Threat vector vehicle: INFODAS provides expertise to BSI baseline protection module INF.11

The increasing complexity and use of IT in vehicles poses a major challenge to Cybersecurity which need to be adressed in a structured way. The newly released BSI IT-baseline protection compendium of 2021 provides a structured review of IT security risks and recommendations in vehicles.

The General Vehicle module INF.11 looks at different types of vehicles in such as cars, trucks, aircraft, trains and ships. It was cooperatively developed by representatives of the German Armed Forces (Cyber & Information Domain Service), the Federal Office of Information Security (BSI), federal and state police, fire department and infodas. The module’s focus is on vehicle’s internal networks (in-vehicle network via communication buses such as CAN, LIN or Flexray) with standard and aftermarket components. WLAN, 3G/5G or Bluetooth interface enable the flow of data and offer a broad attack surface for Cyber attacks. In addition, large amounts of data increasingly remain in discarded or stolen vehicles.

According to Arwed Igert, IT Security Consultant at infodas, “Cybersecurity threats to vehicles may result in unauthorized data transfer, vehicle theft or even the possibility of tampering with critical-safety relevant systems. INF.11 General Vehicle module defines the requirements to be met by vehicle manufacturers and owners to ensure optimal operation of a vehicle from an information security perspective”.

The IT basline protection compendium offers anybody a framework to adress a wide variety of information security issues. Individual modules contain risk assessments and recommendations for specific issues or technologies. The main objective of the INF.11 General Vehicle module is to raise security awareness in dealing with vehicles and to support IT security officers in implementing IT security measures. Autonomous vehicles are excluded from this module in the current version.