The closed standards club: Who shapes vehicle cyber security?

Much like the IETF (Internet Engineering Task Force) standardised internet protocols to enable secure, interoperable networks, AUTOSAR (AUTomotive Open System ARchitecture) plays a similar role in the automotive domain — defining open software architectures that allow ECUs, cloud services, and embedded systems to work across brands and suppliers. The comparison is useful, but imperfect.

While the IETF was built on openness and academic collaboration, it wasn’t immune to dysfunction. Progress was often slow, and large corporations could flood working groups with delegates to sway consensus by volume rather than merit. AUTOSAR, by contrast, is more vertically integrated and industry-driven, with core members like BMW, Toyota, Ford, Bosch, and Continental shaping the roadmap. It delivers technical consistency, but with limited transparency.

Unlike the IETF, AUTOSAR offers few formal pathways for independent researchers, user communities, or public-interest advocates to influence its direction. The architecture of vehicle cybersecurity is being defined largely behind closed doors — by OEMs, Tier-1 suppliers, and select industry partners. What remains unclear is how individual users, fleet operators, or grassroots technologists can formally shape these standards, despite being the ones most exposed to their consequences.

Backend resilience: The new cyber security frontier

As highlighted in Part 2, backend systems have become the primary target. In 2024, more than half of automotive cyberattacks originated in cloud platforms — not the vehicle itself. The backend is now the perimeter. Once compromised, attackers can push malicious OTA updates, extract telemetry and user data, trigger remote immobilisation, and manipulate the behaviour of entire fleets.

To counter this, future protective controls must go beyond perimeter defence:

• Federated backend architecture: Segment cloud services by geography, function, or fleet type to contain breaches
• Policy-aware OTA gatekeeping: Require multi-layered validation and rollback triggers for critical updates
• Backend behaviour monitoring: Detect anomalous API calls and unauthorised data flows
• Decentralised trust anchors: Use hardware-based keys and multi-party attestation to prevent unilateral backend control

These measures shift backend security from passive infrastructure to active, policy-enforced resilience.

Data governance: A GDPR for vehicle telemetry

LAs vehicles collect increasing volumes of data — location, driving behaviour, biometric inputs — there’s a growing need for a telemetry governance framework. A GDPR-style model would include:

• Disclosure: OEMs must inform users what data is collected, where it’s stored, and for how long
• Consent: Users must be able to opt in or out of specific telemetry categories
• Access: Users should be able to view, export, and delete their data
• Auditability: Third-party verification of data handling practices

AUTOSAR’s recent emphasis on data lifecycle management and cloud-integrated diagnostics provides the technical foundation. What’s missing is enforceable policy and consumer-facing transparency.

Lessons from infotainment: Why OEMs can’t be trusted alone

OEMs spent years trying to build proprietary infotainment systems — and failed. Poor UX, limited app ecosystems, and lagging performance drove users to demand open standards. Today, most automakers are migrating to Android Automotive and Apple CarPlay — not by choice, but by necessity.

Cybersecurity is heading down the same path. Closed, opaque stacks may satisfy compliance, but they won’t earn trust. Without visibility, users can’t verify whether their data is protected — or exfiltrated.

Who should own vehicle security?

This is the strategic question. Should cybersecurity be:

• OEM-controlled: tightly integrated, but opaque and vendor-locked
• Third-party managed: modular, auditable, and user-configurable
• Consumer-empowered: with dashboards, alerts, and override capabilities

Each model has trade-offs. A hybrid approach may be the answer:

• OEMs provide baseline security and regulatory compliance
• Third parties offer modular enhancements
• Consumers gain visibility and limited control

This mirrors enterprise IT, where vendor security is complemented by user-level controls and independent monitoring.

Next frontier: Autonomous vehicles, aerial and ground drones and ETOL

As Electric Take-Off and Landing (ETOL) platforms and driverless cars scale beyond prototypes, the need for modular, replaceable security becomes urgent. These platforms:

• Rely on real-time telemetry and cloud orchestration
• Operate in mixed-regulation environments
• Carry passengers, cargo, and sensitive data
• Make autonomous decisions based on external inputs

AUTOSAR’s roadmap supports this evolution. Features like CANsec, Safe APIs, and Vehicle Data Protocols enable secure, modular integration across air and road platforms. However, the challenge remains: how to protect algorithmic intent, enforce telemetry boundaries, and maintain operational integrity — even in the face of partial compromise.

---