EV Cybersecurity
Engineering

Understanding the Role

Security Manufacturing Engineering is a uniquely cross-cutting discipline. Unlike a pure AppSec or infrastructure security role, you operate across hardware trust anchors, factory floor tooling, vehicle software stacks, and cloud backend systems simultaneously. Understanding the full picture is a hard requirement — not a bonus.

The Four Responsibility Pillars

EV Threat Landscape

Before writing a single line of security code, you need a mental model of what you're defending against. The automotive threat landscape is uniquely complex because attack surfaces span physical hardware, wireless interfaces, manufacturing processes, and global cloud infrastructure.

Attack Surface Map

Core Technical Domains

Nine technical domains form the knowledge base for this role. Each is detailed below with conceptual depth, must-know topics, code examples, and pitfalls. Begin with Domains 1–3 as your foundation before moving to the automotive-specific and cloud domains.

# Generate vehicle firmware signing keypair
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os, hashlib

# ── Asymmetric: firmware signing ──────────────────
private_key = ec.generate_private_key(ec.SECP256R1())
public_key  = private_key.public_key()

# Sign firmware binary digest (DER format)
firmware_bytes = open("firmware.bin", "rb").read()
firmware_hash  = hashlib.sha256(firmware_bytes).digest()
signature = private_key.sign(firmware_hash, ec.ECDSA(hashes.SHA256()))

# Verify on target (ECU bootloader does this)
try:
    public_key.verify(signature, firmware_hash,
                      ec.ECDSA(hashes.SHA256()))
    print("✓ Firmware signature valid")
except Exception:
    print("✗ SIGNATURE INVALID — reject firmware")

# ── Symmetric: encrypt telemetry payload ──────────
key   = AESGCM.generate_key(bit_length=256)
aesgcm = AESGCM(key)
nonce  = os.urandom(12)   # 96-bit nonce, never reuse!

plaintext  = b"{'speed':120,'soc':0.73,'lat':37.7}"
ciphertext = aesgcm.encrypt(nonce, plaintext, aad=b"vehicle-id-001")

# aad = associated data: authenticated but not encrypted
# Typically includes device ID, timestamp, sequence num

# Install step-ca (SmallStep)
wget https://dl.smallstep.com/gh-release/cli/latest/step_linux_amd64.tar.gz
tar -xzf step_linux_amd64.tar.gz && sudo mv step /usr/local/bin/

# Initialize offline Root CA (run air-gapped)
step ca init --name "VehicleFleet Root CA" \
     --dns rootca.internal \
     --address :9000 \
     --provisioner "root-admin@company.com"

# Create Intermediate Manufacturing CA
step certificate create \
     "Manufacturing Intermediate CA" \
     mfg-intermediate.crt mfg-intermediate.key \
     --ca root-ca.crt --ca-key root-ca.key \
     --profile intermediate-ca \
     --not-after 8760h     # 1 year validity

# Issue device cert for ECU during provisioning
step certificate create \
     "ECU-${VIN}-${ECU_PART}" \
     device.crt device.key \
     --ca mfg-intermediate.crt \
     --ca-key mfg-intermediate.key \
     --not-after 87600h    # 10-year vehicle lifetime

#!/bin/bash
# Debian 12 Security Hardening — EV Manufacturing Server
set -euo pipefail

## ── 1. Kernel Security Parameters ──────────────
cat >> /etc/sysctl.d/99-security.conf << 'EOF'
kernel.randomize_va_space = 2          # Full ASLR
kernel.kptr_restrict = 2               # Hide kernel pointers
kernel.dmesg_restrict = 1              # Restrict dmesg
kernel.yama.ptrace_scope = 2           # Restrict ptrace
kernel.core_uses_pid = 1
kernel.sysrq = 0                       # Disable magic sysrq
net.ipv4.tcp_syncookies = 1            # SYN flood protection
net.ipv4.conf.all.rp_filter = 1        # Reverse path filter
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.log_martians = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
EOF
sysctl --system

## ── 2. SSH Hardening ────────────────────────────
cat > /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256
EOF

## ── 3. Enable AppArmor & UFW ────────────────────
systemctl enable --now apparmor
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH management'
ufw --force enable

## ── 4. Auditd for security event logging ────────
apt install -y auditd audispd-plugins
cat >> /etc/audit/rules.d/manufacturing.rules << 'EOF'
-w /etc/passwd -p wa -k identity
-w /etc/sudoers -p wa -k privilege
-a always,exit -F arch=b64 -S execve -k exec_log
-a always,exit -F arch=b64 -S openat -k file_access
EOF
service auditd restart

# roles/secure_service/tasks/main.yml
---
- name: Ensure cosign is installed
  get_url:
    url: "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
    dest: /usr/local/bin/cosign
    mode: '0755'

- name: Verify image signature before deployment
  command: >
    cosign verify
    --certificate-identity "ci@company.com"
    --certificate-oidc-issuer "https://accounts.google.com"
    "{{ registry }}/{{ image }}:{{ version }}"
  register: sig_check
  failed_when: sig_check.rc != 0

- name: Run hardened diagnostic service
  community.docker.docker_container:
    name: vehicle-diag
    image: "{{ registry }}/vehicle-diag:{{ version }}"
    restart_policy: unless-stopped
    read_only: true
    user: "1000:1000"
    security_opts:
      - "no-new-privileges:true"
      - "apparmor:vehicle-diag-profile"
      - "seccomp:/etc/docker/seccomp/diag.json"
    cap_drop: ["ALL"]
    cap_add:  []   # Explicitly none
    tmpfs:
      /tmp: "size=64m,mode=1777,noexec"
    env:
      VAULT_ADDR: "https://vault.internal:8200"
      VAULT_ROLE: "vehicle-diag-prod"

# Restrict entire namespace to Restricted profile
apiVersion: v1
kind: Namespace
metadata:
  name: manufacturing-services
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit:   restricted
    pod-security.kubernetes.io/warn:    restricted
---
# NetworkPolicy: default deny-all, explicit allow
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: manufacturing-services
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

# Test automotive IDS with simulated attack
# Setup: sudo modprobe vcan && sudo ip link add vcan0 type vcan
#        && sudo ip link set vcan0 up

import can, time, struct

bus = can.interface.Bus('vcan0', bustype='socketcan')

# ── Normal operation: speed sensor message ────────
def send_speed(speed_kmh):
    data = struct.pack('>H', speed_kmh * 100)  # 0.01 km/h resolution
    msg  = can.Message(arbitration_id=0x180, data=data, is_extended_id=False)
    bus.send(msg)

# ── Attack: inject fake brake command ─────────────
def inject_brake_command():
    # ECU ID 0x200 = brake controller (spoofed)
    payload = bytes([0xFF, 0xFF, 0x00, 0x00])  # Max brake pressure
    msg = can.Message(arbitration_id=0x200,
                      data=payload, is_extended_id=False)
    bus.send(msg)
    print("[ATTACK] Fake brake command injected on 0x200")

# ── IDS Monitor: detect rate anomalies ────────────
msg_counts = {}
for msg in bus:
    aid = msg.arbitration_id
    msg_counts[aid] = msg_counts.get(aid, 0) + 1
    if msg_counts[aid] > 1000:  # Threshold: >1000/sec suspicious
        print(f"[ALERT] CAN flood on ID 0x{aid:03X}")

import boto3, json, base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

kms  = boto3.client('kms', region_name='us-east-1')
iot  = boto3.client('iot-data')

def encrypt_and_publish(vin: str, telemetry: dict) -> None:
    # 1. Generate data encryption key from KMS
    dek_response = kms.generate_data_key(
        KeyId='alias/vehicle-telemetry',
        KeySpec='AES_256'
    )
    plaintext_dek  = dek_response['Plaintext']       # ephemeral
    encrypted_dek  = dek_response['CiphertextBlob']  # store with data

    # 2. Locally encrypt telemetry with plaintext DEK
    aesgcm    = AESGCM(plaintext_dek)
    nonce     = os.urandom(12)
    payload   = json.dumps(telemetry).encode()
    ciphertext = aesgcm.encrypt(nonce, payload,
                                aad=vin.encode())

    # 3. Publish encrypted envelope to IoT Core
    envelope = {
        "vin":          vin,
        "ciphertext":   base64.b64encode(ciphertext).decode(),
        "nonce":        base64.b64encode(nonce).decode(),
        "encrypted_dek": base64.b64encode(encrypted_dek).decode(),
    }
    iot.publish(
        topic=f"vehicles/{vin}/telemetry/encrypted",
        qos=1,
        payload=json.dumps(envelope)
    )

    # Zero out plaintext key immediately
    plaintext_dek = None

from dataclasses import dataclass
from enum import IntEnum

class Impact(IntEnum):
    NEGLIGIBLE=1; MODERATE=2; MAJOR=3; SEVERE=4

class Feasibility(IntEnum):
    HIGH=1; MEDIUM=2; LOW=3; VERY_LOW=4

@dataclass
class ThreatScenario:
    asset: str
    threat: str
    attack_vector: str
    impact: Impact
    feasibility: Feasibility

    @property
    def risk_level(self) -> str:
        score = self.impact * (5 - self.feasibility)
        if score >= 12: return "CRITICAL"
        if score >= 8:  return "HIGH"
        if score >= 4:  return "MEDIUM"
        return "LOW"

