U.S. DOT issues Federal guidance to the automotive industry for improving motor vehicle cybersecurity

　こんにちは、丸山満彦です。米国国家道路交通安全局（NHTSA - National Highway Traffic Safety Administration）が自動車のサイバーセキュリティのガイドをだしていますね・・・パブコメ募集中です・・・

　
■NHTSA - National Highway Traffic Safety Administration
・2016.10.24 U.S. DOT issues Federal guidance to the automotive industry for improving motor vehicle cybersecurity
　　・・Cybersecurity Best Practices for Modern Vehicles

1 Purpose of This Document
2 Scope
3 Background
4 Definitions

5 General Cybersecurity Guidance
　5.1 Layered Approach
　5.2 Information Technology Security Controls

6 Automotive Industry Cybersecurity Guidance
　6.1 Vehicle Development Process With Explicit Cybersecurity Considerations
　6.2 Leadership Priority on Product Cybersecurity
　6.3 Information Sharing
　6.4 Vulnerability Reporting/Disclosure Policy
　6.5 Vulnerability / Exploit / Incident Response Process

　6.6 Self-Auditing
　　6.6.1 Risk Assessment
　　6.6.2 Penetration Testing and Documentation
　　6.6.3 Self-Review

　6.7 Fundamental Vehicle Cybersecurity Protections
　　6.7.1 Limit Developer/Debugging Access in Production Devices
　　6.7.2 Control Keys
　　6.7.3 Control Vehicle Maintenance Diagnostic Access
　　6.7.4 Control Access to Firmware
　　6.7.5 Limit Ability to Modify Firmware
　　6.7.6 Control Proliferation of Network Ports, Protocols and Services
　　6.7.7 Use Segmentation and Isolation Techniques in Vehicle Architecture Design
　　6.7.8 Control Internal Vehicle Communications
　　6.7.9 Log Events
　　6.7.10 Control Communication to Back-End Servers
　　6.7.11 Control Wireless Interfaces

7 Education
8 Aftermarket Devices
9 Serviceability