Great points summarized. What's baffling is that Porsche determined to take the tougher route ahead, induced less confidence from potential customers for next gen mode! There are examples of AAOS update on previous PCM hardware from
Electronic Section of this forum.
Note: Not affiliating with third party upgrade, just to point out it can be done with either software update or PCM upgrade if Porsche choose to remediate potential vulnerability. Leaving tens of thousands of previous Porsche models with vulnerable PCM OS/Software will potentially cause Porsche greater financial impact than fixing the old one!
If cybersecurity has to be baked-in as day-1 design, most likely it's affecting at the network communication level, at the worst, existing Porsche lineups (or Macan ICE) can turn off the cellular connection (manually configuration or via software patch), only allow critical firmware/software update at the Authorized Service Department. Remote attacker won't be able to penetrate without the network connectivity in the first place. Supposedly ICE models can operate and transport without cellular connection!
@grim shared
UNECE R155 article, an interesting read on Cybersecurity Management System (CSMS):
- Physical access control — address threats related to unauthorized physical access to vehicle components (e.g., tampering, theft intrusion).
- Network security — involve threats to the vehicle's internal and external communication networks (e.g., hacking, malware, interception).
- Software security — identify risks associated with the software running on the vehicle, including its operating system and applications (e.g., exploits, injection, unauthorized access).
- Data privacy and protection — pertain to threats targeting the confidentiality and integrity of data collected and processed by the vehicle (e.g., breach, tampering, unauthorized access).
- Operational security — detail threats that impact the vehicle's operational functionality and safety systems come into play (e.g., manipulation, disruption, interference).
- Remote access control — highlight risks associated with remote access to the vehicle’s systems, often through wireless connections (e.g., hijacking, exploitation, unauthorized access).
- Supply chain security — cover threats originating from vulnerabilities within the supply chain, including those from third-party suppliers and service providers (e.g., malicious attacks, vulnerabilities, counterfeit components).
Network and software related items can be addressed with software or PCM update at a cost, another half are applicable to all other Porsche models.
Turn off network, turn off apps, just enjoy the sound of driving!