May 4, 2018—In response to the rising number of cybersecurity threats to the supply chain, the Automotive Industry Action Group (AIAG) announced the release of the Cyber Security 3rd Party Information Security publication—cybersecurity guidelines for automotive trading partners.
The initial idea behind the document came from an OEM approaching AIAG, and discussing the growing vulnerability of both transactional and proprietary information being shared by trading partners throughout the global supply chain. The OEM suggested that, by bringing the issue to AIAG and engaging other automakers, the industry could work toward a unified set of information security expectations. As a result, the document was created at AIAG with information security leaders and executives from GM, Ford, FCA and Honda, and socialized with their counterparts from Toyota, Nissan, Caterpillar, Bosch, Continental and Magna.
“Over the course of the past 25 years we have seen a remarkable shift in enterprise value from tangible to intangible assets. Data is the new currency. As such, more effective command and control of data has become an enterprise risk management priority,” said J. Scot Sharland, executive director of AIAG.
While each OEM may require additional measures be taken to ensure information security, this newly developed document outlines minimum guidelines for the secure exchange of information for supplier partners who collect, process, manage, access or store OEM data outside of the OEM’s computing environment.
By implementing these guidelines, suppliers – particularly those working with multiple OEMs– will be able to focus on complying with a single, unified set of expectations, instead of having to meet different (and potentially conflicting) guidelines for information security. OEMs, in turn, will benefit from knowing that their supplier partners are helping protect confidential and sensitive data.
The information security strategies included in the publication are based on industry best practices and standards – specifically ISO 27002 and/or 27002:2013, NIST 800:53 and NIST 800:171. In fact, the National Institute of Standards and Technology (NIST) was actually involved in the document’s creation; in addition to bringing “lessons learned” from their own experiences to the table, NIST helped facilitate the process of benchmarking one of their suppliers in the defense industry as well.
The General Computing Controls addressed in the guideline document are organized into nine chapters according to specific categories. Examples include access controls, data encryption, vulnerability management, security audits of suppliers/Third Parties, data retention and disposal and security investigations, among others. Controls related to software, service or electronic hardware components that reside in the vehicle or interact with a Telematics/Infotainment system that communicates between the back office and vehicle are beyond the publication’s scope.
“Regrettably, we have already witnessed, first-hand, the devastating and disruptive effects of ‘commercial cyber terrorism’ in our supply chain,” Sharland said. “AIAG is harnessing the collective strength of our eclectic membership – OEMs, suppliers of all sizes, service providers, government and academia – to heighten industry awareness and provide information, education and tools to help mitigate this risk.”
