CIO Review APAC

Understanding Vehicle Type Approval: The importance of expertise in automotive cybersecurity

CIO Review APAC | Monday, January 15, 2024

In this second installment of our series on automotive cybersecurity, we delve deeper into the strategic approach to regulatory compliance, focusing on Vehicle Type Approval (VTA) and its challenges.

Until five years ago, carmakers were hesitant to introduce cybersecurity measures in vehicles despite being aware of their necessity due to cost issues.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

However, when the European Union introduced cybersecurity regulations in 2022, it became virtually impossible to enter the European market without meeting the new standards. The change has made cybersecurity an essential element to ensure the survival of carmakers.

The advancements in vehicle software, diversification of vehicles’ functions and increase in communication have made software-defined vehicles (SDVs) a hot topic for the car industry, and cybersecurity is the final element in building SDVs.

The fact that UNECE WP.29 adopted UN Regulation No. 155 (UN R155) in June 2020 to lay the foundations for the cybersecurity ecosystem is widely known.

1. CSMS and ISO/SAE 21434

The core of UN R155 is that carmakers need to obtain a cybersecurity management system (CSMS) and vehicle type approval. CSMS refers to the process and management system for protecting vehicles from cyberattacks and managing cybersecurity risks. ISO/SAE 21434 is the international engineering standard for vehicle cybersecurity that defines the cybersecurity policies and processes throughout all phases of a vehicle’s development, production and postproduction, and sets the standards for CSMS.

The UN R155 outlines its aims, while the ISO/SAE 21434 provides the requirements and details about assessment standards. In other words, ISO/SAE 21434 is essential to properly implement CSMS.

2. Understanding VTA's purpose and requirements

As previously explained, the Cyber Security Management System is integral to protecting road vehicles against cyberthreats. The VTA process begins with the technical service (TS) evaluating the automaker's technical documentation and conducting initial vehicle tests. Following TS approval, the approval authority (AA) issues a final CSMS certificate following its own review. VTA ensures each vehicle adheres to the prescribed cybersecurity standards, with both TS and AA validating the implementation.

VTA necessitates comprehensive risk assessment, effective cybersecurity measures, and thorough validation testing. This includes identifying risks to road vehicles and determining the adequacy of the risk management strategy, which could involve removal, improvement, avoidance, or acceptance of risks. The specifics of these cybersecurity measures are detailed in UN Regulation No. 155 (UN R155) Articles 5 ("approval") and 7 ("specifications"), with the specific testing protocols outlined in ISO/SAE 21434.

3. Conducting cybersecurity testing for VTA

The ISO/SAE 21434 outlines a four-step validation process for road vehicles: functional testing, vulnerability scanning, fuzzing testing and penetration testing. Each step has a specific focus, from verifying the operation of cybersecurity elements to actively simulating attacks to identify potential vulnerabilities. The type of testing required for each Electronic Control Unit (ECU) is determined by its Cybersecurity Assurance Level as specified in Annex E of ISO/SAE 21434, shown in the table below:

4. Key insights of VTA and FESCARO's expertise

Ensuring the correct setup and application of cybersecurity measures is crucial for the safety of ECUs and vehicles. FESCARO emphasizes a comprehensive approach, integrating threat analysis and risk assessment (TARA), robust cybersecurity solutions, rigorous testing, and effective cybersecurity control management.

FESCARO’s success story with an internationally renowned automaker highlights the importance of choosing a competent cybersecurity partner. During a recent penetration test for a world-renowned automaker, we identified a critical issue in an electric vehicle's powertrain system -- when tested in motion, the drivetrain failed and the gas pedal became unresponsive. Our team of experts swiftly reported this issue to the automaker, and after a thorough review, we successfully applied a cybersecurity patch to resolve the problem.

5. Essential takeaway from VTA experience

The essence of VTA lies in thorough verification and validation of cybersecurity measures. This process must be both rigorous and continuous in order to prevent unforeseen cybersecurity events.

