Are we building cyber vulnerability into EV charging infrastructure? – GCN.com




peterschreiber.media/Getty Images
Sign up for our newsletter

Stay Connected
By Chris Teale
Electric vehicle (EV) charging stations are vulnerable to hacks that could disrupt the grid or steal users’ personal information, and without significant technology upgrades, regulations and standards, the effects could be dramatic.
A recent study from the Sandia National Laboratories outlined the scale of the potential issues, adding to similar alarms raised by other academic researchers. Sandia’s study said hackers could access charging stations to overload the grid, or shut down a station by making it think it has drawn all the energy it needs.
The cloud services used to manage charging stations could also be vulnerable to hacks, especially if software is not kept up to date. Criminals could also use credit card skimmers to steal drivers’ personal information, as they do now on standard gas pumps. There are also concerns that the chargers themselves could be hijacked and be used to display inappropriate content.
With EV companies trying to quickly ramp up their vehicle and charging options amid a nationwide push to electrify transportation, observers said that cybersecurity doesn’t get appropriate attention.
“Right now, there’s a bit of a Wild West mentality out there,” said Kayne McGladrey, field chief information security officer at security software company Hyperproof and a senior member of the Institute of Electrical and Electronics Engineers. “Companies are incentivized for being first to market, not necessarily most secure to market. Because security costs money and because it requires time and resources, naturally that becomes a lower priority.”
EVs themselves have already been shown by researchers to be vulnerable to attack, but the cybersecurity of charging infrastructure has flown under the radar until relatively recently.
At a forum last month hosted by the Office of the National Cyber Director at the White House, leaders in government and the EV industry agreed to work together to assess current cybersecurity standards associated with EVs, what else is needed to keep the ecosystem safe and the state of research and development in this area. Participants also pledged to work together and “identify opportunities for harmonization,” according to a White House readout of the meeting.
States are starting to think harder about cybersecurity too. In its August 2022 state plan for EV infrastructure deployment, the Michigan Department of Transportation (MDOT) said risks “continue to intensify” as the technology advances, but it put the onus on its third-party vendors to be responsible for cybersecurity.
MDOT said it would update its procurement process to ensure cybersecurity and privacy requirements are met. The plan comes as Michigan invests heavily in EV infrastructure, including through a network of chargers and the first public road that charges EVs as they drive on it.
Separately, vendors applying for federal National Electric Vehicle Infrastructure (NEVI) funding will be required to submit a cybersecurity plan that includes “an understanding of high-level security and privacy practices, including physical and technological solutions, in place to protect the chargers and data from cyberattacks,” according to the state plan.
To bolster the cybersecurity of EV charging infrastructure, McGladrey called on companies to invest more in upgrading their hardware and software and conduct regular penetration tests to assess their security. Currently, McGladrey said too much infrastructure relies on wireless networks that connect to the internet and deliver over-the-air updates, so a more secure alternative is needed.
The White House’s labeling system for internet of things (IoT) device cybersecurity could also serve as a roadmap to help rate how resilient EV chargers are in the face of threats, McGladrey said.
Beyond simply upgrading existing technology to improve cybersecurity, others suggested that security be integrated into new software and hardware from the beginning. Jillian Goldberg, chief revenue and investment officer at automotive security company GuardKnox, called that approach “security by design,” adding that it would help build more trust in charging infrastructure, whose vulnerabilities are well known and may be slowing deployment.
“I like to say, if I gave you a car and said, your brakes are going to work 99% of the time, are you going to drive that car? Probably not,” she said. “If I’m going to give you a charging station and say this will be secure 99% of the time, are you going to use that charging station? Probably not.”
 As well as upgrading EV charging technology regularly, McGladrey said regulators worldwide should work to have as much of the infrastructure as standardized as possible, so that it is interoperable and provides at least a minimum standard of protection in both the hardware and software to prevent attacks. Vendors applying for NEVI funding, for example, will be required to meet minimum standards and requirements, part of an effort the federal government believes will help ease cybersecurity concerns.
In Singapore, vendors must follow cybersecurity guidelines for IoT devices sold and used in the country — a good model for EV infrastructure, McGladrey said, as it incentivizes manufacturers to follow those rules if they want to be able to sell their products. 
Leading nations like the United States, United Kingdom, Canada and Australia could even partner on cybersecurity standards for EV infrastructure, he said. There are differences in models, but manufacturers in those countries are essentially “selling the same kit,” he added.
Standards can also help governments respond to attacks. If there were a common infrastructure or software for EV charging, technologists could quickly assess the damage, regardless of the manufacturer.
“The idea is that even if you are a small cog in a giant machine, you still need to know how the whole machine operates, so that you know exactly what the implications of flaws in the other parts may be,” said Sunil Chhaya, a senior technical executive at the Electric Power Research Institute, during a Nextgov webinar earlier this year.
The International Organization for Standardization has already taken steps toward EV charging security standards by specifying terms and definitions and general requirements. And domestically, the National Institute of Standards and Technology has held many conversations on the topic of standardization. A NIST spokesperson did not respond to requests for further comment.
As the rollout of EV charging infrastructure continues, both McGladrey and Goldberg said they are skeptical that cybersecurity will be seen as a priority until there is a major cyberattack — which Goldberg called a “black swan event” — that forces companies to reassess their priorities.
NEXT STORY: Ransomware response requires better federal, state, local coordination
Do Not Sell My Personal Information
When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.
Manage Consent Preferences
Strictly Necessary Cookies – Always Active
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data, Targeting & Social Media Cookies
Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link
If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.
Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings

Cookie List
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
Strictly Necessary Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Functional Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Performance Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Social Media Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Targeting Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Help us tailor content specifically for you:

source


CyberTelugu

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top