VPTaaS: Cyber Penetration Test as a Service for Future Vehicles

汽车行业正面临着日益严重的网络犯罪威胁，2015年因安全问题召回了140万辆汽车，2020年6月因勒索软件攻击导致北美工厂停产。因此，汽车制造商和车主必须采取积极主动的措施来保护他们的车辆免受网络威胁，例如实施强大的安全措施和程序，定期进行网络健康检查作为车辆服务的一部分，并进行渗透测试。然而，当前的渗透测试服务通常具有不完整的覆盖、有限的测试环境、时间限制、高成本、误报和误报以及有限的测试范围。为了满足这一需求，该提案提出了专门针对车辆的渗透测试即服务（VPTaaS），旨在检测和响应车辆内部和周围的网络安全事件，包括收集和分析日志事件数据，响应安全事件以及调查异常的根本原因。此外，VPTaaS将提供有关网络安全和软件更新实践及其各自行业标准的实施支持、评估、认证和认证服务，以及鼓励白帽黑客报告他们发现的漏洞的激励和奖励计划。

The automotive industry is facing an ever-growing threat from cybercrime, as evidenced by the 1.4 million vehicles recalled in 2015 due to security-related issues, and the halt in production across North American plants in June 2020 due to ransomware attacks. Thus, it is essential for vehicle manufacturers as well as vehicle owner to take proactive steps to protect their vehicles from cyber threats, such as implementing robust security measures and procedures, performing periodic cyber health-checks as part of vehicular servicing, and conducting penetration testing.However, current penetration testing services often have incomplete coverage, limited testing environments, time constraints, high costs, false positives and negatives, and limited scope of testing. To address this need, this proposal puts forth a Penetration Test as a Service (VPTaaS) specialized only for vehicles, designed to detect and respond to cybersecurity events in and around vehicles, including the collection and analysis of log event data, responding to security events, and investigating root causes of anomalies. Additionally, VPTaaS will offer implementation support, assessment, attestation, and certification services with respect to cybersecurity and software-update practices and their respective industry standards, as well as incentive and reward programs to encourage white-hat hackers to report vulnerabilities they discover.