Telematics generates a vast amount of data, including a detailed history of vehicle and driver activities and operations. This type of data is extremely useful within an organization for controlling fuel and maintenance costs, increasing productivity and safety, and minimizing risk. Using telematics for accident reconstruction or benchmarking can generate even greater insight.
Protecting that valuable data is essential. If accessed by a malicious party, there could be serious consequences, potentially jeopardizing customer accounts, schedules, shipments, location of assets, and personal information. Cybercrimes are committed because there is value to be gained from data, whether that data is a collection of usernames and passwords, credit card numbers, or social security numbers, or — as we’ll see — telematics data.
Therefore, whether you are a small business owner, fleet manager, developer, CIO or CEO, it’s critical that you understand how your telematics data is handled and protected.
In this white paper, you will learn about:
Overview of the telematics ecosystem
How Geotab secures telematics data at each level
Best practices for telematics cybersecurity
Key questions to ask your telematics provider about security
Open platform telematics can be viewed as the Internet of Things (IoT) hub of the vehicle, connecting multiple devices to the vehicle through one centralized communications system. An expanding list of third-party devices can be integrated with telematics, such as these solutions from the Geotab Marketplace:
Tire pressure sensors
Salt and sand spreading monitors
In-vehicle verbal feedback
Collision avoidance systems
The telematics ecosystem includes both hardware and also the software responsible for collecting and analyzing the vehicle data.
|Geotab GO Telematics Device
GO RUGGED Ruggedized Telematics Device
|The Geotab GO is a small telematics device with GPS technology and auto-calibrating accelerometer that plugs into the OBD II port of the vehicle (from passenger vehicles up to Heavy Duty trucks). The device collects data on vehicle position, speed (relative to posted), harsh braking, harsh driving, seatbelt, fuel consumption, odometer, vehicle fault codes, battery voltage, air temp, and other engine data, sending it to the cloud hosted environment for processing and analysis.|
|MyGeotab Fleet Management Software||Flexible, scalable, web-based software for fleet management. Key features include GPS vehicle tracking, advanced reporting, driver behavior management, engine data reporting, route optimization, engine health and maintenance, accident reconstruction, open data integration, and custom mapping.|
|Input/Output Expanders||Third-party hardware that connects to the expander port of the Geotab telematics device that performs specific task and relays information to and/or from the device. Examples: driver identification via Near Field Communication (NFC), GO TALK|
Online center of fleet management solutions that integrate with the Geotab open telematics platform, including software Add-Ins, hardware accessories and Add-Ons, mobile apps, general software solutions, and custom reports.
Examples: driver’s camera and in-cab video, Bluetooth asset tracking, Mobileye advanced collision prevention, Geotab Drive app for Hours of Service, Driver Vehicle Inspection Reporting and Driver ID, paperless gamification apps.
Software Development Kit (SDK)
Application Programming Interfaces (APIs)
|The Geotab software development kit (SDK) and Application Programming Interfaces (APIs) are a set of tools for automating tasks, building third-party hardware Add-Ons for the Geotab GO device, and integrating business systems such as accounting, payroll, CRM, maintenance, route planning, risk management and safety compliance.|
Establish a dedicated team of security specialists and management who believe in security.
Set comprehensive and transparent policies on security and privacy.
Implement security best practices in product and software development.
Regular training of employees, partners, and end users on security policies and procedures.
Geotab platform security is designed for end-to-end protection of your data. Key implementations include:
GO device and network interfaces use authentication, encryption, and message integrity verification to ensure that telematics data cannot be read or forged by malicious parties.
Over-the-air updates use digitally-signed firmware to verify that updates comes from a trusted source.
Geotab uses independent third-party experts to validate the platform from end to end.
The following explains in more detail how telematics systems are secured.
The microelectronic modules on each Geotab GO device are manufactured in fabrication facilities across the globe. The pieces return to Geotab’s facilities where the final assembly by Geotab employees completes the GO device hardware. The electronics of each device are tested and then prepared to receive the firmware programming.
Since Geotab does not purchase the device hardware from any other entity and has full control of design, manufacturing, assembly, and testing, we can quickly and efficiently respond to manufacturing defects or potential hardware vulnerabilities internally, without being reliant on any other party.
Firmware is the specialized software that programs the microcontroller and electronics modules in the device — including communicating with the engine computer and auxiliary systems, receiving GPS coordinates, and coordinating cellular communication.