FESCARO's three-year journey underscores the importance of exhaustive testing and consistent technology application. Real-vehicle testing is critical for comprehensive validation as stipulated in UN R155. Our strategy for successful VTA includes meticulous TARA documentation, extensive ECU testing, real-life vehicle trials, comprehensive VTA evaluation checklists, and seamless integration of cybersecurity testing with IT infrastructure.

In our next article, we will explore the final step of automotive cybersecurity certification: SUMS certification, and discuss the prerequisites for achieving it.

[Ku Seong-seo, Fescaro head of global business sales at fescaro.com ]

Fescaro is a vehicle cybersecurity specialist that has gone through all major certification processes (CSMS, ISO/SAE 21434, VTA, SUMS). It is the only company in Korea to have obtained what is referred to in the field as the "grand slam of vehicle cybersecurity certification consulting.” - Ed

 

More in News

In today's data-driven environment, leveraging the appropriate metrics is essential for the success of any digital marketing campaign. These metrics offer critical insights into campaign performance, enabling businesses to effectively make informed decisions, optimize strategies, and achieve their marketing objectives. Understanding and leveraging critical digital marketing metrics is crucial for optimizing campaigns and driving business success. These metrics can be broadly categorized into website performance, engagement, and cost-efficiency. Website performance metrics include overall website traffic, segmented by source, and insights into user behavior, such as new versus returning visitors, session counts, and average session duration. Page views and identification of the most visited pages help gauge content popularity, while exit and bounce rates indicate potential areas for improvement. The conversion rate, representing the percentage of visitors completing a desired action, is a critical measure of website effectiveness. Engagement metrics focus on social media and email marketing. Social media metrics like reach, impressions, engagement rate, follower growth, and brand mentions reveal how well content resonates with the audience. In email marketing, the open rate, click-through rate (CTR), and conversion rate are vital indicators of campaign success. Cost-efficiency metrics assess the financial performance of digital marketing efforts. These include cost per click (CPC), cost per lead (CPL), and cost per acquisition (CPA), which measure the expenses associated with generating clicks, leads, and customers. Return on investment (ROI) and return on ad spend (ROAS) provide a comprehensive view of the profitability of marketing campaigns. Advanced Metrics for Maximizing Impact and Driving ROI Today, organizations must move beyond basic metrics to gain deeper insights into their performance. Key metrics like "Time on Page," "Pages per Session," and "Scroll Depth" provide valuable information on user engagement and content consumption. Tools such as click maps and heatmaps further enhance understanding by visually representing user interactions highlighting areas of interest and disinterest. For e-commerce, advanced metrics like "Average Order Value (AOV)," "Customer Acquisition Cost (CAC)," "Customer Lifetime Value (CLTV)," and "Churn Rate" are essential for understanding customer behavior and optimizing revenue. In the realm of social media, metrics such as "Share of Voice," "Sentiment Analysis," "Influencer Marketing Metrics," and video performance indicators offer a comprehensive view of brand visibility and engagement. Email marketing, too, can be refined through metrics like "Click-to-Open Rate (CTOR)," "Unsubscribe Rate," "List Growth Rate," and "Email Deliverability," ensuring that campaigns are both practical and targeted. Cost-efficiency metrics, including various attribution models like single-touch, multi-touch, and data-driven attribution, are crucial for determining the effectiveness of marketing efforts. Beyond traditional ROI, businesses should also consider profit margin, breakeven analysis, and marketing mix modeling to understand their strategies' financial impact fully. Advanced tools such as user experience (UX) metrics, predictive analytics, and data visualization are invaluable for measuring satisfaction, forecasting trends, and simplifying complex data. These tools and metrics are often encapsulated in key performance indicators (KPIs) that align with specific business goals, such as increasing website traffic, achieving higher conversion rates, or reducing customer acquisition costs. To evaluate and improve digital marketing campaigns effectively, it is essential to set clear goals, select relevant metrics, and establish benchmarks. Regular performance tracking and data analysis enable businesses to make informed, data-driven decisions. Businesses can continuously optimize their marketing strategies by iterating and refining campaigns based on these insights. ...Read more
