Shifting Gears: Integrating Security Audits into Automotive DevSecOps

The accelerated expansion of the automotive industry is concurrently experiencing a shift towards Software Defined Vehicles (SDVs) and centralized E/E architectures. This transition, while simplifying hardware, introduces new potential attack vectors and escalates the overall system complexity. This complexity multiplies as the automotive systems involve n-tier suppliers, with components delivered and integrated separately, providing attackers with fresh vulnerabilities to exploit. The high cost of rectifying vulnerabilities in production has compelled Original Equipment Manufacturers (OEMs) to adopt proactive security measures within their DevOps. The industry is now adopting "shift-left" strategies, incorporating cybersecurity tools into their CI/CD pipelines, and starting to realize that security is more of a process than a feature. Although the current DevOps toolchain addresses a significant portion of security best practices, a critical gap persists are the ability to perform an automated security audit. This paper investigates the need for the automated security audit as part of the DevOps and its and proposes a usable security methodology that Original Equipment Manufacturers (OEMs) and n-Tier suppliers can utilize to bolster their product security.