Supplier Delocalization: A Threat to Automotive Cybersecurity Knowledge Sharing

Computing technologies have transformed the automotive industry, leading vehicle manufacturers and component suppliers to develop and integrate ever more technologically complex components into the modern connected vehicle. In the unrelenting search for sustainable competitive advantage, automotive manufacturers are driven to develop more reliable and safer products, at the same time as promoting product personalisation, higher quality, increased functionality and lower costs. The creation of new digital products is a complex task, characterised by uncertainty, variability and the threat of cybersecurity breaches. These innovations require cooperation across multiple fields of expertise, some of them new to automotive design, development and production. Globalisation and delocalisation continue to introduce new opportunities, but increase competition. Delocalisation of suppliers occurs both physically and virtually, globally dispersed component suppliers jealously guard intellectual capital (component specific knowledge and integration processes) but do not have access to the product architectural knowledge of OEMs. At the same time the knowledge domains which are critical in the modern automotive industry are remote from those which have historically been core to competitive success.The potential risks inherent in a cyber-vulnerable connected or autonomous vehicle affect all stakeholders in the automotive industry from vehicle designers and manufacturers to vehicle end-users. Component specific and architectural knowledge sharing between vehicle manufacturers and their globally dispersed supply chain brings cybersecurity knowledge sharing challenges to the fore. This paper argues that the challenge of cybersecurity knowledge sharing is magnified by globalisation and the delocalisation of suppliers. As vehicle manufacturers try to incorporate the same scalable architecture for chip-based systems and software that has been built into computer systems for many years, the need for cybersecurity knowledge-sharing has never been greater. However, in practice it has not been easy to capture cybersecurity knowledge and to apply it effectively in component design, development and integration processes for cyber-vulnerable components. This maybe particularly the case where supply chains are characterised by delocalisation.This paper draws on the results of survey which focused on the automotive cybersecurity knowledge sharing approaches employed by component suppliers in the design and development of digital components for connected vehicles. The key areas of investigation were the ways in which component suppliers shared component specific information with vehicle manufacturers, how they acquired relevant architectural knowledge from OEMs and the identification and analysis of the barriers to cybersecurity knowledge sharing contingent on the current structure of the automotive supply chain.Keywords: Cybersecurity knowledge-sharing, connected vehicles, automotive supply-chain, delocalisation.