Automotive Cybersecurity Threats–Broader Than You Think

Automotive Cybersecurity Threats–Broader Than You Think

If I would offer you an opportunity to spend $300 and make $50,000 right away with more to come and no additional expense, would you take it? What about downloading a cybersecurity hack for that much off the Dark Web and using it to steal a $50,000 car?

Such a possibility exists Etay Maor, Chief Security Officer of IntSights told me yesterday. His firm, a threat intelligence company focused on enabling enterprises to Defend Forward, released the firm’s new report, Under the Hood: Cybercriminals Exploit Automotive Industry’s Software Features. The report identifies the inherent cybersecurity risk and vulnerabilities manufacturers face as the industry matures through a radical transformation towards connectivity.

Car manufacturers offer more software features to consumers than ever before, and increasingly popular autonomous vehicles that require integrated software introduce security vulnerabilities. Widespread cloud connectivity and wireless technologies enhance vehicle functionality, safety, and reliability but expose cars to hacking exploits. In addition, the pressure to deliver products as fast as possible puts a big strain on the security capabilities of cars, manufacturing facilities, and automotive data.

The two main things that affect hackers’ motivation, regardless of their skills and knowledge are the cost effectiveness of the attack and the value of the information.

Vehicles usually have more complicated attack surfaces to penetrate compared to other options, i.e. attacks against banks or retail shops. That said, the automotive industry still has numerous attack vectors, just as any other industry: needs Phishing, credential leakages, leaked databases, open ports, and services, insider threats, brand security, and more.

Dark Web Forums

In the research, IntSights discovered online shops that sell car hacking tools that appear on the clear web and are easy to find. These online shops sell services that disconnect automobile immobilizers, as well as services that sell code grabbers and forums that give bad actors a complete tutorial on how to steal vehicles.

“The automotive manufacturing industry is wrought with issues, stemming from legacy systems that can’t be patched to the proliferation of vehicle connectivity and software as consumers demand more integration with personal devices and remote access,” said Maor. “A lack of adequate security controls and knowledge of threat vectors enables attackers to take advantage of easily acquired tools on the dark web to reap financial gain. Automakers need to have a constant pulse on dark web chatter, points of known exposure, and data for sale to mitigate risk.”

Top Vehicle Attack Vectors:

  • Remote Keyless Systems
  • Tire Pressure Monitoring Systems
  • Software and Infotainment Applications
  • GPS Spoofing
  • Cellular Attacks

Other attack vectors explored include:

  • CAN-BUS
  • Attacking Can-BUS
  • Remote Attack Vectors
  • Car Applications
  • Physical Attack Vectors

IntSights has “the industry’s only all-in-one external threat protection platform designed to neutralize cyberattacks outside the wire.” Its cyber reconnaissance capabilities enable continuous monitoring of an enterprise’s external digital profile across the clear, deep, and dark web to identify emerging threats and orchestrate proactive response.

Emerson Automation Steps Up Digital Transformation Game

Emerson Automation Steps Up Digital Transformation Game

Everyone touts Digital Transformation lately. Emerson Automation has been patiently building a Digital Transformation practice through acquisition and development. Executives announced advances at this year’s edition of Emerson Global Users Exchange—my second stop of the Fall Conference Tour. I see Emerson pulling away from many of its automation peers becoming part of a select group of suppliers putting it all together (the others being Siemens, ABB, and Schneider Electric / AVEVA).

I’m going to run through some of the more significant announcements from the press conferences so far this week.

New Digital Transformation Organization

Emerson has established a dedicated organization focused on digital transformation technologies and programs. The Digital Transformation business brings together resources to help manufacturers develop and implement pragmatic digital transformation strategies that deliver industry-leading, or Top Quartile, performance. The $650+ million business combines existing expertise in consulting, project execution, smart sensor technologies, data management and analytics – all part of Emerson’s Plantweb digital ecosystem. The organization will help customers not only establish a clear vision for digital transformation, but also execute and realize measurable results at each step of their journey.

