“Cars today are basically data centres on wheels,” says Slava Bronfman, CEO and co-founder of Cybellum.
“Connected cars use cellular, wifi, Bluetooth, SIM-based telematics, and other types of connectivity to communicate.”
To those working in the automotive industry, none of this is new. But, for many consumers, the idea that their new car uses the same tech they find in their phones would be a shock.
“I’m not familiar with anyone getting into a dealership and asking about the cybersecurity rating of the car they are buying,” continues Bronfman.
Naturally, “It will change as the attack rate grows,” he says. “We haven’t seen terror attacks on vehicles and, hopefully, we won’t see these kinds of threats in the future. However,” he continues, “stealing cars based on cyber methods, stealing private data, and geo-location of the car, are the types of threats that we see on a daily basis.”
While these threats might not be immediately obvious to consumers, it’s clear that people in the industry have been taking note of Cybellum’s expertise. Just last week, it was announced that LG, the South Korean technology behemoth, was set to acquire a 64% stake in Cybellum for $140 million – giving the Israeli company a valuation of more than $200 million.
Slava Bronfman, CEO and co-founder of Cybellum.
“We’re excited about this partnership with LG and the great return we’ve been able to deliver to our stakeholders,” Bronfman said at the time before revealing that the discussions had been in the works for a while.
“Cybellum was approached by LGE following their scouting activities exploring the market for investment. Exploratory discussions began a few months ago which advanced towards a strategic investment in Cybellum,” he continues.
However, LG seems content to be a relatively light-touch investor.
“Cybellum will retain complete independence from LG with the autonomy to manage our strategy and product development,” says Bronfman. “The work with LG will allow us to accelerate our product development and go to market efforts, we plan to launch new products and target new areas in the coming future.”
But what did LG like so much about Cybellum? The answer, according to Bronfman is all in the Cyber Digital Twin.
“The Cyber Digital Twin technology is unique to Cybellum that creates great value to our customers,” he says.
“The Cyber Digital Twin, which is an identical replica of each component in the vehicle,” he continues. “Then, all the security assessments, risk analysis, vulnerability management, are conducted on this digital artefact without the need to access the hardware or the source code.”
The Cyber Digital Twin, of course, isn’t a physical recreation of a driver’s car.
The Cyber Digital Twin allows companies to control the risks to cars during their entire lifecycles, regardless of whether the motor is in development or has been on the road for years.
By creating a digital twin of a car, rather than testing and experimenting on the real car, cybersecurity teams can ensure that everything stays secure.
Those Digital Twins, however, are becoming bigger every day. Cyber Digital Twin is a detailed representation of the vehicle’s software components make-up including the software bill of materials, versions, licenses, hardware architecture, OS’s configurations, encryption mechanisms and keys, control flow, API calls, and more,” says Bronfman.
The twins are continually evaluated, says Bronfman, to detect new vulnerabilities and potential zero-day threats.
Cybellum finds these vulnerabilities and threats by scouring public and private threat information. Public information might be found on the dark web, for example, while private information is typically held by “white hat” hackers who hack company systems and alert the companies to any issues they find – typically for a handsome reward.
“Each vulnerability,” continues Bronfman, “is evaluated for relevancy and the risk it poses to the specific component and vehicle involved, presenting any resulting attack chains that could impact overall security.”
The protection doesn’t stop once a vehicle is on the road, however.
“In the post-production phase,” says Bronfman, “using a real-time threat intelligence feed, the Cyber Digital Twins are checked for new vulnerabilities, severity-level increases to existing threats, and new attack methods, showing you a full impact assessment on the entire fleet and providing mitigation recommendations.”
In short, if a new threat crops up, Cybellum will be able to spot it and help you fix it almost immediately.
At this point, you might be wondering (and with good reason) why automakers aren’t developing this kind of tech themselves.
“I wouldn’t say they pay enough attention today,” says Bronfman. “But the trend is very positive and encouraging, the new WP29 RN155 regulation is changing the entire automotive industry with regard to cybersecurity.”
That arcane-sounding regulation came directly from the UN and essentially gives automakers a list of rules to follow when it comes to cybersecurity and over-the-air updates to their cars. It’s a byzantine document but we’ll likely be living with its effects for years to come.
“We see serious budgets being injected into the secure development processes and the risk assessment of security issues,” continues Bronfman.
“There is a lot more attention and awareness, and interestingly we see ever more Chief Product Security Officer roles being created in the industry.”
For most of us then, even some within the car industry itself, it seems as though we are entering into a brave new world of hackable cars and compromised data.
For Slava and Cybellum, however, this is well-trodden ground. And that, for all of us, is a very good thing indeed.
Keyword: Auto Industry “Doesn’t Pay Enough Attention” to Cybersecurity – Cybellum CEO Slava Bronfman