Risk management is a crucial practice in many industries. Its primary objective is to identify, assess, manage, and mitigate risks that may impede organizational goals. Effective risk management strategies need to be adaptable to the constantly changing landscape of global economies, cybersecurity threats, environmental issues, and more. Effective risk management is a multi-faceted process that involves identifying, assessing, mitigating, and continuously monitoring potential threats within an organization or industry. Risk identification is the first step, where potential threats relevant to the organization are recognized. This is followed by risk assessment, which evaluates the severity and likelihood of these risks. Risk mitigation strategies are then developed to reduce exposure or counteract potential threats. Finally, ongoing monitoring and review ensure that strategies remain effective and adaptive to emerging risks. Risk management strategies vary across industries and are tailored to sector-specific challenges. In the financial sector, key approaches include leveraging artificial intelligence (AI) and machine learning (ML) for market risk prediction and regulatory compliance automation, conducting stress tests on financial models to prepare for economic downturns, and implementing robust cybersecurity measures to prevent fraud and data breaches. Healthcare risk management focuses on patient safety, data privacy, and crisis preparedness. Strategies include adopting encrypted electronic health records (EHR), training healthcare professionals in emergency response protocols, and reinforcing supply chain resilience to avoid shortages of essential medical supplies. Globalization presents risks in manufacturing and supply chains, such as supply chain disruptions and regulatory compliance challenges. Effective measures include utilizing IoT-based monitoring systems to prevent equipment failures, diversifying suppliers to mitigate geographic dependency, and conducting regular audits to ensure compliance with industry standards. The energy and environment sector faces environmental risks and market fluctuations. These can be managed through investments in renewable energy projects, predictive maintenance tools for equipment longevity, and comprehensive disaster recovery plans to address events like oil spills and blackouts. Risk mitigation strategies for technology and IT, where cyber threats and data security are primary concerns, include strengthening cybersecurity frameworks with continuous vulnerability assessments, integrating blockchain for secure transactions, and providing regular employee training on emerging cybersecurity risks. Emerging trends in risk management are shaping the future of resilience across industries. Integrating predictive analytics through AI and ML enhances risk detection with real-time insights and early warnings. A growing emphasis on Environmental, Social, and Governance (ESG) factors influences risk assessments to align with stakeholder expectations. Digital twins, or simulation models, are increasingly used in manufacturing and healthcare to forecast operational risks and optimize processes. Additionally, cyber resilience is becoming a priority, with organizations adopting advanced encryption technologies and robust incident response frameworks to safeguard against escalating cyber threats. Effective risk management requires a comprehensive understanding of industry-specific challenges and leveraging modern technology to stay ahead of emerging threats. By integrating adaptable strategies, predictive tools, and strong governance, organizations across industries can successfully navigate uncertainties and secure their future. ...Read more
Fremont, CA : Screen time management software has become a valuable resource for people who want greater control over their digital behavior. As screens play a larger role in work, education, communication and entertainment, spending excessive time online has become a common concern. These solutions help users understand their usage habits, limit distractions and develop healthier routines. Through activity tracking, usage restrictions and personalized recommendations, screen time management software supports a better balance between digital engagement and everyday life. Demand is also increasing across APAC as governments, schools and businesses place greater emphasis on digital wellness. How Does Screen Time Management Software Support Healthier Digital Habits? Many individuals remain unaware of how frequently they interact with digital devices throughout the day. Screen time management software provides detailed usage insights, helping users identify patterns that may influence concentration, productivity and overall well-being. In the broader digital technology sector, CloudFX offers cloud management platforms that analyze resource utilization and operational data, demonstrating the value of tracking digital activity to improve efficiency. As smartphone adoption and digital learning expand across APAC, demand for tools that encourage responsible technology use continues to increase. Most solutions include features that let users create limits for selected applications or online activities. Once a usage threshold is reached, the system can issue notifications or temporarily pause access to encourage users to step away from screens and devote time to other priorities. Parents frequently use these platforms to encourage responsible technology use among children. Schools throughout APAC are also exploring digital wellness tools to support healthy learning environments. Features such as device scheduling, content restrictions and activity reports help establish appropriate boundaries. Educational institutions are also adopting these tools to support classroom focus and reduce