“In a space inundated by confusing promises, Emerson helps customers define and execute a practical and successful path to digital transformation,” said Lal Karsanbhai, executive president of Emerson’s Automation Solutions business. “With our new Digital Transformation business, we are strategically focused on guiding customers to the right strategy, helping them drive improved organizational alignment, and implementing programs that accelerate improved business performance.”

“The industry is at a critical point in the digital transformation journey,” said Stuart Harris, group president for Emerson’s new Digital Transformation business. “Many companies have a vision but struggle to implement practical solutions that deliver results and therefore they are getting frustrated. Other companies are solving specific problems, but not realizing value at scale across the enterprise. Emerson has the technology to provide practical solutions, and the experience to define the best practices and roadmap to help make a broad operational impact.”

Existing and new Emerson resources comprising the business include:

  • Operational Certainty Consulting: facility and enterprise-level roadmap strategies and implementation to improve reliability, safety, production and energy utilization metrics
  • Operational Analytics: the industry’s most comprehensive portfolio of predictive diagnostics and advanced analytics, providing insights on health and performance of operational assets
  • Industry Solutions: deep, industry-specific expertise on solutions to drive key performance indicators
  • Pervasive Sensing: the industry’s largest portfolio of smart, easy-to-deploy, connected devices, including wireless instruments
  • Project Management: best practices, tools and resources to  implement a digital transformation project with confidence

Comprehensive Operational Analytics Portfolio

Emerson’s portfolio of operational analytics focuses on the greatest source of value for industrial manufacturers – the production itself. Operational analytics with embedded domain knowledge can impact and improve performance of simple equipment, complex assets and process units, and entire production plants.

“We recommend addressing the high impact, known problems first,” Zornio said. “By using proven models that make analytics accessible to the personnel responsible for the performance of assets, our customers can act quickly to solve problems faster. For example, Emerson’s solutions can detect and address 80% of the equipment failure modes contributing to production loss in a plant in real-time.”

Additionally, Emerson’s enhanced portfolio includes machine learning and artificial intelligence that can be used to identify new discoveries and deepen insight to impact business performance. These tools provide perspective previously unattainable with traditional analytics.

“With our acquisition of KNet and its integration into our Plantweb Optics asset performance platform, Emerson can provide not only some of the most advanced machine learning and AI tools in the industry, but also the connection to people and workflows, which are critical to digital transformation success,” Zornio said.

Emerson’s portfolio now provides both pre-packaged analytics solutions as well as a complete analytics toolbox for users to develop their own applications. This portfolio is supported by Emerson’s Operational Certainty consulting practice and robust data management capabilities that provide a foundation for analytics success.

AMS Asset Monitor increases visibility and adds predictive analytics

AMS Asset Monitor edge analytics device digitalizes essential asset data and analytics for better operations performance and improved decision making. AMS Asset Monitor provides actionable insights into essential
assets that were previously monitored only with infrequent assessments. The new edge analytics device will connect with Emerson’s Plantweb Optics asset performance platform to provide key operations personnel with instant asset health details for operations and maintenance decision making.

Plants typically monitor the condition of essential assets such as pumps, fans, and heat exchangers only every 30 to 60 days. The longer the gap, the more likely that a defect goes undetected and results in an unexpected failure with significant impact on production, product quality, and plant efficiency. The new AMS Asset Monitor combines easy deployment, embedded logic-based analytics, and intuitive health scoring to make it easier for organizations to monitor and maintain essential assets. For instance, AMS Asset Monitor’s analytics and visualization can help plant personnel effectively plan maintenance during scheduled shutdowns and turnarounds and reduce or eliminate unplanned downtime.

Unlike typical analytics devices that send data to a historian or the cloud to be processed later, AMS Asset Monitor provides analytics at the edge, performing calculations at the device. This device-centered analytics capability reduces the time, complication, and expense of adding analytics to a plant’s assets. Each device collects data continuously and uses embedded logic to identify and diagnose common reliability issues. Individual issues such as imbalance, misalignment, bearing faults, lubrication issues, or fouling are consolidated into an overall asset health score. AMS Asset Monitor then communicates these health scores via a web browser or—when integrated with Plantweb Optics—through real-time persona-based alerts on mobile devices. Plantweb Optics also enables enterprise-wide visibility and expands edge analytics and digital intelligence throughout the organization, keeping personnel aware of essential asset health.