Because a telematics device attaches itself to a complex and interconnected system, the firmware that issues the orders to the device is an exceptionally important part of the connected car.
A telematics device will receive many updates to its firmware over the course of its life. These updates introduce new features or resolve issues with the device after it has been installed in a vehicle. The device automatically receives over-the-air (OTA) updates and performs the update process in a way that is invisible to the user.
This leaves a potential opening for attackers to attempt to replace the firmware on a telematics device with malicious firmware of their own.
To prevent compromised firmware, the following methods are used to secure the device:
Controlling firmware installation on the device at the manufacturing stage.
Digitally-signing over-the-air updates to verify that the updates come from a trusted source.
Without both steps to verify that every firmware update is authentic, it is impossible to know if the device is under your control or the control of a malicious party interested in getting your data.
The telematics device sends data from the vehicle to the central server over a cellular connection. Although varying by territory, provider, and infrastructure, cellular communication is commonly done over 2G, 3G and 4/5G networks, which can have their own unique vulnerabilities.8
A secure communication channel can be established with the use of encryption. Encryption is the process of encoding a message such that only the sender and recipient would be able to view the message. To an outside party, like an attacker, this encoded message would appear as a meaningless collection of symbols. The intended recipient of the message, using a special key, can turn this collection of symbols into intelligible information.
As such, a normally vulnerable channel like a cellular network can be made secure by encrypting the messages sent from a telematics device to the destination server. Because of its mathematical properties, strong encryption cannot be decrypted trivially even by powerful computers. Geotab devices use industry-leading encryption.
Telematics devices relay their data to storage and processing servers, which can be thought of as vaults containing valuable information. The physical servers can be protected by restricting physical access only to authorized personnel. The data inside, on the other hand, can be protected by securing the cloud environment through industry-standard firewalls, access control, and activity monitoring.
It is critical to understand that even the most secure systems are not perfect. In the event of a security breach, it is important to be capable of mitigating the damage caused by any unauthorized access.
Mitigation is the act of minimizing the potential impact from a threat. Effective mitigation can be done by never storing user passwords for the attacker to steal. This is a process known as hashing and salting a password — storing a hash and salt value of a password instead of the actual password. This process impedes the progress of an attacker if they gain unauthorized entry, thus buying precious time to respond to the security compromise and mitigate damage.
Hashing and salting extends the metaphor of the vault: if a robber breaks into a bank vault, instead of having direct access to pile of treasure, they would have to break into every single individual personal vault one at a time in order to steal the valuables.
Data security is a practice rather than an act. New security threats are bound to arise as technology develops and the complexity of a system grows. An organization that is serious about security will continuously engage with security issues through updating their systems, training employees, refining processes, and finding vulnerabilities.
At the very core of the telematics system is the team of engineers and support staff that keep everything running smoothly. Resilient organizations should address the fact that an employee might go against the best interest of the company — whether leaking data because of payments from competitors, malfeasance, or simply accidental errors.
So it becomes essential that an organization maintain vigilance at all levels. This can be accomplished by controlling and monitoring access privileges, making log records of important operations, and making sure all employees are aware of the risks related to their actions. A strong culture of security should instill confidence in employees of their ability to respond to security threats, but without creating anxiety about attacks that may or may not come.
One way of building security confidence and safely exposing a telematics system to threats is by performing penetration tests, which are authorized hacking attempts performed by a company specializing in computer security. In a penetration test, the security company will attempt to find vulnerabilities in your hardware and software and — instead of exploiting these vulnerabilities like an actual hacker might — they will document their attack methodology and report their findings to you. The results of the penetration test should then acted upon accordingly — whether that is fixing security holes or changing internal procedures — before malicious agents can exploit those very same vulnerabilities.
Ultimately, data security is an ongoing, corporation-wide effort aimed at safeguarding the data of all users.
The security of your telematics data should not be overlooked. Like any other critical business data, it should be protected with comprehensive security mechanisms and processes that are continuously reviewed and updated. Following industry best practices is essential.
Cybersecurity is a shared responsibility. We can all play a role in keeping security systems strong. Getting informed and asking questions is a great first step on the path to effective cybersecurity management.
To learn more about telematics security, please visit: security.geotab.com
Editors: Gleb Nikonov, Melanie Serr, Alex Sukhov, Scott Sutarik