Vehicle Security: Risk Assessment in Transportation
This work addresses security risks for policymakers and engineers in critical transportation infrastructure, but it is incremental as it applies existing risk assessment methods to vehicle networks.
The study tackled the problem of unknown vehicle security vulnerabilities in Intelligent Transportation Systems by identifying opportunities for adversaries to take control of the in-vehicle network, using a risk-based model to conduct a qualitative vulnerability-oriented risk assessment and aggregate individual risks to determine system-level risk.
Intelligent Transportation Systems (ITS) are critical infrastructure that are not immune to both physical and cyber threats. Vehicles are cyber/physical systems which are a core component of ITS, can be either a target or a launching point for an attack on the ITS network. Unknown vehicle security vulnerabilities trigger a race among adversaries to exploit the weaknesses and security experts to mitigate the vulnerability. In this study, we identified opportunities for adversaries to take control of the in-vehicle network, which can compromise the safety, privacy, reliability, efficiency, and security of the transportation system. This study contributes in three ways to the literature of ITS security and resiliency. First, we aggregate individual risks that are associated with hacking the in-vehicle network to determine system-level risk. Second, we employ a risk-based model to conduct a qualitative vulnerability-oriented risk assessment. Third, we identify the consequences of hacking the in-vehicle network through a risk-based approach, using an impact-likelihood matrix. The qualitative assessment communicates risk outcomes for policy analysis. The outcome of this study would be of interest and usefulness to policymakers and engineers concerned with the potential vulnerabilities of the critical infrastructures.