How to handle the ever-increasing threat for Fleet Managers: Cyber Attacks
With the exponential growth of in-vehicle technology and the expansion of the connected car, fleet managers could be facing an increasing challenge in protecting their fleet as increased connectivity is providing various attack opportunities to cybercriminals.
Phishing attacks accounted for more than 80% of cybersecurity incidents in 2020, wihile the average cost of a ransomware attack increased to 133.000 dollar. In a chaotic security environment where 77% of the organizations don’t even have a cyber attack response plan, vehicle fleet managers have to study their lesson carefully as the era of IoT closes in.
By 2025, the IoT market is expected to include 75 billion connected devices. A large part being installed on fleets and traffic systems. The complexity and homogeneity of networks and the vast amounts of data will lure cybercriminals to attack vehicle fleets worldwide, as fleet cars will turn into mobile data banks filled with interesting and sensitive information.
How can a fleet car be infiltrated?
One of the devices cyberattackers would try to infiltrate is electronic logging devices (ELD). Hacking one of these devices would result in the loss of sensitive data that is shared among the fleet, companies and regulatory bodies. Cybercriminals can also infiltrate electronic units (ECUs) which are interconnected by Controller Area Network (CAN bus). Dozens of ECUs in cars will provide improved real-time data gathering through IoT, AI and cloud computing, increasing efficiency in fleet telematics while reducing costs. On the other hand, if telematics servers come under attack, electronic systems of a car can be infiltrated and malware can be uploaded to the vehicles.
A successful attack will result in the theft of data belonging to fleets, drivers, clients, corporations and industry partners. Not only could lead the attack to severe downtime and lost revenue for a company, but stolen information may also trigger waves of phishing and ransomware attacks, which would result in catastrophic financial losses, disruption in operations and damage to brand reputation. Additionally, cyber attacks may result in severe fines under regulations such as GDPR, due to privacy issues.
What are the actions fleet managers must take?
The potential of threats targeting cars is well-known. Already back in 2015, security researchers hacked a Jeep Cherokee with a laptop 15 kilometres away and found the same exploit in 2.700 other vehicles in the same network. In 2019, a hacker managed to track more than 20.000 vehicles by hacking two applications used by companies to monitor and manage their fleets. So, it's better to be cautious and prepared, and take action where possible.
There are four main steps for fleet managers to provide security for their fleets:
- Using constantly updated cyber-security software;
- Providing employee training to prevent phishing attacks;
- Controlling who has access to the vehicles;
- Preparing a fleet specific cyber threat response plan to be ready for any scenario.
Ensuring fleet security will require several more steps and partnering with IT and security experts will be critical to creating a reliable ecosystem.
Author: Müfit Yılmaz Gökmen
