SANS Automotive Summit Webcast

Key Takeaways

hi this is Doug Wiley with the SANS Institute and it's my pleasure to be here with you today talking about our upcoming second automotive cybersecurity summit and training events our theme this year is smart vehicles and smart infrastructures and the event will take place May 1st through May 8th in Chicago this year we'll be continuing our conversation on the rapid move to new innovation technologies and capabilities that are affecting the automotive industry we'll be talking about autonomous vehicles and smart cities and the emergence of all this innovation that is beginning to affect not only the companies that that make smart vehicles but the consumers and the environment that they they all have to - of course exist in we've assembled a myriad of topics and some outstanding subject matter expert speakers who will be taking us through much of this material I'm very pleased to be joined by Kai Thompson who is this year's chair of the the summit and training event so with that I'd like to introduce Kai and we'll continue our conversation thanks Doug hi everyone this is Kai Thompson I'm a science instructor for ICS 515 so that's industrial control systems active defense and instant response and also work a German car manufacturer Audi as a neutral forensics and instant response Lee I've been with Audi for the past five years and before that I worked for 14 years in the steel industry and the reason for me to go over to the auto industry was actually this these profound changes happening in that industry so these just like three strikes of moving from gasoline engines to electric vehicles moving from old vehicles to smart fleets that you just hire or we just hitch a ride and of course two robots on wheels autonomous vehicles that are to me the most interesting thing of course being being a hacker and a nerd you love your robots on wheels yeah this this change that's happening right now in the auto industry and it's not only touching the auto industry but as we already say in the topic offer some it's more on vehicles and smart infrastructures this is touching everything that has to do with transportation especially with personal transportation and being part of this journey and being able to leave your footprints in this journey and how we do this and how we do these changes is to me really really interesting and really important that's why I wanted to join this industry great and Kaiser there's gonna be a variety of attendees to the summit itself you know we're expecting chief security officers and chief information security officers individuals that work in security operations centers even some developers and incident responders so I know as we look at the topics that we're going to be covering that we're gonna be having a mixture of both some deep technical conversations as well as some of the conversations around the standards and guidelines that are being adopted across industry and of course you know the the larger issues that every every organization in the automotive industry is grappling with so give us some thoughts about you know the keynote kickoff for instance and what we might expect from that this year I love to yeah yeah so Baron Giesler he was giving the keynote I've known him for most of my life and for the past thirty years he was one of the pioneers and bringing autonomous vehicle on the road and first of starting with with drivers assistant systems as we have to now at modern especially premium vehicles so Garonne was the the lead for autonomous driving an Audi for a number of years and then changed roles and went over to the supplier side of the industry and he's now working on on developing or running running divisions that develop autonomous systems to be put into giggles but as he'll point out is Ennis in his keynote of course this is a journey we don't go from Tribute of cars to fully autonomous vehicles overnight this is a journey and we'll live with a mixture and especially with vehicles that are remotely controlled at least some part of the time for a very long time and that that's actually what he's been working on for a couple of years already so these these touch phones will be part of this keynote which will bring us right into the whole journey that we're doing in this two-day summit like how do vehicles interact with the transportation environment so traffic lights parking spaces everything else you have as traffic system or transportation system in your city telling you when the next train will will arrive because you're moving from one transportation system to the other and then of course we have to know how to interact also with the larger environments your chart your electric vehicle charging systems as one example I already mentioned something like parking spaces and city infrastructures but also how do we make sure that the ways these systems interact are safe and secure so what's the framework for this what's the framework for assessing the risk that these different components bring onto each other so how do we go about that but also how do we respond to incidents in these environments some of this is probably as we all know all classical Incident Response we've been doing an IT for quite some time but these environments are more complicated and more interconnected and of course they're moving people so people might get hurt and we don't want that so this is a journey we all have to do together and we bring you together the different threads technology-wise planning infrastructure frameworks legal to move forward to understand ones in one another's constraints and language to move this forward into a journey that we have to take together yeah I know there's there's two particular topics that I'm especially looking forward to you know one one is relating to legacy vehicles and the fact that cars and other vehicles are on the road for such a long duration of their life and as technology continues to progress we know that we're gonna have this mixture of of old and new that has to has to co-mingle so the panel discussion around that is something that I'm really looking forward to and then and then likewise you know considering the evolution of the infrastructure itself and just talking about how we're starting to see more and more technology in the smart cities that are enabling these types of interactions amongst the vehicles that's that's also an area that I think is is really going to help pull this all together so Kai you know part of the event is much more than just the summit itself there will be training that's provided May 1st through May 6th and and there's four courses that we'll be offering this year so give us just a few thoughts around you know those four different courses and why they're relevant to somebody in the automotive industry sure love to so of course we started out with our Security Essentials boot camp seg 401 which I recommend to everyone who wants get to get to know the security landscape and the language that we I teach security guys talking and also the basic building blocks of IT security because I think yeah having this this common ground that everybody knows what we're talking about is really essential SEC 504 Heckert wells techniques exploits an incident handling is to me a very good starting point if you want to get deeper into what can actually happen to anything IT connected how do attacks work and how to do do we detect prevent or at least mitigate them so this is a great mixture of this is what an attack looks like this is how I offend against it or how at least detect it so the basic building blocks you you want to be actively defending your environment weather components they might contain network penetration testing and ethical hacking sex sex 560 yeah testing your products your IT environment and the interconnection between all these smart city vehicles leads infrastructure things will become more and more important we've been doing this at Olli for quite a while already we which has saying not only our IT environments but we run penetration tests that go all the way from the internet so we're back on right into the vehicle and sec v 6e is a very good class to learn about what we can get from pen testing how should we do it and how we should conduct it even if you're not running your own internal testing teams but hiring external people it's good to have a background in this class to just know what you can expect from pen testing know the lingo know how it works so the better shape your expectations and what you should be doing to guide pen testing and out of my favorite class for 508 advanced is old forensics into response and threat hunting which was actually the first size class I ever took myself if you want to get really deeply into how to detect advanced threats in your environment doing Incident Response or go hunting for these threats in your environment I think 508 is the best class there is and frankly if we look at how or where smart vehicle fleets will start at first these environments will be interesting targets to advanced threats because that's where you can make money as a criminal so getting your knowledge up in these kinds of things these two certain parts of the industries highly recommended to get started right now that's great guy Thanks thanks for that summary I mean we we have we have these for immersive training opportunities and then the summit to boot where people will have access and exposure to some of the leading such a subject matter experts in the field so very excited and to to be part of this and I do want to thank you Kai the time you've taken out today and hopefully we're gonna see everybody in Chicago for the summit and training event thank you very much duck yeah we need to go forward to the summit so looking forward to seeing you all in May in Chicago have a good time