Securing the Connected Car Era
Key Points
- Modern vehicles function as complex computers, containing 70‑100 onboard systems and roughly 100 million lines of code, which makes every car a potential hacking target.
- The explosion of connected‑car deployments—projected at 367 million vehicles by 2027 and already numbering in the billions—means each vehicle becomes an additional endpoint, dramatically expanding the overall attack surface.
- Cars remain on the road for a decade or more, yet manufacturers rarely provide long‑term software patches, leaving legacy vehicles vulnerable much like outdated laptops.
- This longevity creates a business‑model dilemma: automakers have little incentive to maintain security updates for models they no longer sell, despite the growing cybersecurity risk.
- The IBM Institute for Business Value report highlights these challenges, prompting experts in AI‑driven autonomous EVs and cybersecurity to explore mitigation strategies for secure, connected mobility.
Full Transcript
# Securing the Connected Car Era **Source:** [https://www.youtube.com/watch?v=rLms76Q8bS4](https://www.youtube.com/watch?v=rLms76Q8bS4) **Duration:** 00:12:58 ## Summary - Modern vehicles function as complex computers, containing 70‑100 onboard systems and roughly 100 million lines of code, which makes every car a potential hacking target. - The explosion of connected‑car deployments—projected at 367 million vehicles by 2027 and already numbering in the billions—means each vehicle becomes an additional endpoint, dramatically expanding the overall attack surface. - Cars remain on the road for a decade or more, yet manufacturers rarely provide long‑term software patches, leaving legacy vehicles vulnerable much like outdated laptops. - This longevity creates a business‑model dilemma: automakers have little incentive to maintain security updates for models they no longer sell, despite the growing cybersecurity risk. - The IBM Institute for Business Value report highlights these challenges, prompting experts in AI‑driven autonomous EVs and cybersecurity to explore mitigation strategies for secure, connected mobility. ## Sections - [00:00:00](https://www.youtube.com/watch?v=rLms76Q8bS4&t=0s) **Security Risks in Connected Cars** - The segment highlights how modern vehicles operate as complex computer systems with millions of lines of code, making them vulnerable to hacking, and introduces the presenters' focus on addressing cybersecurity challenges as the number of connected cars is projected to reach 367 million by 2027. ## Full Transcript
the modern car is essentially a computer
that takes you places in fact it's
likely to contain between 70 and 100
onboard computers and a 100 million
lines of code and that doesn't just mean
High Tech Electric Vehicles that's all
cars these days and what we know from
cyber security is that every computer
can potentially be hacked which means
potentially every car can be hacked rest
well with that idea right and that's why
a recent IBM Institute for business
value report drew our attention we both
Drive AI powered self-driving electric
cars in fact we both got to the studio
today in them so we have a very personal
vested interest in this technology and
making sure it succeeds no doubt you've
seen Martin's great videos on the IBM
technology channel on AI and hopefully
you've also seen some of Jeff's videos
on cyber security so this whole subject
of security connected Cars Is Right In
The Sweet Spot for both of us
professionally as well in this video
we're going to take a look at the
challenges in this emerging space and
see what we can do to mitigate the risks
so let's talk about some challenges and
the first challenge I think is that
connected cars run on a lot of data lots
and lots of data connected cars have
always on network connections and used
for all sorts of purposes like shared
Mobility assisted driving and autonomous
Fe features now according to Juniper
research the number of connected cars is
quite large it's projected to be
something like
367 million Vehicles by
2027 now that sounds a lot but we're not
just talking about self-driving Vehicles
here many of today's vehicles are
considered connected Vehicles so today
there's something like 20000 million
connected Vehicles so I wonder with all
of this data it doesn't represent any
kind of security concerns is it Jeff Oh
contr Martin uh every one of these
things is an endpoint and every single
one of them increases the attack surface
making it easier for a bad guy to do
whatever it is he wants to do because
now he's got a million different targets
hundreds of millions of different
targets that he can aim at and
potentially attack and create all kinds
of Havoc so that becomes an additional
threat that we have to consider another
thing also if you've got a 10-year-old
laptop probably it's getting toward the
end of its life and you're going to Chu
that thing and and get another one um
and certainly you wouldn't want to use
one that hasn't had software updates in
