System and method for providing fleet cyber-security
A system and method for providing fleet cyber-security comprising may include collecting, by a plurality of data collection units installed in a respective plurality of vehicles in the fleet, information related to cyber security and including the information in reports to a server. Data in reports may be aggregated, by the server. A cyber-attack may be identified based on aggregated data.
1 . A system for providing cyber-security to a fleet of vehicles, the system comprising:
a server included in a security operations center (SOC) managing cyber-security of the fleet, the server comprising:
a memory; and
a processor adapted to:
receive from a plurality of data collection units (DCUs) installed in a respective plurality of vehicles in the fleet, a plurality of reports, the reports including information collected by the DCUs and related to cyber security;
correlate data received from a first DCU with data received from a second DCU, wherein correlating includes identifying software common to a plurality of vehicles and associating a vulnerability of the identified common software with the attack; and
based on the correlation, identify a source of a cyber attack.
2 . The system of claim 1 , wherein an identified source of the attack is a device included in a plurality of vehicles.
3 . The system of claim 1 , wherein an identified source of the attack is a communication system serving a plurality of users or vehicles.
4 . The system of claim 1 , wherein an identified source of the attack is a service.
5 . The system of claim 1 , wherein the source of the attack is identified based on a sequence of events which is common to a plurality of vehicles.
6 . The system of claim 1 , wherein the source of the attack is identified based on identifying a common event occurring at a common time.
7 . The system of claim 1 , wherein the source of the attack is identified based on a common service facility.
8 . The system of claim 1 , wherein identifying a source of the attack includes identifying a specific network address.
9 . The system of claim 1 , wherein the processor is further adapted to identify a geographic area related to the attack.
10 . A method of providing cyber-security to a fleet of vehicles, the method comprising:
receiving from a plurality of data collection units (DCUs) installed in a respective plurality of vehicles in the fleet, a plurality of reports, the reports including information collected by the DCUs and related to cyber security;
correlating data received from a first DCU with data received from a second DCU, wherein correlating includes identifying software common to a plurality of vehicles and associating a vulnerability of the identified common software with the attack; and
based on the correlation, identifying a source of a cyber attack.
11 . The method of claim 10 , wherein an identified source of the attack is a device included in a plurality of vehicles.
12 . The method of claim 10 , wherein an identified source of the attack is a communication system serving a plurality of users or vehicles.
13 . The method of claim 10 , wherein an identified source of the attack is a service.
14 . The method of claim 10 , wherein the source of the attack is identified based on a sequence of events which is common to a plurality of vehicles.
15 . The method of claim 10 , wherein the source of the attack is identified based on identifying a common event occurring at a common time.
16 . The method of claim 10 , wherein the source of the attack is identified based on a common service facility.
17 . The method of claim 10 , wherein identifying a source of the attack includes identifying a specific network address.
18 . The method of claim 10 , further comprising identifying a geographic area related to the attack.