Roadmaps Security roadmaps Specialised and emerging
Secure vehicles and the systems that move people and goods: in-vehicle networks and ECUs, connected car services, V2X, EV charging, and the rail, aviation and maritime systems with their own rules.
Estimated time: 15–30 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
ECUs, domain controllers, gateways and the move to zonal and software-defined vehicles. Learn what talks to what and where the trust boundaries are.
CAN, CAN FD, LIN, FlexRay and automotive Ethernet. CAN has no authentication; understand how it works and why that shapes everything.
Telematics, infotainment, Bluetooth, key fobs, diagnostics ports, charging and apps. Study the published research to see how they have been reached.
Functional safety (ISO 26262) and cybersecurity must be engineered together. A security flaw that affects a safety function is the worst case.
Each has its own systems, standards and regulators: signalling and train control, avionics and air traffic, ship bridge and cargo systems. Learn the landscape.
UNECE R155 and R156 for vehicles, EASA and FAA rules for aviation, IMO for shipping, NIS2 for transport operators. Know what applies to your products and operations.
The standard for automotive cybersecurity engineering: organisation, project processes, threat analysis, concept, development, validation and post-production. Learn the work products.
TARA identifies assets, damage scenarios, threats, attack paths and risk for a vehicle item. It is the core 21434 activity; learn to do it well.
Secure boot, hardware security modules, secure diagnostics, debug locking and memory protection on automotive microcontrollers.
Message authentication on CAN (SecOC), gateway filtering, intrusion detection on the bus, and the stronger options automotive Ethernet brings.
Telematics units, backend APIs, mobile apps and over-the-air updates. Apply API, cloud and mobile security, and protect the vehicle identity and keys.
Signed, staged, resumable updates with rollback protection and safety checks, managed under R156. An OTA system is also the most valuable thing to attack.
Vehicles talk to each other and to roadside units with signed messages under a dedicated PKI. Learn the security architecture and its privacy design.
Chargers, charge point operators and grid links use ISO 15118 and OCPP. Charging is a growing attack surface for both vehicles and the grid.
Fuzz the buses and diagnostics, test ECUs, telematics and apps, and validate the security concept, in your own lab or with explicit authorisation.
Monitor fleets for attacks and anomalies, handle vulnerability reports and run incident response for vehicles in the field, as R155 requires.
Signalling, train control and operational systems follow IEC 62443-based standards such as TS 50701. Treat them as OT with safety certification constraints.
Avionics, ground systems and airport operations; ship bridge, engine and cargo systems. Both sectors now have mandatory cyber risk management.
R155 requires an organisation-wide CSMS covering development, production and post-production. Build and run it across suppliers and product lines.
Tier suppliers build most of the vehicle. Flow security requirements and evidence down the chain and verify them.
Set the security vision for vehicles, infrastructure and operations, aligned to safety, regulation and the shift to software-defined systems.
A modern vehicle is a network of dozens of computers on wheels, connected to the manufacturer, to apps and to road infrastructure. Rail, aviation and maritime systems are similar: safety-critical, long-lived, increasingly connected and now regulated for cybersecurity.
Transportation security combines embedded and OT skills with sector regulation. For vehicles, ISO/SAE 21434 and UNECE R155 define how security must be engineered and managed across the lifecycle. The work ranges from threat analysis of a new vehicle platform to securing charging networks and fleet telematics.
A security flaw in a vehicle or transport system can cause physical harm at scale, and regulators now require demonstrated cybersecurity management before vehicles can be sold. The sector needs engineers who understand both the vehicle and the standards.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact