#automotivecybersecurity

There has been a lot of noise after the recent AIS 189 updates from ARAI. Instead of adding to the confusion, I thought it would be more useful to step back and look at AIS 189 from a practical engineering and compliance perspective. For OEMs, Tier-1 suppliers, partners, and leadership teams, the real question is not whether AIS 189 creates more work. It does. The better question is: How much of this work can be built on top of an existing ISO/SAE 21434 cybersecurity engineering framework? That is the approach I have taken in this article. The intent is to break down AIS 189 in a way that helps organisations understand what can be reused, what needs to be updated, and what needs to be built specifically for the Indian type-approval context. If your organisation has already invested in ISO/SAE 21434, you are not starting from zero. But you do need to understand the regulatory delta clearly especially around CSMS certification, annual reporting, supplier dependencies, cryptographic justification, forensic logging, modification control, and evidence retention. I would be very interested in feedback from OEMs, Tier-1s, testing agencies, cybersecurity teams, and compliance leaders working through this transition. Have a look and share your thoughts. https://sumitchouhan.com/articles/iso-21434-ais-189 #AIS189 #ISO21434 #AutomotiveCybersecurity #CSMS #TARA #VehicleCybersecurity #ConnectedVehicles #TypeApproval #ARAI #IndiaAutomotive #CyberSecurity

Most automotive hashtag#cybersecurity conversations still revolve around one thing - compliance. Pass the audit. Close the findings and move on. And everyone feels good. Until something actually breaks. Attackers don’t care about your audit report. They don’t look at controls in isolation. They look at how everything connects and more importantly, where it doesn’t hold together. That’s exactly where most vehicle programs are still weak. This is where hashtag#ConnectedVehicle hashtag#ThreatSimulation changes the game. This is not another checklist and definitely not another “ISO-aligned assessment”. But actually asking: 1. What happens if someone injects messages inside the vehicle network and pivots through the gateway? 2. What happens when OTA isn’t broken at the crypto layer, but at rollback logic? 3. What happens when V2X data is technically valid… but completely false? 4. What happens when your backend becomes the attack path into the vehicle? Because that’s how real attacks work as chains, not events. and The uncomfortable truth? You can be fully aligned to ISO 21434… and still be vulnerable in production. Standards give you structure. They don’t guarantee resilience. If we don’t start validating vehicles the way attackers think, we’re just building confidence… not security. Reach us today on [email protected] for more information. For hashtag#UAE and other global clients reach us on [email protected] Trojan Hunt India LLP Trojan Hunt International FZ LLC #AutomotiveCybersecurity #ConnectedVehicles #ISO21434 #CyberResilience #VehicleSecurity

India’s 5.9 GHz C-V2X notification is an important step. But opening the band is only the beginning. The Department of Telecommunications has created an exemption framework for Cellular Vehicle-to-Everything communication in the 5875–5905 MHz band, with defined RF limits such as 23 dBm/MHz maximum power spectral density, 33 dBm maximum EIRP, and -30 dBm/MHz out-of-band emissions. That gives connected mobility a clearer regulatory path. But anyone who has spent serious time with RF knows one thing: A band is not “ready” just because it is available. a. It has to be measured. b. It has to be characterised. c. It has to be understood in the field. At 5.9 GHz, the physics is unforgiving. Link margins can disappear quickly. Antenna placement matters. Vehicle shadowing matters. Roadside clutter matters. Multipath, Doppler, interference, congestion, timing drift, and front-end behaviour all matter. On paper, V2X is a packet. On the road, it is a microwave signal trying to survive a very hostile channel. This is where I believe amateur radio experience becomes relevant. Amateur microwave operators around the 5.7 GHz region understand link budgets, antenna gain, feeder loss, receiver sensitivity, noise figure, frequency stability, and the small dB losses that decide whether a signal decodes or disappears. Weak-signal operators understand timing discipline, coding gain, and decoding close to the noise floor. APRS operators have lived through shared-channel congestion, over-beaconing, relay storms, and the limits of polite access protocols. Direction-finding operators understand that detecting a signal is one thing; locating the physical emitter is another. These are not abstract ideas. They are operating realities. That is why I wrote my article: Lessons From the Bands: Amateur Radio Technical Practice as a Resource for V2X Research (https://lnkd.in/gvdkPaHC) V2X should not rediscover old RF lessons the hard way. India has opened the regulatory door. Now we need to build the measurement culture around it: passive roadside sensing, open 5.9 GHz propagation data, interference mapping, congestion studies, timing-resilience experiments, and security models that connect the digital message to the physical signal. Because in V2X, trust does not begin at the packet. It begins at the channel. Check here - https://lnkd.in/g2Rn2rg4 #V2X #CV2X #ConnectedVehicles #AutomotiveCybersecurity #AmateurRadio #India