Connectivity & telematics
Cellular modules, eCall and cloud connectivity keep the vehicle permanently online – an attractive target for remote attacks.
Knowledge · Standards · Security
Automotive cybersecurity, clearly explained
Modern vehicles are computer networks on wheels. This page explains the attack surfaces, the applicable regulation and the key milestones of vehicle cybersecurity.
UN R155
UN R156
ISO/SAE 21434
What is automotive cybersecurity?
Automotive cybersecurity covers all measures that protect connected vehicles, their electronic control units (ECUs), in-vehicle networks and backend systems from manipulation, theft and surveillance. A modern car often contains more than 100 control units and millions of lines of software – connected via bus systems, cellular, Wi-Fi, Bluetooth and cloud services. Each of these interfaces is a potential entry point.
Because vehicles are safety-critical and often remain in service for decades, cybersecurity must be considered across the entire lifecycle – from development through production and operation to decommissioning.
Attack surfaces of modern vehicles
Connectivity creates convenience – and enlarges the attack surface. The most important entry points at a glance.
Key fobs & keyless entry
Relay and replay attacks extend or record the key signal – theft without a physical key.
Bus systems (CAN, LIN, Ethernet)
Classic in-vehicle networks often do not authenticate messages. “CAN injection” lets attackers inject forged commands.
Infotainment & apps
Head unit, Bluetooth, Wi-Fi, USB and companion apps are popular entry points into the vehicle network.
OTA software updates
Over-the-air updates must be signed and traceable – otherwise the update channel itself becomes a risk (UN R156).
Charging infrastructure (EV)
Charging stations, Plug & Charge (ISO 15118) and billing systems open new attack vectors for electric vehicles.
ADAS & sensors
Camera, radar, LiDAR and GPS can be deceived through spoofing or jamming, affecting assistance functions.
Backend & supply chain
Manufacturer backends, supplier software and key management are part of the attack surface – security does not end at the vehicle.
Regulation & standards
Since 2020, vehicle cybersecurity has been internationally binding. The key frameworks:
Cybersecurity Management System (CSMS)
The first binding international regulation: manufacturers must operate a certified CSMS and demonstrate a cybersecurity type approval. Mandatory for new vehicle types since July 2022, for all newly produced vehicles since July 2024 (UNECE markets).
Software Update Management (SUMS)
Sister regulation to R155: governs secure, traceable software and over-the-air updates via a Software Update Management System.
Cybersecurity Engineering
“Road vehicles – Cybersecurity engineering” (2021). Process standard for security-by-design across the entire lifecycle of electrical/electronic systems.
Risk analysis & framework
Threat Analysis and Risk Assessment (TARA) is the core methodology of ISO 21434. UNECE WP.29 forms the regulatory framework behind R155/R156.
Security across the entire lifecycle
Security-by-design means building in security from the start – not bolting it on afterwards. ISO/SAE 21434 structures this process along the vehicle lifecycle:
01
Concept & risk analysis
Identify assets, model threats, assess risks (TARA).
02
Development
Secure architecture, requirements, implementation and testing following the V-model.
03
Production & operation
Secure manufacturing, monitoring, vulnerability management and field updates.
04
Decommissioning
Securely erasing data and keys at the end of the lifecycle.
Milestones & incidents
How vehicle cybersecurity evolved from a research topic into a legal requirement.
-
2015
Jeep Cherokee hack
Researchers Charlie Miller and Chris Valasek remotely take over functions such as braking and steering via the UConnect infotainment system. Result: a recall of around 1.4 million vehicles.
-
2020
UN R155 & R156 adopted
UNECE adopts the first binding international regulation on vehicle cybersecurity.
-
2021
ISO/SAE 21434 published
The joint ISO and SAE standard defines cybersecurity engineering for road vehicles.
-
2022
R155 mandatory for new types
From July 2022, cybersecurity type approval is mandatory for all new vehicle types.
-
2023
CAN injection thefts
Criminals steal vehicles by injecting forged CAN messages through accessible wiring (e.g. at the headlight).
-
2024
R155 for all new vehicles
Since July 2024 the regulation applies to all newly produced vehicles in UNECE markets.
By the numbers
100+
control units in a modern vehicle
1.4M
vehicles recalled after the 2015 Jeep hack
2024
R155 mandatory for all new vehicles (UNECE)
100%
lifecycle to secure – concept to decommissioning
About this site
automotive-cybersecurity.ch is an information resource on the cybersecurity of connected vehicles – from control units and in-vehicle networks to diagnostics, regulation and standards. The goal is to present a complex topic in a clear and compact way.
This resource is for information purposes and does not constitute legal or security advice. Information on regulation and incidents is provided to the best of our knowledge, without warranty.