“Plants are always looking for more ways to improve profitability by increasing productivity. Just a percentage point or two in availability can equal millions of dollars per year or more,” said John Turner product manager for online prediction, Emerson. “The AMS Asset Monitor enables personnel across the plant to see the current health of essential assets along with suggested actions to improve asset health. This allows them to make informed decisions to maintain reliability, increase uptime and maximize productivity.”

The AMS Asset Monitor’s small footprint along with wired or wireless Ethernet connectivity make it simple to install. The edge device can support new applications by simply adding new logic-based analytics.

Industrial Wireless Network Solution

Emerson is partnering with Cisco to introduce a next-generation industrial wireless networking solution. The new Emerson Wireless 1410S Gateway with the Cisco Catalyst IW6300 Heavy Duty Series Access Point combines the latest in wireless technology with advanced WirelessHART sensor technology, delivering reliable and highly secure data, even in the harshest industrial environments.

“A secure connection that scales easily is the foundation for every successful IoT deployment.” said Liz Centoni, senior vice president and general manager, IoT at Cisco. “By using the power of the intent-based network, Cisco provides a secure, automated, rock solid infrastructure helping IT and operational teams work together to reduce complexity and improve safety.”

This next-gen wireless access point provides enhanced wi-fi bandwidth necessary for real-time safety monitoring, including Emerson’s Location Awareness and wireless video. These applications enhance personnel safety practices, improve plant security and help ensure environmental compliance. A reliable and fast connection between devices and people streamlines decision making by providing real-time analytics. It also enables a mobile workforce to virtually come together, collaborate and resolve critical issues in a timely manner.

“Products installed in industrial plants need to last for years, even decades,” said Bob Karschnia, vice president of wireless at Emerson. “This kind of longevity was a critical design and engineering requirement to ensure this new wireless access point was future-proofed to meet a rapidly evolving technology landscape.”

Personalized Digital Experience

​​​​Emerson‘s new personalized digital experience – MyEmerson–connects people and technology through streamlined work processes and better collaboration. With a MyEmerson online account, users can access digital tools to quickly engineer solutions, manage software and installed assets, access training, collaborate with experts, streamline procurement processes, and improve visibility into buying history and trends.

“Driven by our personal interaction with digital technology, customers have new expectations today about speed and access to information,” said Brad Budde, vice president of digital customer experience, Emerson
Automation Solutions. “Our customers still want access to human expertise, but now expect a great digital experience as well. Combining these two experiences to deliver information immediately and use it to solve problems faster is what drives new business value.”

Digital engineering tools help engineers collaborate, gain confidence in an evolving industry, and streamline time-consuming manual processes. With online sizing, selection, and configuration tools for measurement instrumentation, valves, actuators, fluid control, pneumatic and electrical solutions, engineers can confidently and accurately specify solutions for their unique requirements and process conditions. By employing
digital tools, engineers can configure instrumentation up to 93% faster, typically saving over 100 engineering hours annually.

For procurement professionals, MyEmerson includes access to online purchasing and supplier management resources. Once solutions are selected and configured by engineering counterparts, the information moves seamlessly to the procurement team – eliminating the need for manual handoffs and duplicate entry of model codes. Procurement personnel can then create requisition lists, generate quotes and automatically populate purchase orders. With greater visibility to order status and order history, procurement teams have access to the information they need to drive more efficient processes.

The MyEmerson development roadmap will centralize the management of software, hardware and workforce upskilling. With easier access to technical documentation, easier identification of device location, and the ability to initiate repair, replacement or service as needed, organizations gain maintenance and turnaround planning efficiencies. By moving from manual management of disparate software applications, updates and
licenses, users will be able to actively operate and maintain their software portfolio through a single-entry point. Both hardware and software records will be tightly integrated to relevant training, enabling trackable and accessible information in the same experience.

Emerson Automation Steps Up Digital Transformation Game

High Energy Exhibited At Manufacturing Software User Conference

This week saw the annual incarnation of the Ignition Community Conference from Inductive Automation in Folsom, CA focused on application of manufacturing software. The level of user conversations and idea exchanges is higher than anywhere else I attend.