10 years it's going to be slow it's
going to have all sorts of security bugs
in it and things like that well guess
what happens with vehicles most people
hang on to them uh either for 10 years
or more or they get rid of them and
somebody else inherits that car but the
point is it's out on the road for
decades and we're not used to supporting
software and vulnerabilities for that
long a period of time what's the
business model what's the incentive for
the car maker to keep supporting
software updates in vehicles that
they're not making any more money from
that means we have lots of security
holes sitting out there riding on the
highways you know 10 years is am to hour
my wife has had a car for 14 years ah
you're making my point exactly right now
let's talk about another concern I think
many of us have and that's about another
increase in something the increas in
complexity so a connected vehicle is
loaded with all sorts of onboard
capabilities now there's some obvious
ones like CPUs of course for processing
but there's probably gpus as well that
are powering the infotainment system
there are
tcus those are telematics control units
for managing the telecoms and the data
services in the vehicle like GPS
navigation and one we're both very
familiar with Jeff I think is otaa over
the air I'm waiting for one right now
love the otaa updates yeah we can't wait
for those so there's also LS of things
that happen outside of the vehicle as
well out Car Technology as well so for
example there is cloud technology for
workloads that don't run on the vehicle
now that's also known as Cloud VTO
meaning virtual Security operation
Center and that has various applications
and data platforms that monitor manage
and respond to cyber security threats
and in ents so yes it's uh it's a lot of
complex stuff it is complex and what I
know for sure is that complexity is the
enemy of security because the more
complex a system is the harder it is to
assure that it's going to do exactly
what we intend for it to do so all of
this great stuff that gives us these new
features also represents a complexity
which then represents a threat to
security as we see security decrease as
a result of these things if we're not
really careful now what a lot of
organizations do with software in
general and this applies to cars as well
is they tend to look at security as an
afterthought it's a bolt-on as opposed
to something that's baked in from the
start if you bake it in from the start
and use the right design principles
you've done security by design a secure
by Design car would be one that fails
safe instead of fails open it's one that
has uh the defense and depth capability
so we're not relying on a single
security mechanism but we have multiples
it's one where we're imple implementing
the principle of lease privilege so that
systems can't do more than they were
supposed to be able to do they can only
do exactly what they were designed to do
and no more so we need to be able to
implement these kind of of processes and
architectures in the vehicles themselves
and I have a down arrow challenge as
well I'm just going to call this lack of
because traditionally incar security is
man managed by an oem's product
development organization and the outcast
security stuff is the shared
responsibility between probably research
and development and the IT department
and that leads to a lack of stuff so
there is a lack of shared resources
between these teams there's probably
also a lack of common tools and there's
probably a lack of common skills between
these organizations as well now in fact
the ibv study reported that well over
50% of Auto motive execs reported lack
of all of these things yeah no doubt and
that really sums up the conclusion that
threats will increase as we add all of
these things the threats on the road
will continue to increase now some
people will ask the question is this a
real threat or is this something you
guys are just hyping this is
hypothetical well no it's real in fact
it's been around for a while even though
you might not have been aware of it back
in 2015 a couple of white hat hackers
guys who hack but they expose the
information that they find to the car
makers so they're not damaging anybody
they're actually looking for security
vulnerabilities in order to make the
system better they actually did a proof
of concept where they were able to take
over one of the very popular vehicles on
the road that day in those days and they
were able to control the brakes they
were able to control the infotainment
system the steering the engine speed a
lot of different things like that that
could be disastrous in the hands of an
attacker and they were able to do it and
it caused as a result a recall of 1.4
million vehicles uh that had to be
changed their software updated and so
forth and back then we didn't have
overthe a updates so these vehicles had
to be brought into the shop in order to
be uh to be updated uh so these are are
real threats that we see already imagine
when we start introducing all of these