interruptions during learning activities. By increasing awareness of digital behavior, screen time management software helps users make more thoughtful decisions about technology use. Floresh provides a mobile-enabled learning platform that tracks student progress and connects teachers, students and families through shared information. What Factors Are Creating New Opportunities for Screen Time Management Software? Demand for digital wellness solutions continues to grow as people seek better ways to manage technology in their daily lives. Users increasingly expect more than basic usage reports. They want meaningful insights that help them understand habits and make practical improvements. Software providers are responding by introducing advanced analytics and more personalized user experiences. The expanding digital economy across APAC is creating new opportunities for these solutions. AI influences these platforms by analyzing behavior patterns and offering personalized suggestions based on individual usage habits. Instead of just presenting data, these tools help users recognize practical actions that promote healthier screen time. Another significant development is the ability to monitor activity across multiple devices. Since many people switch between smartphones, tablets, computers and workplace systems throughout the day, unified tracking provides a more complete understanding of overall digital activity, making it easier to manage screen usage consistently across different environments. ...Read more
Enterprise cloud strategy has moved from migration planning to daily financial control. AI has accelerated that shift. Workloads that once depended mainly on predictable CPU consumption now draw on GPU capacity, token-based usage and data-intensive services that can expand faster than annual budgets anticipate. For executives responsible for cloud management investment, the question is no longer whether cloud platforms can support scale. It is whether the enterprise can see, govern and adjust consumption before cost growth becomes a board-level issue. This pressure is sharpened by multi-cloud adoption. Large organizations often use AWS, Azure, Google Cloud, Oracle, private cloud assets and virtualized infrastructure in parallel. Each environment may offer its own reporting console, pricing model and governance logic. That fragmentation makes it difficult for IT, finance and business leaders to agree on what is being used, which units are driving consumption and where paid capacity is idle or underused. Cloud management software now has to translate technical activity into accountable business information. The strongest solutions give leaders a unified view of services, usage, performance dependency and cost attribution. Visibility must reach beyond invoices and dashboards. It should expose the relationship between workloads, capacity, geography, business unit and actual utilization so that decisions are based on measurable consumption rather than assumptions. AI increases the importance of this discipline because GPU and token economics can distort prior cost models, making yesterday’s forecasting habits unreliable. Financial control also needs to protect business speed. Cost reduction alone is not enough if it slows provisioning, weakens application performance or forces teams into manual approval cycles that frustrate delivery. Effective platforms help identify idle resources, rightsizing opportunities, workload placement options and abnormal usage patterns while keeping the business able to scale when demand is justified. This is where FinOps moves from reporting practice to management discipline, connecting finance, IT and business owners around shared accountability. The buying decision also has a tools-rationalization dimension. Many enterprises have accumulated point products for monitoring, service requests, cost tracking, security alerts and governance. Each may solve a narrow problem, but the combined environment can increase reconciliation work. Executive buyers should favor software that reduces management friction rather than adding another console to be managed. Interoperability is equally important. Enterprises cannot afford management software that deepens dependence on one provider or leaves teams reconciling data across disconnected tools. A strong AI and cloud management solution should support hybrid and multi-cloud environments, normalize information across providers and maintain consistent governance for distributed teams. The best fit for executive buyers is a platform that combines cost analytics, automation, lifecycle management, performance insight and policy control without forcing the organization into a rigid architecture. Cloud FX emerges as the premier choice for organizations that need AI-aware cloud management tied directly to cost accountability. Its SinglePaneFX platform supports multi-cloud visibility, analytics and governance, while TechSaverFX focuses on FinOps, usage metrics and optimization across hybrid environments. The company’s transcript-backed strength lies in identifying unused or underused servers, shifting workloads to better-used capacity and measuring GPU and token-based economics that now shape AI cloud charges. Its vendor-agnostic integration with AWS, Azure, GCP, VMware and Oracle makes it especially relevant for enterprises managing complex estates rather than a single-provider environment. ...Read more
Top