I entered the building walking down the hallway amongst the exhibits of partner companies. Immediately the strength of MQTT, Sparkplug, and embedded Ignition stood out. The stands of OEMs Opto 22, Wago, EZAutomation, Moxa, Bedrock Automation, and Stratus Technologies swarmed with curious engineers.

MQTT is a light-weight messaging protocol that is now an open standard. Originally developed jointly by IBM and Arlen Nipper, now CTO of Inductive Automation partner Cirrus Link, MQTT is also widely deployed in IT applications.

Family obligations cut my stay, but I got a sense of what is important. Last year’s focus was Ignition 8, a major update to the core product. This year’s focus included the various aspects of the ecosystem that has sprung up through some patient nurturing by Inductive Automation executives.

Free training has been a hallmark. Examples cited included college student interns at customer sites taking the online class and then developing a significant application–all during their summer internship. It’s that easy to learn and develop.

Inductive has expanded its university partnerships for additional training and has also greatly expanded its international presence. Partnerships include a growing number of OEMs who package Ignition within products and systems integrators out solving interesting problems for their customers.

This is called the “Community Conference” because of the intense community of users.

By the way, customers often tell me that the product is rock solid, but what convinced them to change software suppliers–not an easy undertaking–is the innovative pricing model originally developed by founder (and president/CEO) Steve Hechtman. The model drives cost of ownership down for customers, and, while Inductive Automation is a private company and does not release financials, when I pump Steve for information, he smiles broadly.

Oh, and competitors are trying to find a way to compete with their pricing. That should be interesting.

Many, if not most, companies I cover are earnestly trying to build an ecosystem of partners. Inductive Automation patiently assembled an impressive one.

[Disclaimer: Inductive Automation is my major sponsor, but I’m not paid to be anything but my usual objective, analytical self observing the industry.]

Emerson Automation Steps Up Digital Transformation Game

Industrial Internet of Things to the Production Floor

Major IT companies have been scrambling to compete in the Industrial Internet of Things market. The control, instrumentation, and automation companies all talk about how this is all stuff they’ve been doing for years, or even decades, this is really quite new.

The first IT company people I talked with talked about selling boxes—gateways or edge computing. I’m thinking that there’s not enough money in that market. And, I was right. As the companies flesh out their strategies, the IoT group leadership keeps moving higher up the corporate ladder. And the vision broadens to include much of the portfolio of the companies enabling them to progressively enhance their competitive positions within their major customers.

Hitachi Vantara has recently been talking with me about their approach to the problem. I learned about Vantara and its focus initially through people I knew who landed new positions there. Life is always about serendipity. In the past, I’ve reported on the Lumada platform and the way the company is building modularly atop it. There was Maintenance Insights and then Video Insights. Now unveiled is Manufacturing Insights. I will get a deeper dive and talk to customers the second week of October when I attend its customer conference.

Note that these applications have more in common with MES than what you might think of as simply connecting devices with IIoT. In other words, the value proposition and integration into the customer grows.

Let’s discuss the latest addition to the Hitachi Lumada platform, Manufacturing Insights, which the company describes as a suite of industrial internet-of-things (IoT) solutions that empower the manufacturing industry to achieve transformative outcomes from data-driven insights. Using artificial intelligence (AI), machine learning (ML), and DataOps, Lumada Manufacturing Insights optimizes machine, production, and quality outcomes.

“Data and analytics have the power to modernize and transform manufacturing operations. But for too many manufacturers today, legacy infrastructure and disconnected software and processes slow innovation and impact competitive advantage,” said Brad Surak, chief product and strategy officer at Hitachi Vantara. “With Lumada Manufacturing Insights, customers can lay a foundation for digital innovation that works with the systems and software they have already to operationalize immediate gains in uptime, efficiency and quality and transform for the future.”

