THE THREAT LANDSCAPE of connected vehicles and ITS integra>on in general. Sco$ CADZOW

Transcription

1 1 THE THREAT LANDSCAPE of connected vehicles and ITS integra>on in general Sco$ CADZOW

2 2 Your speaker? Sco$ CADZOW Expert and rapporteur for TETRA, ETSI s NGN, the Design for Assurance paradigm, the Privacy by Design paradigm He is the former chairman of the ETSI ITS Security group and also its counterpart in ISO TC Has been vice- chairman of ETSI Project TETRA WG6 (Security) and the TETRA Security and Fraud PrevenTon Group (SFPG) Has been vice- chairman of the ETSI Lawful IntercepTon group. Has contributed to ENISA reports on network resilience, supply chain integrity, and on measures to counter internet bullying. Is actve in the privacy debate as it applies to technology and telecommunicatons standards Is actve in a number of FP7 and H2020 projects as consortum member, expert and reviewer

3 The cyber car? 3 HFT2013

4 The networked car? 4 ETSI All rights reserved

5 Tradi>onal networks? 5

6 6 ETSI s C- ITS picture

7 7 Crash test dummy? Cyber crash test dummy?

8 Cyber crash test How do we give assurance that our e- features in our ITS works? Can we crash cars remotely? Can we re- route busses and trains? Can we falsify the data used for transport management? Who are we allowed to make the guinea pigs? Who is the test driver? 8 ETSI All rights reserved

9 9 Vehicle security? Euro- NCAP?

10 Why [not] CIA? Does the CIA paradigm fit to the networked car? Danger of being soluton led Encrypt, AuthenTcate, Validate the integrity of something Who are our Alices and Bobs? Vendor? Driver? Passenger? Local vehicles? Local infrastructure? Law enforcement? Road manager? LogisTcs manager? RouTng soaware? Who is our Eve? Vendor? Driver? Passenger? Local vehicles? Local infrastructure? Law enforcement? Road manager? LogisTcs manager? RouTng soaware? 10

11 11 Privacy and Ethics? ITS reveals behaviour Behaviour may be illegal Behaviour may inform hidden PII Who can act on the behaviour? Mike Pluke will look at this in much more detail

12 12 ITS to aid enforcement? Driving in the middle lane is illegal when the inside lane is clear ITS with geo- knowledge can encourage legal driving There is no Goldilocks lane! Speed limits are mandated maxima ITS with geo- knowledge can again encourage legal driving Society has evolved a casual relatonship to transport law Few other areas in society have such casual relatonships to the law ITS is a source of data that can aid proof of liability How is data made accurate enough? Is ITS data enough for provision of such proof?

13 echea>ng through ITS? Professional cycling devices use ANT+ to indicate power, cadence, speed, heart- rate and (soon) gear- changes Capturing a rival s data is (a) unethical, (b) the starter for cheatng Motorsport telematcs are transmi$ed from car to pit Capturing a rival s data is (a) unethical, (b) the starter for cheatng We test for drugs in sport when do we start to test for cybercheatng? Liability in accidents costs money and reputaton IncenTve is to ensure that ITS removes proof of liability Digital tachograph is used to record driver actvity and compliance IncenTve is to ensure the record proves compliance 13 ETSI All rights reserved

14 Digital tachograph an ITS implementa>on Records when a driver is driving and when restng Data has to be trusted as driver working hours and pa$erns are regulated Records locaton of the driver At start and end of a session, in debate over periodic locaton reportng Recording is local to the driver But it is the driver who is regulated, the driver and his employer who have an incentve to falsify the data Is on- vehicle recording the best means of enforcement? 14 ETSI All rights reserved

15 ITS or IVS? Intelligent TRANSPORT Systems Transport is not just cars but also trains, trams, boats, planes, bikes, pedestrians Transport moves things: goods, people Intelligent transport needs to ask why we are moving things Too easy to simplify ITS to Intelligent Vehicle Systems Very simply ITS is not IVS, but ITS may leverage IVS The real goal is to achieve wide- area trusted intelligent integrated societal transport systems 15 ETSI All rights reserved

16 ITS and smart city? Smart city needs data to work What is happening where? when? ITS is a data source ITS is a data consumer Which ITS? For public transport planning? For logistcs planning? For safety enforcement? For legal enforcement? All of them for all societal purposes 16 ETSI All rights reserved

17

18 18

19 19

20 20

21 The changing privacy landscape? MoneTsaTon of PII PII has always been a valuable commodity PII is now a traded commodity The traders may be the beneficiaries but may have limited liability relatonships to the PII owner PII is pervasive and large Data sets and behaviours are possibly bigger, certainly more visible than in the past Data doesn t die it lingers (hard to kill off or deny) Is ITS data part of PII? Yes and it will have monetary value 21

22 22 Common security solu>ons Secrecy Don t let anyone know what you re doing Containment Once the a$acker is in the system and commi$ed a crime keep them locked in the system Intrusion detecton Find out when an a$acker is in the system (before damage occurs) Access control (restricton) Only allow known partes into the system And on and on

23 23 How secure are we? A safe is rated by the number of hours it takes to break the lock Without the key With knowledge of the locking mechanism So we should rate our security in terms of risk What is the risk if our identty leaks? our conversaton is overheard? our credit card details are corrupted? our lives change? But what is the metric for privacy?

24 24 Trust as root of privacy? Human nature builds trust over Tme BFFs don t appear at first sight Privacy is contextual We keep it in the family, we keep it in the workplace, we leave it on the sportsfield People move between contexts Should trust established in one context move with us? Who do I trust with my ITS generated PII?

25 25 Privacy protec>on measures Anonymity Ensures that a user may use a resource or service without disclosing the user's identty Pseudonymity Ensures that a user may use a resource or service without disclosing its user identty, but can stll be accountable for that use Unlinkability Ensures that a user may make multple uses of resources or services without others being able to link these uses together Unobservability ensures that a user may use a resource or service without others, especially third partes, being able to observe that the resource or service is being used

26 Summary ITS is complex ITS is mult- variable ITS is mult- sector My concerns: ITS is stll a long way from Intelligent ITS is stll very silo- ed My hopes: Industry has recognised the role of standards Industry has begun the debate on privacy and trust in ITS as a societal tool 26 ETSI All rights reserved

27 27 Acknowledgements SUNSHINE This project is par.ally funded under the ICT Policy Support Programme (ICT PSP) as part of the Compe..veness and Innova.on Framework Programme by the European Community (hcp://ec.europa.eu/ict_psp). i- Tour The research leading to these results has received funding from the European Commission s Seventh Framework Programme (FP7/ ) under the Grant Agreement number The authors are solely responsible for it and that it does not represent the opinion of the Commission and that the Commission is not responsible for any use that might be made of informaton contained therein. i- SCOPE The project has received funding from the European Community, and it has been co- funded by the CIP- ICT Policy Support Programme as part of the CompeTTveness and innovaton Framework Programme by the European Community (h$p:// ec.europa.eu/ict_psp), contract number The author is solely responsible for it and that it does not represent the opinion of the Community and that the Community is not responsible for any use that might be made of informaton contained therein

28 28 Ques>ons