Simulating and Evaluating Incident Response for Automotive Systems

### Overview With connected vehicles increasingly exposed to cyber threats—highlighted by recent events such as the Upstream report noting 409 incidents (92% remote) and the CARIAD/Volkswagen data breach disclosure at the Chaos Communication Congress affecting over 800,000 vehicles—automotive organizations must shift their mindset from *if* an incident occurs to *when*. Presenters Felix Boing and Sergey Va argue that product security must adopt preparedness techniques proven in military war games, IT disaster recovery, and fire drills. Specifically, the automotive sector needs structured ways to simulate and evaluate incident response rather than relying purely on passive documentation or compliance checklists.

### Key Topics The speakers outline three primary approaches to incident exercises, balancing effort against realism: 1. **Tabletop Exercises**: Low effort, low realism. These are transparent, discussion-based walkthroughs where facilitators guide teams through playbooks, emergency plans, and tactics, techniques, and procedures (TTPs). They serve as a low-cost starting point to establish baseline process awareness. 2. **Incident Simulations**: Balanced effort and realism. Considered the "sweet spot" for continuous readiness, these exercises take place within the actual process setting with only selected stakeholders aware. Facilitators introduce realistic stimuli and operational stressors. 3. **Red Teaming**: High effort, high realism. Realistic offensive engagements mirroring external threat actors. While offering authentic testing, red teaming requires extensive reconnaissance, specialized skills across hardware and protocols, significant time (weeks to months), and suffers from limited observability into internal defender workflows.

The exercises involve three core roles: - **Red Team**: Offensive security executing vulnerability exploitation and compromise. - **Blue Team**: Defensive personnel mitigating threats and executing incident response. - **White Team**: Neutral facilitators coordinating the playbook, maintaining rules of engagement, injecting stressors, and documenting observations.

### Technical Details & Playbook Design Simulations rely on structured playbooks defining triggers, participant boundaries, metrics, and evaluation criteria: - **Stimulus & Intake Evaluation**: In a technical baseline example, an external researcher submits a Remote Code Execution (RCE) vulnerability report alongside a proof of concept. The exercise tracks the incident intake process across the Vehicle Security Operations Center (VSOC) manager, software platform manager, and VSOC analysis team. - **Containment & Scope Management**: To prevent unnecessary engineering costs, specific stakeholders (such as the platform manager) are pre-notified so developers do not spend resources writing actual fixes for simulated bugs. - **Metrics**: Key measurements include external reachability (availability of contact points such as `security.txt` or website forms), intake response time, stakeholder notification coverage, and triage accuracy (evaluating whether the RCE's severity is classified correctly). - **Resilience Tweaks & Stressors**: Scenarios can be adapted to test real-world friction, such as receiving non-technical complaints from an angry customer reporting sensitive infotainment data, key personnel being absent (e.g., manager on vacation), or legacy ECU support where the original engineering team has moved on to newer vehicle architectures.

### Takeaways - **Move Beyond Passive Compliance**: Standard audits under frameworks like ISO/SAE 21434 often only verify written incident plans or tracking spreadsheets; live simulations prove whether the capabilities actually function in practice. - **Address the Tier Supplier Blind Spot**: While OEMs are typically at the forefront of public vulnerability disclosures, Tier 1 and Tier 2 suppliers often lack dedicated incident response readiness for product security despite being reliant on OEM handoffs. - **Practice Delivers Competence**: Discussion-based tabletops are ideal for initial orientation, but regular incident simulations (recommended at least semi-annually, echoing guidance from Germany's BSI) provide the optimal cost-benefit ratio for training, verifying process efficiency, and removing organizational blind spots.