Cyber Defense eMagazine December Edition for 2021

wide electricity network due to repeated, simultaneous switching on/off of the charging current. It can
also damage the vehicle battery being charged.
All of these risk factors make a good case for the EV industry to implement cybersecurity practices that
will protect EV customer data, as well as prevent network hacking and the potential costly loss of
operation. In this era of concerns about compliance and data privacy the EV industry, notably charging
station networks and suppliers, also cannot afford data breaches that will damage customer confidence
and corporate image.
ISO/IEC 27001 Certification
First and foremost, ISO cybersecurity certification should be required for any business charging station
supplier – whether they be portable chargers or networking applications that drive the charging operation,
or any component that is tied to a network and thus vulnerable to a cyber threat. Compliance with
ISO/IEC 27001 is considered the most important cybersecurity certification worldwide. It demonstrates
that measures for ensuring information security and data protection have been implemented and are
regularly monitored and reviewed. This proof is essential to developing a secure charging infrastructure
and to protecting data generated by EV users, industry business partners, other supplier partners and
investors.
A Software-First Strategy
Bringing the charging industry into advanced 21 st century cyber defense practices will be challenging.
Many suppliers are “old world” thinkers, the “plugs and cables” hardware companies. The other side of
this are startups who look at software security as an add-on, who've never focused that closely on
software. They tend to underestimate the diverse range of sources of cyber threats that deficient software
security can pose.
Both types need to change their mindset to “software-first.” After all, charging stations have long since
been highly complex, software-controlled systems that are equivalent to IoT nodes. They must cope with
huge volumes of data streams, whether in communication with the vehicle to be charged, in
communication with the electricity network, or in communication with user authentication and usage
billing services.
These are data streams that offer numerous points of attack for malicious parties, not to mention the
physical access to the actual devices. U.K. researchers found that, in one case, a simple screwdriver
was all that was needed to access the inner workings of the devices. The issue of vulnerability applies to
popular charging stations and portable chargers with IoT connectivity. What is also notable is that security
research in this area is lagging in spite of the growing adoption of EVs and increase in private and public
charging stations.
Cyber Defense eMagazine – December 2021 Edition 70
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.