being the first vehicle in the world to obtain the cybersecurity certificate
For this, external entities to manufacturers will be the ones who certify compliance with the requirements set by the new regulation, subjecting them to evaluations. With this new regulation, external services should be cut to formalize that a vehicle is cybersecure.
The chosen entity must demonstrate that they have the appropriate skills, specific technical knowledge and proven experience in the field that covers each ONU regulation, in this case the UNECE/R155 regulation on cybersecurity for vehicles. These authorized entities must be previously designated by the manufacturers to carry out the evaluation test and inspections.
The question that any manufacturer cound ask is: how can I comply with the regulation? In this aspect, the UNECE/R155 has granted freedom to the brands to look for solutions to execute the regulations and to obtain the required safety certificate. For example, NUUK mobility solutions has chosen EUROCYBCAR, a technology company from the Basque Country that performs all kinds of tests in its lab located in Vitoria-Gasteiz.
In this test, hackers, IT engineers, car testers and CyberQ Testers have been carrying out for years the technical cybersecurity evaluation – the EUROCYBCAR test- on vehicles that belong to public authorities, institutions and OEMs.
After having passed the EUROYBCAR test, AENOR will audit a cybersecurity certificate for the NUUK Cargopro electric motorcycle, which will be valid for 3 years.
The EUROCYBCAR test, to comply the UNECE/R155 requirements, has 3 types of proofs:
Some of these applications allow the user to control various parameters of the vehicle from their smartphone -such as turning on the heating before entering- or access information stored in the vehicle -such as the mileage or the routes usually followed by the driver-. This, obviously, is a danger if a cybercriminal manages to violate these applications, since they could access vehicle systems and even cause an accident.
Once the vehicle has undergone the EUROCYBCAR test protocol and has passed it -being suitable-, it is granted a cybersecurity certificate and is given a “stamp” with a grade ranging from 3 to 5. The more high, it will mean that the analyzed car has a higher level of protection. That is, that “it will be a guarantee that it protects the user’s data that the vehicle stores” when, for example, they connect their smartphone.
And, above all, a good grade in the test will also be synonymous with the fact that the vehicle in question has the appropriate measures in place to prevent someone from remotely taking control of systems such as the steering, the brakes, the engine… and causing accidents. with serious risk to the life of the driver and passengers, or that of road users.
