1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Penetrations tests to prove cyber security in IATF 16949

Discussion in 'IATF 16949:2016 - Automotive Quality Systems' started by afer1964, Mar 19, 2024.

Tags:
  1. afer1964

    afer1964 New Member

    Joined:
    Mar 19, 2024
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Which of you has successfully commissioned or completed a cyber security penetration test and thus passed the re-certification audit? Which service providers from the IT world can you recommend? Which certifications from IT service providers are required?
     
    afer1964, Mar 19, 2024
    #1
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,110
    Likes Received:
    2,562
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    "Pen testing" as part of IATF 16949? Really?
     
    Andy Nichols, Mar 19, 2024
    #2
  3. afer1964

    afer1964 New Member

    Joined:
    Mar 19, 2024
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Yes, in Germany, Austria, etc.
     
    afer1964, Mar 20, 2024
    #3
  4. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,110
    Likes Received:
    2,562
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    There's no requirement in IATF 16949 which relates to penetration testing of a cyber security system. Can I ask why the question?
     
    Andy Nichols, Mar 20, 2024
    #4
  5. yodon

    yodon Well-Known Member

    Joined:
    Aug 3, 2015
    Messages:
    198
    Likes Received:
    115
    Trophy Points:
    42
    Setting the compliance to 16949 question aside (which I can't answer anyway as I'm not in that field)...

    Please clarify if you are asking about pen testing for product related software (e.g., software that can enable car shut-down or enable you to remotely unlock the doors) or for your internal network?

    Generally, pen testing needs to be done by test specialists equipped to do such testing. They have to really hammer on the exploit attempts and that requires automated testing. I don't know of any certifications for completing pen testing on product software. If you're talking about your internal network, you can get certified to ISO 27001 (but that's more than just cybersecurity / pen testing).
     
    yodon, Mar 20, 2024
    #5
    afer1964 likes this.
  6. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,110
    Likes Received:
    2,562
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Here's my guess: IATF 16949 requires as part of the organization's contingency planning, that it includes not just the "normal fire, flood, plague" etc. but also a breach of cyber security. I'd wager at least $5 that an auditor - having learned a little bit about some aspects of cyber security - that they now "expect" the organization to demonstrate penetration testing...

    I'll happily donate the $5 if I'm not (somewhat correct). BTW - in Germany, the so-called VDA "TISAX" requirements for information security of automotive (prototype) products is gaining acceptance. Things are getting out of hand IMHO...
     
    Andy Nichols, Mar 20, 2024
    #6
    afer1964 likes this.
  7. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    821
    Likes Received:
    405
    Trophy Points:
    62
    No way I take that bet. Probably 100% dead on.
     
    Golfman25, Mar 20, 2024
    #7
  8. afer1964

    afer1964 New Member

    Joined:
    Mar 19, 2024
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Thanks for your initial answers.
    It's about the IT remote location of a global corporation in the automotive supply industry. They have 280 employees on all continents in IT and are Tisax certified because of the VDA, ISO 14001, ISO 5001, and IATF 16949.
    Conclusion from the Cyber Security Assessment Tool (CSAT):
    After reviewing the CIS Controls™ (v8.0) questionnaire, described in detail later, the current overall maturity level of the Company cybersecurity program and practices matches level 3 – rationalized (from max. 4). The organization’s maturity level is based on the lowest scored CIS control, gathered during the interview with the security team.
    The CSAT questionnaire is based on the CIS Controls, aiming to provide relevant information on your IT processes. In addition, the questionnaire also contains some questions connected to the ISO27001:2022 controls.
    The overall impression is very good, which is also reflected in the company score of 3.4, which is one of the highest among the assessments carried out to date.

    I know from experience that the auditor wanted to see objective results of the penetration test and unfortunately that is not available.



    you right Andy:)
     
    afer1964, Mar 20, 2024
    #8
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,110
    Likes Received:
    2,562
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Thanks! Your IATF 16949 auditor is operating out of scope. What they are asking for is NOT A REQUIREMENT. Did they write an non-conformity?
     
    Andy Nichols, Mar 20, 2024
    #9
  10. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,110
    Likes Received:
    2,562
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    If the Certification Body auditor knew anything about cyber security (regardless of the particular content in IATF 16949) they should have asked about the level of awareness of email, sms and other types of phishing attacks by the organizations personnel, including how to respond! Those who have at least got some background in information security can tell you that they pose the biggest threat, since few know a) how to recognize them and b) how to deal with them.
     
    Andy Nichols, Mar 20, 2024
    #10