Objective
Modern automotive security extends far beyond isolated CAN Bus attacks. With the increasing complexity of connected vehicles, security practitioners must understand not only how to identify and exploit weaknesses in in-vehicle networks, but also how to assess their impact and design practical defensive strategies.
This workshop is designed to provide participants with a hands-on understanding of modern automotive cybersecurity by combining in-vehicle network security, CAN and UDS security testing, Threat Analysis and Risk Assessment (TARA) aligned with ISO 21434, and an applied introduction to CAN Intrusion Detection Systems (IDS).
Through guided practical exercises using open-source tooling and vulnerable automotive lab environments, participants will learn how to analyze vehicle communication, perform protocol-level security assessments, map exploitation paths to risk outcomes, and explore practical detection approaches for identifying malicious activity on CAN networks.
Course Content
Day 1: Foundations of Automotive Security, Vehicle Architecture & Risk Assessment
Session 1: Introduction to Modern Automotive Security
- Evolution of automotive cybersecurity
- Modern vehicle architectures and ECUs
- Trust boundaries in connected vehicles
- Defining the automotive attack surface
- Current trends in automotive penetration testing
Session 2: Threat Analysis and Risk Assessment (TARA)
- Introduction to TARA in the context of ISO 21434
- Item definition and asset identification
- Damage scenarios and threat scenarios
- Attack path analysis
- Feasibility rating and impact assessment
- Technical and business risk quantification
Session 3: Controller Area Network (CAN) Fundamentals
- Introduction to CAN protocol and communication model
- CAN frame structure and arbitration
- Practical understanding of CAN message flow
- Tooling setup for hands-on exercises
- Introduction to the vulnerable lab environment
Day 2: Practical CAN Exploitation & Security Assessment
Session 4: Hands-on CAN Traffic Analysis
- Capturing and interpreting CAN traffic
- Identifying meaningful communication patterns
- Sniffing, replaying, and observing ECU behavior
Session 5: CAN Packet Injection & Manipulation
- Crafting and transmitting CAN messages
- Message tampering and practical effects
- Replay and manipulation techniques in a controlled environment
Session 6: Protocol-Level CAN Attacks
- Bus Off attack
- Overload / denial-style abuse scenarios
- Double Receive attack
- Attack chaining and impact demonstration
- Discussion on safety, cybersecurity, and operational implications
Session 7: Mapping Exploitation to Risk
- Connecting practical attack findings back to TARA
- Evaluating exploit feasibility and business impact
- Automotive CIA considerations
- Risk alignment and mitigation prioritization
Day 3: CAN IDS & Defensive Engineering
Session 8: CAN IDS – Detection, Monitoring & Response
- Why intrusion detection matters in automotive networks
- Signature-based and anomaly-based detection approaches
- Detecting replay, injection, flooding, and abnormal message behavior
- Building practical detection logic using open-source tooling/scripts
- Understanding false positives, limitations, and tuning considerations
- Mapping CAN IDS alerts to attack scenarios and risk outcomes
Session 9: Mitigation, Hardening & Wrap-Up
- Defensive strategies for CAN and diagnostic security
- Risk-based mitigation planning
- Hardening considerations for in-vehicle communication
- Open discussion on real-world constraints and implementation challenges
- Final recap, Q&A, and practical discussion
Note to the attendees
This workshop is designed to be highly interactive and hands-on. While the core structure and learning objectives will remain consistent, selected modules especially the CAN IDS segment and supporting practical exercises may be further curated based on audience profile, live feedback, and the pace of the session. This allows the training to remain adaptive and aligned with the workflow of the participants while preserving the overall agenda and intended learning outcomes.
