What kind of security features are being added to cars today as well as to AVs to prevent them from falling victim to cyberattacks and malware?
For an autonomous vehicle, security cannot be an afterthought, as a compromised AV becomes a serious safety hazard for those in and around the vehicle. Security of an AV also needs to be a defense in depth strategy, as the attack surface of an autonomous car is huge; multiple connectivity ingress points, many sensors, hundreds of millions of lines of software, many CPUs and ECUs are all potential attack vectors for malicious agents.
At Arm, we are focusing on protecting the many Arm-based modules that are helping power the AV, offering technologies like TrustZone and cryptography along with our Platform Security Architecture (PSA) framework that is aimed at securing connected devices. These technologies provide a root of trust to enable security functions such as secure boot, key storage, cryptography, attestation, and auditing functions.
As computing systems become more complex with multiple functions being put into domain controllers, there needs to be additional protection of the software that runs on these systems.  Arm provides isolation technologies with its built-in hardware virtualization and system MMUs that, when used with a hypervisor, can separate software and I/O devices, and can isolate the critical components from the key attack vectors such as the external connectivity.
Lastly, as part of the defence in depth, there are a large number of companies, many whom are Arm partners, that are focusing on bringing specific security functionality to the car and module manufacturers. For example, technologies are available to encrypt CANbus communication to protect critical driving functions from attack, and others to make sure that any over the air (OTA) updates are secured, an example of the latter being the open source Uptane project that is being utilized in connected car systems.
Arm is also bringing its Platform Security Architecture to work with many companies that can achieve PSA certification and working with standards bodies such as the National Institute of Standards and Technology (NIST) and Society of Automobile Engineerings (SAE) to inform them of the threat models and security analysis for autonomous use cases.