Safer, Sooner: Automotive Cyber Safety & The I Am The Cavalry Initiative

### The Convergence of Automotive Safety and Cybersecurity Modern passenger vehicles have evolved from purely mechanical machines into complex distributed networks on wheels, containing over 100 million lines of software code distributed across dozens of Electronic Control Units (ECUs). In this presentation, Josh Corman, co-founder of the grassroots cybersecurity initiative "I Am The Cavalry," addresses the urgent public safety implications of connected vehicle architectures. When automotive engineering and digital connectivity collide, software defects cease to be mere IT inconveniences or financial risks; they transform into potential kinetic safety hazards capable of causing severe physical harm and loss of life.

### The Explosion of Remote Vehicle Attack Surfaces For decades, automotive manufacturers operated under the assumption that vehicle exploitation required physical access to internal wiring harnesses or the on-board diagnostics (OBD-II) port under the dashboard. However, modern connectivity requirements have dramatically expanded the remote attack surface: - **Telematics and Cellular Gateways:** Built-in cellular modems providing navigation, remote diagnostic telemetry, and emergency dispatch services. - **Short-Range Wireless:** Bluetooth hands-free audio, Wi-Fi hotspots, tire pressure monitoring systems (TPMS), and keyless entry RF protocols. - **The Elimination of the Physical Boundary:** Remote vulnerabilities—exemplified by Charlie Miller and Chris Valasek's demonstration of remote Jeep Cherokee exploitation via the Sprint cellular network—shattered the premise that physical access was required to send arbitrary CAN bus commands to critical control actuators like steering, acceleration, and braking.

### The Five-Star Automotive Cyber Safety Framework To provide automotive executives, regulators, and engineers with an actionable roadmap, I Am The Cavalry established the Five-Star Cyber Safety Framework: 1. **Safety by Design:** Incorporating secure software development lifecycles (SDLC), formal threat modeling, attack surface reduction, and rigorous architectural defense-in-depth from inception. 2. **Third-Party Collaboration:** Implementing coordinated vulnerability disclosure policies (aligned with ISO 29147 and ISO 30111) that establish clear, legally safe reporting channels ("safe harbor") for white-hat security researchers. 3. **Evidence Capture (Black Box Logging):** Integrating tamper-evident forensic logging that records CAN bus traffic, sensor telemetry, and electronic anomalies, enabling crash investigators to differentiate between mechanical failure, human error, and cyber-attacks. 4. **Security Updates:** Transitioning away from reliance on physical dealer recalls toward secure, authenticated over-the-air (OTA) update mechanisms that can rapidly patch vulnerabilities at scale. 5. **Segmentation and Isolation:** Establishing cryptographic and physical boundaries between non-critical, internet-facing infotainment systems and safety-critical powertrain, braking, and steering networks.

### Supply Chain Realities and Response Time Lags Corman highlights the fundamental structural tension between IT patch cycles and automotive product lifecycles. Traditional automotive manufacturing operates on multi-year design cycles, where Tier 1 suppliers deliver closed black-box ECUs that remain in vehicle production for five to seven years and on the road for decades. When critical vulnerabilities are discovered, automakers often face response times measured in months or years. Physical mailings of USB update drives suffer from dismal adoption rates (often under 10%), proving that without automated, secure over-the-air updating capabilities, fleets remain permanently vulnerable to known exploits.

### Catalyzing Industry Culture and Coordinated Disclosure Rather than adversarial shaming, the Cavalry initiative advocates for empathetic, multi-stakeholder collaboration across hackers, automotive OEMs, insurers, and federal regulators: - **Regulatory Pressures:** Congressional inquiries (such as Senator Markey's "Tracking & Hacking" report) and class-action lawsuits highlighted the regulatory risk of inaction, compelling automakers to form the Automotive Information Sharing and Analysis Center (Auto-ISAC). - **Embracing the Research Community:** The presentation encourages automakers to replace hostile legal threats with bug bounty programs and transparent communication, fostering an ecosystem where independent vulnerability discoveries protect public safety before adversaries weaponize vehicle weaknesses.

(AI summary — Gemini 3.8 Flash)