-: Your organization may have a lot of different vehicles,
depending on what kind of operations you're involved in.
For example, if you run a warehouse,
you may have forklifts and trucks.
If you run a delivery service,
you might have cars and motorcycles.
Maybe you even have unmanned aerial vehicles
if you work with law enforcement or the military.
Each of these vehicles
has their own control systems on board
and many of these are now becoming networked together.
Automobiles are becoming more and more advanced everyday.
Some cars can even drive themselves
while others have fantastic touchscreen displays
that do everything from controlling the air conditioning
to playing music to even driving the car,
in the case of some advanced cars
like those that are manufactured by Tesla.
All of these systems
have to be connected together to communicate
and it's what we call a Controller Area Network or CAN
that does this connection in your car.
This is great for operations,
but again, it can be horrible for security.
In fact, a couple of years ago,
a team of security researchers got into a new jeep
and tried to take over the onboard computer
by breaking into that controller area network
from the stereo.
After rewriting some of the function calls,
they were able to do it
and they were able to turn off the car
as it drove down the road.
This again is something we don't want to happen
and so security is important.
Now, to prevent this from occurring,
manufacturers use an air gap solution.
An air gap is a method of isolating an entity,
effectively separating it from everything else.
So, in the case of an automobile,
the engine's control unit should be isolated
from the controller area network.
This will ensure that the attacker can't jump
from the radio or the air conditioning through the CAN
and shut off the engine while the car is in motion.
Whatever vehicle type you're using,
you should look to include appropriate security policies
to help protect it.
This may include disabling advanced technologies
and Internet connections, if you're the user,
developing your code and using proper secure
software development lifecycle methodologies,
if you're the manufacturer,
and ensuring that you minimize your system's open ports
and services as much as practical.
Remember, anything with a CPU and memory
can serve as a computer.
And if it's serving as a computer,
it can be attacked or exploited.