Accelerate Manufacturing Transformations

Lumada Manufacturing Insights applies data science rigor to drive continuous improvement opportunities based on predictive and prescriptive analytics. The solution integrates with existing applications and delivers actionable insights without the need for a rip-and-replace change of costly manufacturing equipment or applications. Lumada Manufacturing Insights supports a variety of deployment options and can run on-premises or in the cloud.

“With Hitachi Vantara, our customers benefit from our deep operational technology expertise and distinctive approach to co-creating with them to accelerate their digital journey,” said Bobby Soni, chief solutions and services officer at Hitachi Vantara. “With our proven methodologies and advanced tools, we can tailor solutions for our customers that enhance productivity, increase the speed of delivery, and ultimately deliver greater business outcomes.”

Providing machine, production and quality analytics, Lumada Manufacturing Insights drives transformational business outcomes by enabling customers to:

• Build on the intelligent manufacturing maturity model and empower the digital innovation foundation for continuous process improvement.

• Integrate data silos and stranded assets and augment data from video, lidar, and other advanced sensors to drive innovative new use cases for competitive advantage.

• Drive 4M (machine, man, material and methods) correlations for root-cause analysis at scale.

• Evaluate overall equipment effectiveness (OEE) and enhancement recommendations based on advanced AI and ML techniques.

• Evaluate scheduling efficiency and optimize for varying workloads, rates of production and workorder backlogs.

• Monitor and guide product quality with predictive and prescriptive insights.

• Improve precision of demand forecast and adherence to production plans and output.

Customer Comments

I hope to get more depth while I’m at the Next 2019 user conference Oct. 9-10. Here are some supplied quotes.

“Significant short-lead products have to be designed, prototyped and delivered to meet the demands of our customers and partners as we accelerate the product supply for 5G. Ericsson and Hitachi Vantara have collaborated to test Lumada Manufacturing Insights to gear up for an anticipated increase in new product introductions, establishing a digital innovation foundation for sustained gains,” said Shannon Lucas, head of customer unit emerging business for Ericsson North America. “We are leveraging the same solution that we will take to our joint customers in partnership with Hitachi Vantara, and will further expand IIoT use cases based on our 5G technologies.”

“As a progressive manufacturer, our focus was to accelerate transformative change, eliminate data silos and build a foundation for digital innovation that would accelerate our journey toward Manufacturing 4.0. “We leveraged the IIoT workshop to align our use cases with our business transformation priorities and have a roadmap for success with Lumada Manufacturing Insights,” said Vijay Kamineni, business transformation leader at Logan Aluminum. “The collaboration with Hitachi Vantara enables us to define business goals for each stage of our transformation, with clear outcomes that we believe will accelerate gains in productivity, quality, safety and sustainable manufacturing. “Hitachi Vantara brings a unique IT/OT advantage that will help us in the long run.”

“Humans and machines working together to deliver the vision of ‘digital drilling’ is driven by our ambition to achieve transformative outcomes, drilling our best wells every time and consistently achieving Target Zero for accidents. With Hitachi Vantara, we are realizing time to value with industrial analytics and the powerful Lumada platform to process more than 20,000 data streams per second per rig, providing actionable information to the right people at the right time and helping make optimal decisions. This drives our operational excellence and consequently our competitive advantage,” said Shuja Goraya, CTO at Precision Drilling Corporation. “We’re leveraging insights from video and lidar, integrating it with Lumada Manufacturing Insights to deliver business outcomes. It’s driving process optimization through effectively identifying improvement opportunities and shortening well delivery times for our customers. It’s all about effective use of data to make better decisions and then being able to consistently execute on these learnings. We are excited about our strategic partnership with Hitachi Vantara.”

Availability

Lumada Manufacturing Insights will be available worldwide Sept. 30, 2019.

Emerson Automation Steps Up Digital Transformation Game

Industrial Manufacturers Are Behind the Industrial IoT Innovation Curve

Sean Riley, Global Director of Manufacturing and Transportation at Software AG, discussed Industrial IoT (IIoT) implementation in industry with me a couple of weeks ago. Now, a survey sponsored by Software AG has been released revealing that manufacturers are not scaling IIoT across the enterprise due to failure to invest in predictive analytics and innovative integration strategies.

