Protection of Data and Systems
Cyber Defense for the Defense Sector
With the increasing networking and digitalization of critical infrastructures and military equipment, the importance of cyber defense in the defense sector is becoming ever more critical. It is essential to ensure the integrity of systems, protect sensitive data, and detect tampering attempts early. This is mandatory to maintain trust in an increasingly technology-driven environment for national protection in both civilian and military domains. Below, we highlight the complexity and necessity of advanced cyber defense measures.
The Ukraine war clearly shows the crucial role of unmanned systems (UXS). These systems are particularly vulnerable to cyber and system security risks due to rapid innovations in defense and control technologies. An example is GPS spoofing, where false GPS data is faked to mislead systems and redirect their effects to incorrect targets.
These threats affect not only unmanned combat systems but also vehicles generally used by the military. Many of these vehicles are either civilian models or based on them and equipped with special systems adapted to military needs. The connection between unmanned systems and civilian vehicles lies in the shared need to protect them from cyberattacks. It is crucial that both unmanned and manned systems are secure to prevent theft of sensitive data or tracking due to misuse and complex connectivity. Therefore, it is necessary to examine the systems and deploy robust protection and defense mechanisms to ensure the security and effectiveness of military operations.
Marco Siebert, head of Embedded Security at IAV, emphasizes the need for a holistic approach to cybersecurity: "This is a vital point. Ultimately, every manufacturer and user in the defense environment must carefully consider how to protect data theft and system integrity." The fact that data is collected during operation and also transmitted to AI systems raises questions about protecting sensitive infrastructure and makes clear that a comprehensive security approach is indispensable.
According to Siebert, it is critically important to close identified security gaps through quick action and effective defense strategies. "Experience has shown: If someone has enough time and resources, they can find a security gap. That is why good monitoring is essential to respond quickly if a vulnerability is discovered."
The ability to quickly close security gaps and be adaptable will become increasingly important due to growing diversity to ensure the integrity and security of sensitive systems and infrastructures. This requires a holistic security approach in military vehicles across all communication participants.
Approach: Strengthening Cyber Defense
To effectively strengthen military systems with regard to their long service life and special requirements against current and future cyber threats, IAV has developed services such as penetration testing in special environments and innovative solutions like the Firmware Security Module (FSM), IAV quantumSAR, and the Automotive Cybersecurity Defense Center (ACDC). FSM and quantumSAR aim to retrofit control units while addressing the threat posed by quantum computers.
Firmware Security Module (FSM)
Enables secure booting of control units.
The Firmware Security Module is a software-based solution that secures control units retroactively even without special security hardware or with hardware that cannot be updated. It enables safe startup of control units and protects necessary secret data. This module offers a flexible and effective way to retrofit existing systems with required protection and defense mechanisms. Especially in the context of software-defined systems, the capability to adapt cryptography is crucial for protection throughout the entire service life.
IAV quantumSAR
Integrates quantum-safe encryption algorithms.
As part of the FSM project, IAV integrates quantumSAR, an open-source project with quantum-safe encryption algorithms, to counter the threat from quantum computers. It is customizable and based on algorithms considered post-quantum secure, thus ensuring protection of sensitive defense sector systems.
Security by Design and Risk Analyses
Minimizing risks already in the development phase.
IAV follows a security-by-design approach addressing risks already during development. Through risk analyses and the development of appropriate protection mechanisms, IAV ensures that military systems are fundamentally protected against cyberattacks.
Automotive Cybersecurity Defense Center (ACDC)
Detects security vulnerabilities in the field.
The ACDC enables system monitoring during deployment and early detection of security vulnerabilities. This allows experts to respond quickly and precisely to threats and ensure continuous protection throughout the system’s entire service life.
Quantum Computing: New Cyber Threats
As soon as quantum computers are in use, new security architectures are necessary.
The use of quantum computers requires new security architectures. Quantum computers can perform calculations at speeds inaccessible to conventional computers and thereby break common encryptions in a fraction of the usual time. This endangers the confidentiality and security of sensitive communications, such as those used in military command and weapons systems. Post-quantum cryptographic algorithms, based on mathematical problems that are also hard to solve for quantum computers, therefore offer the solution for sustainable protection of sensitive infrastructure.
Quantum-safe Algorithms
Post-quantum algorithms are hard for quantum computers to solve.
This is where quantum-safe algorithms come into play. Embedded security experts Philipp Jungklass and Marco Siebert explain: "Previous methods are easily broken by quantum computers." Quantum-safe algorithms, also called post-quantum algorithms, are based on mathematical problems that are very difficult for quantum computers to solve. "Post-quantum cryptography ultimately describes algorithms that still offer the necessary security even in the age of quantum computing." These algorithms are thus the solution to ensure the security of connected vehicles and other digital systems, especially in the defense environment, in the quantum computing era. IAV has responded to the challenges posed by quantum computers to cybersecurity by developing innovative software. This software enables efficient implementation of post-quantum algorithms on current control units. "We decided to implement and evaluate post-quantum algorithms on today's common control units," explains Marco Siebert. By adapting algorithms from an open-source library for use on microcontrollers, IAV gained valuable insights and tested them in practice.
Open-Source Solution
Transparency and trust are the basis of security.
IAV consciously decided to provide the software as an open-source solution. Transparency and knowledge transfer increase security and trust in digital systems, especially in safety-critical systems.
Penetration Tests: Finding and Closing Security Gaps
Identifying vulnerabilities before attackers can exploit them.
Penetration tests are a central tool of cyber defense. They allow potential weaknesses to be identified and closed early. Undesired system behavior is simulated to reveal vulnerabilities. Claude-Pascal Stöber-Schmidt, Technical Sales Manager Cybersecurity at IAV, explains: "We develop targeted attack scenarios and use state-of-the-art techniques such as scanning, attack simulations, and vulnerability analyses to uncover hidden risks." With tools like DiagRA (CAN bus) and Kali Linux (network), IAV ensures comprehensive security assessment.
Conclusion: Cybersecurity is an Ongoing Process
Cybersecurity is a dynamic field requiring constant development. "We must trust that security-relevant systems function correctly and securely," emphasizes Marco Siebert. Whether defense against hackers, penetration testing, or preparation for the quantum era—our digital world's security depends on foresight and proactive action.