# Example TARA for OTA update system
threats = [
    ThreatScenario(
        asset="OTA firmware package",
        threat="Attacker delivers unsigned firmware",
        attack_vector="Compromise OTA delivery CDN",
        impact=Impact.SEVERE,
        feasibility=Feasibility.LOW
    ),
    ThreatScenario(
        asset="OTA signing private key",
        threat="Signing key exfiltration",
        attack_vector="Compromise CI/CD signing environment",
        impact=Impact.SEVERE,
        feasibility=Feasibility.MEDIUM
    ),
]

for t in threats:
    print(f"[{t.risk_level:8}] {t.threat}")

# .github/workflows/secure-build.yml
name: Secure Vehicle Service Build
on: [push, pull_request]

jobs:
  security-pipeline:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write    # For OIDC signing
      security-events: write

    steps:
    - uses: actions/checkout@v4

    - name: SAST - Semgrep
      run: |
        pip install semgrep
        semgrep --config=auto --error \
          --sarif-output=semgrep.sarif .
      continue-on-error: false

    - name: SCA - pip-audit
      run: pip-audit --strict --output pip-audit.json

    - name: Build container image
      run: docker build -t vehicle-service:${{github.sha}} .

    - name: Container vuln scan - Trivy
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: vehicle-service:${{github.sha}}
        exit-code: '1'
        severity: CRITICAL,HIGH

    - name: Generate SBOM (CycloneDX)
      run: |
        syft vehicle-service:${{github.sha}} \
          -o cyclonedx-json=sbom.cdx.json

    - name: Sign image + SBOM with cosign (OIDC)
      uses: sigstore/cosign-installer@v3
    - run: |
        cosign sign --yes vehicle-service:${{github.sha}}
        cosign attest --yes --type cyclonedx \
          --predicate sbom.cdx.json \
          vehicle-service:${{github.sha}}

import boto3

# Emergency: revoke all certs from compromised batch
def revoke_manufacturing_batch(batch_id: str, reason: str):
    iot  = boto3.client('iot')
    acm  = boto3.client('acm-pca')

    # 1. List all certs from batch (tagged at provisioning)
    paginator = iot.get_paginator('list_certificates')
    certs_to_revoke = []

    for page in paginator.paginate():
        for cert in page['certificates']:
            tags = iot.list_tags_for_resource(
                resourceArn=cert['certificateArn']
            )['tags']
            tag_map = {t['Key']: t['Value'] for t in tags}
            if tag_map.get('ManufacturingBatch') == batch_id:
                certs_to_revoke.append(cert)

    # 2. Revoke in IoT Core (prevents new connections)
    for cert in certs_to_revoke:
        iot.update_certificate(
            certificateId=cert['certificateId'],
            newStatus='REVOKED'
        )

    print(f"Revoked {len(certs_to_revoke)} certs from batch {batch_id}")
    # 3. Next: push emergency OTA to affected VINs
    # 4. Next: update OCSP responder CRL
    # 5. Next: notify PSIRT & regulatory team

Skill Priority Matrix

Use this matrix as a gap analysis before building your study plan. Critical skills are interview table-stakes. High skills differentiate candidates. Preferred skills close the deal. Be rigorously honest with your current level.

24-Week Preparation Roadmap

A structured 24-week plan organized into four phases. Each phase builds on the previous. Parallel reading and project work is encouraged. Time estimates assume 10–15 hours/week of focused study alongside existing employment.

Tools & Technology Reference

Complete tooling reference organized by functional category. Learn each tool in the context of an actual project — not in isolation.

Automotive Security Standards & Requirements

These standards define the security requirements for EV and SDV that OEMs and suppliers must meet. UN R155/R156 and ISO/SAE 21434 are the primary regulatory and engineering frameworks. Knowing them differentiates you from a generic security engineer, shapes the requirements you'll write, and will come up in interviews. You don't need to be a compliance expert — but you need to understand structure and implications.

Security Design Patterns to Master

These architectural patterns appear repeatedly across the manufacturing, vehicle, and cloud domains. Understanding them lets you both recognize their application in existing systems and design them from scratch.

Interview Preparation

This role requires demonstrating both deep technical depth and cross-functional judgment. Interviews will combine technical system design, hands-on coding, threat modeling, and behavioral scenarios. Prepare for all four modes.

System Design Scenarios

Behavioral Questions (STAR Format)

Technical Depth Questions — Expected Answers

Portfolio Project Guide

Build these projects in public GitHub repositories with thorough READMEs. They serve as talking points in interviews ("let me show you the code") and demonstrate that you can execute — not just discuss — the skills required for the role.

Curated Learning Resources

Every resource here is specifically selected for relevance to this role. Organized by type and priority. "Foundational" = do these first. "Domain-specific" = once foundations are solid. "Advanced" = for continuous learning in role.

Essential Books

Online Courses

Key Standards & Reports to Read

Hands-On Practice Platforms

Certifications — Prioritized