems. Failure to quickly discover and fix these vulnerabilities compromises the integrity of the software and driver safety. Therefore, automobile manufacturers need security policies with robust Software Bill of Materials (SBOM), an itemized list of components in a given software, to guarantee safe, secure and updated software throughout the lifecycle of their vehicles.
SBOM Best Practices – Hi-Fidelity SBOMs
The software supply chain remains opaque, often concealing layers of nested open-source dependencies up to 20 to 30 levels deep. Traditional security measures are ill-equipped to detect or prevent software supply chain compromises. The complex and opaque nature of modern supply chains, compounded by the intricate layers of nested open-source dependencies, renders conventional security practices insufficient. As a result, there’s a critical need to augment existing security protocols with more robust mechanisms capable of identifying and mitigating threats originating from within the software supply chain.
In order to enhance supply chain security, thorough “Hi-Fidelity” Software Bill of Materials (SBOM) processes are required. Similar to how car manufacturers meticulously list, inspect, and track each part during production, processes need to document accurate SBOMs and meticulously document every open-source component used in software projects (including all of the currently hidden layers). By comparing the actual code of each dependency and its transitive dependencies (those are dependencies of dependencies), Hi-Fidelity SBOMs enable the identification and documentation of potential security risks, helping to address concerns surrounding software updates for car manufacturers.
This careful documentation ensures openness in the software supply chain and plays an important role in managing security issues and compliance with licensing rules. This transparency fosters trust within the automotive software supply chain, addresses security concerns and establishes compliance with industry standards.
Software is currently driving innovation and functionality for cars. By embracing documentation and management of software components, automotive leaders can uphold the principles of safety, reliability, and quality in their software-driven innovations. SBOMs have the potential to revolutionize how software is managed and integrated within vehicles.
No one will ever be entirely safe from a software supply chain attack; however, having a proper Hi-Fidelity SBOM process can help find and fix problems in the software supply chain before there is a chance to compromise it. A car assembly line systematically connects various parts to create a functional and safer car. It’s time for organizations to implement a Hi-Fidelity SBOM process to ensure that the accompanying software is just as functional and safe. Overall, implementing a smooth SBOM process will help keep automotive software protected and in line with regulations.
The author, Javed Hasan is the Co-Founder & CEO at Lineaje.