Keeping Your Fleet Safe from Cyber Attacks

Fleet Cybersecurity Key Takeaways:

• Connected commercial fleets face growing fleet cybersecurity risks, including ELD hacking, malware, and remote device exploitation.
• Fleet device vulnerabilities — like weak passwords and open network access — can make trucks targets for bad actors.
• A commercial truck cyber attack can spread across an entire fleet through connected devices, making prevention critical.
• Fleets can reduce risk by auditing ELD security, strengthening firmware, and working with a trusted fleet security technology provider.
• Platform Science's SOC 2 Type 2-certified, defense-in-depth approach helps protect connected trucks at every layer — hardware, software, and infrastructure.

‍

In an increasingly connected world, more attention and resources are being directed to ensuring the technology connecting the Internet of Things (IoT) is properly secured. From hotel room keys to home appliances and personal fitness trackers to surveillance devices – “bad actors” sometimes look for ways to infiltrate and steal information or cause disruptions. Today’s smart commercial fleets are no different, and engineers and fleet technology providers are taking active steps to advance fleet cybersecurity and ensure connected smart rigs stay safe.

Since the Federal Motor Carrier Safety Administration (FMCSA) established its mandate on electronic logging devices (ELDs) in 2019, commercial fleets in the U.S. have been required to use these integrated devices for improved compliance and safety for trucks and drivers. ELDs make it simple to track things like hours of service (HOS), vehicle motion status, engine status, and other basic data points.

By design, ELDs cannot control a CMV’s functionality and are not legally required to track vehicle performance data like speed, braking, and steering. However, commercial trucks are becoming steadily more connected to both the back office and other trucks in the fleet, with new technologies delivering a fuller picture of vehicle and fleet health, driver habits, road conditions, and more. With this increased connectivity comes new concerns for potential disruptions by people with nefarious intentions. The threat of a cyberattack on commercial trucks is a growing concern that fleet managers can't afford to ignore.

Understanding the Risk of a Commercial Truck Cyber Attack

While most cyberattacks on fleets today are, like for most businesses, targeting back office and company-level operations, some characteristics of ELDs could make them susceptible to hackers. For example, they are wireless and typically Bluetooth-enabled, creating the potential for remote control. Their wireless nature also could leave them vulnerable to uploaded malware, while their connectivity with the rest of their fleet means that malware could possibly spread to other vehicles (commonly known in cybersecurity as a “worm”).

In a recent study on commercial vehicle ELD security, researchers explored fleet device vulnerabilities that left ELDs potentially prone to cyberattacks. The ELD brand they observed contained an easily identifiable SSID (name) on the network, were openly accessible, and was protected by a weak password. These features made it easy for attackers to identify the equipment on a nearby vehicle and then work to infiltrate it. Before the researchers published their findings, they shared their results with the ELD manufacturer, who had time to address and mitigate the identified vulnerabilities before the paper was published.

Fleet Cybersecurity Best Practices: How to Combat Cyberattacks on Your Trucks

Fleets can better protect themselves from potential cyberattacks by implementing the following practices, according to experts:

• Evaluate the cybersecurity status of your ELDs and your entire system. Work with your telematics provider on how to conduct a risk assessment of your fleet using resources like the NIST Risk Management Framework.
• Identify critical systems that need to be protected and prioritize them. Develop contingency plans for what to do if those systems fail or are compromised.
• If drivers suspect their ELD device or vehicle has been hacked due to erratic vehicle performance, they should immediately contact fleet maintenance for guidance.
• Work with your telematics provider to enhance default security settings, implement more robust firmware, improve authenticity checks, and eliminate any unnecessary and high-risk features.
• Improve system passwords by utilizing tools that generate complex passwords or use a standard password prefix with the last four digits randomized.
• Use a secure firmware signing mechanism involving cryptographic signing to ensure updates are authentic and from a verified source.

How Platform Science is helping protect its partners against cyberattacks

Platform Science has built defense-in-depth security into its hardware, software, and infrastructure to prevent the types of potential fleet device vulnerabilities described in the recent research, including:

• Regular third-party penetration testing
• Scanning of software updates prior to release for vulnerabilities and security risks
• Constant security scanning of live infrastructure for intrusion detection and anomalous activity 
• Multiple overlapping security layers between the tablet, the ELD, and the truck via close relationships with OEMs, in addition to OEM multiple layers
• Mobile device management to prevent device compromises
• Signed firmware in our tablet and CVD, among other protections

We also work very closely with our OEM partners, their security protocols, and with all the security protections their vehicles provide. Additionally, we proactively monitor, test, and evaluate potential security threats. Finally, Platform Science has been System and Organization Controls 2 (SOC 2 Type 2) certified for more than four years.

View the wide range of secure telematics technologies Platform Science offers commercial fleets, or contact us today to schedule a demo or learn more about our security measures.