The shocking thing to me about the survey is that it mirrors survey results over the past three or four years. Executives and managers recognize a problem further even acknowledging that this is something that could cost them competitively against the market even putting them out of business. Yet, they cannot figure out how to do it right. They whine about how tough it is.

Sounds to me like a new crop of leadership is needed.

There are good practices taught some 40 years ago when I took a deep dive while implementing my first IT project. Things like understanding the system first. Bringing all the departments in on the plans, work to be done, and benefits we all would get. Some recommendations from Software AG sound that familiar—breaking silos, bringing IT and OT organizations closer together (a management problem, not a technical one), transparency in the project roll out.

The survey of over 125 North American manufacturers primarily in the heavy industry and automotive sectors revealed inability to scale IIoT investments across their enterprises results in losing millions of dollars in potential profits.

The survey also revealed that the vast majority of manufacturers queried report that their IIoT investments are limited – locked in one small department or sector of their company – preventing these organizations from sharing the power of IIoT across their enterprises.

Other key findings include:

  • 80% of all survey respondents agree that processes around IIoT platforms need to be optimized or they will face a competitive disadvantage but very few are doing this
  • IT-OT integration is considered one of the most difficult tasks – with 57% of automotive manufacturers stating that this has prevented them from realizing full ROI from their IIoT investments
  • 84% of automotive and heavy industry manufacturers agree that the most important area of IIoT is “monetization of product-as-a-service-revenue.” However, optimizing production is still important with 58% of heavy industry and 50% of automotive manufacturers agreeing with that statement
  • Curiously, defining threshold-based rules is considered almost as difficult as leveraging predictive analytics to scale IIoT. More than 60% of respondents stated that defining threshold-based rules was as difficult as integrating IT systems and IoT sensors into existing control systems.

“Manufacturers place a high value on IIoT, but they are encountering serious difficulties in unlocking the complete intended value to unleash their innovation across their organizations,” said Riley. “Fortunately, there is a way for them to quickly and easily resolve this problem. By investing in the right IT-OT integration strategy that leverages sensors, predictive analytics, machine learning, control applications, and product quality control, manufacturers can fix this problem in less than 6-12 months while realizing other key benefits, namely extended equipment lifetime, reduced equipment maintenance costs and accessing more accurate data for production-quality improvements.”

Riley outlined five best practices for manufacturers to follow when looking to scale their IIoT investments across their enterprises and realize immediate profits and competitive advantage. Those best practices are:

1. Ensure clear collaboration between IT and the business by leveraging a step by step approach that starts focused and has clear near term and long- term objectives to scale

2. Create a transparent roll out process and don’t let other plants or departments move ahead outside of it

3. Give IT the ability to connect at speed with a digital production platform that is proven to be successful

4. Leverage a GUI driven, consistent platform to enable an ecosystem of IT associates, business users and partners around the platform

5. Enable the plant or field service workers to work autonomously without continual support from IT through GUI driven analytics, centralized management and easy, batch device connectivity and management

Riley also stated that it is critically important for manufacturers to select the best possible IIoT integration platform supported by key enabling technologies like streaming analytics, machine learning, predictive analytics and a larger ecosystem. Software AG’s Cumulocity IoT platform recently received the highest use case scores from Gartner Group in the brand new “Critical Capabilities for Industrial IoT Platforms” report which included Monitoring Use Case, Predictive Analytics for Equipment Use and Connected Industrial Assets Use Case for its IoT.

The Software AG IIoT Implementation survey was completed in Q2 2019 by Software AG and an independent third-party research house. The survey queried nearly 200 respondents at large manufacturing companies across automotive, heavy industry, high-technology, electronics, pharmaceutical and medical device industries. The respondents were primarily senior executives leading Manufacturing or Information Technology with the breakdown of 50% Managers, 38% Directors and 13% Vice Presidents or higher.

Software AG product

The press release contained some information about the company’s IoT platform—Cumulocity.

Being device and protocol agnostic allows it to connect, manage, and control any “thing” over any network. Cumulocity IoT is open and independent, letting customers connect to millions of devices without being locked into one single vendor.

Follow this blog

Get a weekly email of all new posts.