trusted access to an organization’s internal networks and data.

Turnaround and transformation
in cybersecurity: Automotive
Key findings from The Global State of
Information Security® Survey 2016
Cybersecurity has become a driving
issue for automotive organizations
as security incidents accelerate
and a combination of new risks
associated with product lifecycle
management, supply-chain
partners, consumer privacy and
connected vehicles are introduced.
Many automotive organizations
are responding by taking action
to bolster their cybersecurity
capabilities, according The Global
State of Information Security®
Survey 2016. They are strengthening
their cybersecurity posture by
implementing technologies such
as cloud-based cybersecurity,
Big Data analytics and advanced
authentication. What’s more, the vast
majority—92%—has adopted riskbased cybersecurity frameworks to
help guide their corporate internal
information security road map.
Another sign of progress is a
renewed willingness to bolster
security spending. After a decline
last year, automotive organizations
boosted their information security
budgets by 54% in 2015.
On-ramp to the Internet
of Things
The connected automobile is rapidly
becoming a high-profile example
of the Internet of Things (IoT)
technology. In fact, automotive
organizations are already deeply
involved in technologies and
services that link vehicles to their
operational and IT systems.
This year, 58% said they produce or
sell telematics products or services,
and 65% are involved in connected
vehicle diagnostics. While the extent
of potential risk of proof-of-concept
exploits on connected automobiles is
not yet known, the survey found that
security compromises to components
that underpin the IoT—including
operational systems, embedded
devices and consumer technologies—
more than doubled in 2015.
More than two-thirds (69%) of
survey respondents have an IoT
security strategy in place or are
implementing guidelines. Almost
three-quarters (73%) have a plan to
mitigate a breach of user telematics
data, and 71% perform regular
assessments of suppliers that have
access to telematics information.
Addressing threats
from within
Employees are, by a long shot, the
leading source of compromise. They
are not the only source of rising
insider threats, however. This year,
more than two-thirds of respondents
attributed security incidents to
business partners such as supply
chains and resellers, which often have
trusted access to an organization’s
internal networks and data.
Many automotive organizations are
leveraging Big Data analytics built
on cloud architecture to monitor for
suspicious user activity and address
these insider threats. Among the 63%
of organizations that employ Big Data
to improve cybersecurity practices,
respondents said analytics has
enhanced understanding of internal
security threats and improved visibility
into anomalous network behavior—
capabilities that are essential to
combatting insider compromise.
As the volume of information surges,
organizations are shifting more data
to cloud providers, and many are
linking analytics with sophisticated
cloud-enabled cybersecurity services.
Three-quarters of respondents
already use cloud-based cybersecurity
services like real-time monitoring
and analytics, identity and access
management, which can help identify
and respond to insider incidents.
Intensifying regulatory
scrutiny
Governments around the world have
established legal measures that allow
testing of autonomous automobiles
on public roads.1 Next, they will begin
to establish laws and regulations that
govern use of self-driving vehicles as
well as telematics and communications
data. The potential for new regulatory
oversight is a key concern for
many automotive executives.
Organizations should prepare
by closely following regulatory
developments in order to update
internal compliance controls,
processes and monitoring capabilities.
It’s also worth noting that survey
respondents mentioned that
increased Board participation in
cybersecurity issues has improved their
regulatory compliance programs.
1 UK Department for Transport, The Pathway for Driverless Cars, February 2015
How automotive organizations are responding
to rising cyber-risks
115%
35%
Internal records remains one of the top
targets of cyberattacks with compromises
increasing 35% in 2015.
In 2015, the number of detected
security incidents more than doubled
over the year before.
The number of respondents who attributed security
incidents to employees climbed over the year before,
while those who cited former service providers/
consultants/contractors showed the greatest increase.
37%
41%
35%
39%
33%
30%
30% 30%
21%
2014
2015
Current
employees
Former
employees
Hackers
Competitors
Many organizations are implementing strategic
initiatives—such as risk-based frameworks and cloud-based
cybersecurity—to improve security and reduce risks.
75%
66%
Risk-based Cloud-based Formally
security cybersecurity collaborate
framework
with others
63%
61%
Big Data Cybersecurity
analytics
insurance
54%
25%
Former
service providers/
consultants/
contractors
92%
After a double-digit decline last year,
respondents boosted their information
security budgets by 54% in 2015.
-24%
Estimated financial losses as a
result of all security incidents
dropped 24% over the year before.
Automotive organizations are investing in core
safeguards to better defend their ecosystems
against evolving threats.
59%
58%
56%
Have an overall
security strategy
Have security
baselines/standards
for third parties
Have a CISO in
charge of security
55%
51%
42%
Conduct threat
assessments
Employee security training
& awareness program
Active monitoring/
analysis of
security intelligence
For a deeper dive into the
Rik Boren
Larry Wiggins
2016 Global State Information
Partner, Cybersecurity and Privacy
Director, Cybersecurity and Privacy
Visit
to explore the data further
Security Survey findings
go www.pwc.com/gsiss
to
[email protected]
[email protected]
pwc.com/gsiss or contact:
Source: PwC, CSO, CIO, The Global State of Information Security® Survey 2016, October 2015
© 2015State
PwC. All
reserved.Security®
PwC refers to
the US2016,
member
firm or one
of its subsidiaries or affiliates, and may sometimes refer to the PwC network.
Source: PwC, CSO, CIO, The Global
of rights
Information
Survey
October
2015
Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. 71224-2016.km
© 2015 PricewaterhouseCoopers LLP, a Delaware limited liability partnership. All rights reserved. PwC refers to the United States member firm, and may sometimes refer
to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. 76502-2016 JP