kind of capabilities how much more that
is in fact going to increase yeah so
that's a a real threat to security but
another one of my concerns is privacy
what about privacy yeah that's a really
good one also and as a driver a consumer
of this technology you should care about
it as well privacy well your car is
collecting lots of information about you
it's a computer that takes you places
you know your computer is collecting
lots of information about you and a lot
of that information is used to improve
service for you to give you a more
customer IED experience but how is that
information used and where is it sent we
know it's being sent off into a cloud
someplace else what are they doing with
that information do we know can they
change their terms of service so this is
a threat to Consumer privacy and most
people are not aware of it they go ahead
and consent when they get the car so
that they can drive it when those terms
of service come up nobody brings their
lawyer along to read through the whole
thing before they take delivery of the
vehicle you just go ahead and accept it
and by the the way that stuff changes so
we've got threats both real and
theoretical in the security space as
well in the Privacy
space all right Jeff we've covered the
challenges but what can we do about them
so let's talk about some recommendations
yeah in fact Martin let's take a look
where you cover the automakers and what
they can be doing to improve security
and I'll talk about what the drivers and
consumers can do to protect themselves
okay so on the automator front there's
there's a couple things that we can do
so manufacturers need to embed security
and privacy in the entire product life
cycle and they can start with building
core platforms and services and one sort
of platform and service is a hyperscaler
now what is that it's a large scale
cloud service provider capable of
delivering compute storage and
networking resources on a massive scale
and that extensive amount of compute can
take advantage of Data Insights to
design a robust and secure
infrastructure and Jeff I'm sure you
knew we couldn't get ped through an
entire video without me talking about
gen apparently that's a thing it is a
thing yes so generative AI is a
consideration here but how well it could
be used to automate the monitoring of
compliance with security standards
across the supply chain could be used to
generate contracts and reports and
create models that predict future risk
based on historical data as well the key
here is though to use common tools and
standards to encourage security and
compliance and transparency
across the entire ecosystem oh and one
other thing for manufacturers to
consider from the start and it's
something you've already mentioned Jeff
that is
SBD secure by Design yeah if you don't
build the security in from the start
then trying to add it on later is more
expensive and actually more dangerous so
in fact if you don't get this stuff
right as an automaker it could represent
an existential threat to the company
because of damage to your brand
reputation damage so get that stuff
right for sure now on the consumer side
what can you do well I think it starts
off with education so learn as much as
you can about this technology about what
your car is intended to do what it's not
intended to do how you can use the
capabilities best uh in a safe way and
don't do things that that avoid the way
the car was designed to operate another
thing that you can do like with all
systems that are computers and again
these are computers that take you places
there's software on there you need to
make sure that the software is updated
now if you get over the a updates and
you maybe don't want to apply it the
very same day that it comes that's
understandable but don't go weeks or
months for sure don't go months not
applying these updates and if you have
to take the car into the shop because
there's uh there's no way to do an
overthe aair update well then that's
what needs to be done because if you
don't do this then there are latent
security bugs in your car and you're
driving around now what could be a
ticking Time Bomb you want to make sure
that's not happening in your case and
then the one thing you definitely do not
want to do Jailbreak the car
jailbreaking means you modify the
software in a way that the automaker
didn't intend and when you do that you
violate the security model and we have
no idea what's going to happen at that
at that point we all are impatient
especially me I want those updates
quickly but don't do this to try to get
them because that will put you at far
greater risk look Jeff and I we are both
real fans of connected vehicle
technology and what AI can bring to the
Driving Experience exactly we just need
to make sure that the security
challenges are mitigated so that we can
sit back and enjoy the
ride if you like this video and want to
see more like it please like And
subscribe if you have any questions or
want to share your thoughts about this
topic please leave a comment below