Identity for Automotive

The job identity does in automotive

Automotive identity spans three populations: employees with a large dealer and supplier network, the connected vehicles and backends, and consumers using owner apps. They meet in one place: the dealer portal or admin panel a staff member logs into can also reassign which consumer account controls a car, so a workforce identity flaw becomes a vehicle-control flaw.

Machine identity is the other half: every vehicle, ECU and backend needs cryptographic identity and certificate lifecycle across a vehicle lifetime measured in decades. See what is machine identity.

The identity threat picture

The Identity Breach Database has no incident tagged to automakers. The closest record is Advance Auto Parts, a parts retailer whose password-only Snowflake account gave up data on 2,316,591 job applicants and employees in 2024. The sector's best evidence comes from company notices and researcher disclosures:

Dealer portal to vehicle control (Kia, 2024). Researchers reported that anyone could register an account on Kia's dealer portal using the same API format as the owner site. The resulting access token could query dealer endpoints: look up a vehicle by VIN, read the owner's name, email and phone, demote the owner and add the attacker as primary owner. That gave remote door locks, engine start and location in about 30 seconds from a license plate, on most vehicles made after 2013. They reported it on 11 June 2024. Kia said it was remediated by 14 August and that it was never exploited maliciously.

Admin panel takeover through password reset (Subaru, 2025). In the Subaru STARLINK case, an admin portal password reset endpoint accepted employee email addresses without a confirmation token, and the 2FA prompt was a client-side overlay that could be removed. Access allowed a year of location history accurate to within 5 meters, remote engine and door-lock commands, and adding an authorized user to a vehicle. Reported on 20 November 2024, it was fixed the next day.

A cloud key left in public code (Toyota, 2022). Toyota said a website development subcontractor had uploaded part of the T-Connect site's source code to a public GitHub repository in December 2017, against its handling rules. The code contained a data server access key, and 296,019 customer email addresses and customer management numbers were exposed until Toyota made the repository private on 15 September 2022 and changed the keys two days later. See secrets in repositories and CI.

All three are authorization and lifecycle failures in enterprise identity, not attacks on vehicle cryptography.

The regulatory floor

• UN Regulation No. 155 (cybersecurity and CSMS). In force since 22 January 2021. Manufacturers need a Certificate of Compliance for their Cybersecurity Management System, valid for a maximum of three years, covering development, production and post-production, including how they manage dependencies on suppliers. Annex 5's threat list puts identity first: "abuse of privileges by staff (insider attack)" and "unauthorized internet access" to back-end servers, "extraction of cryptographic keys," and unauthorized access to the owner's personal data, including the vehicle's electronic ID. Paragraph 7.3.8 requires cryptographic modules in line with consensus standards.
• UN Regulation No. 156 (software update and SUMS). In force on the same date. Paragraph 7.2.1.1 requires that "the authenticity and integrity of software updates shall be protected," so signing keys and who can use them fall inside type approval.
• EU application. The General Safety Regulation (EU) 2019/2144 made protection against cyberattacks a type-approval item: EU type approval was refused to new types without it from 6 July 2022, and registration of non-compliant new vehicles has been prohibited since 7 July 2024.
• ISO/SAE 21434:2021 (Road vehicles, cybersecurity engineering) defines cybersecurity engineering across the vehicle lifecycle. It is voluntary, but a practical way to structure the process evidence an R155 audit asks for.
• NIS2. Annex II covers manufacture of motor vehicles, trailers and semi-trailers (NACE C29), with access control policies and MFA under Article 21(2). Member States review entity lists by 17 April 2027. See identity controls for NIS2.
• US connected vehicle rule. The Commerce Department's final rule, effective 17 March 2025, prohibits transactions involving vehicle connectivity system hardware and covered software from persons linked to China or Russia. The software prohibitions start with model year 2027 and hardware with model year 2030. It forces an inventory of who supplies the telematics stack that holds vehicle identity.
• Privacy. Owner and telematics data falls under GDPR and CCPA/CPRA.

Owner accounts and connected-car identity

• Ownership transfer is an authorization event. Changing a car's primary owner should require proof tied to the vehicle and notify the current owner, never a dealer API call alone, which was Kia's flaw.
• Resale and shared cars. Previous owners keep app access unless the sale triggers revocation. Build deprovisioning into the title transfer.
• Consumer authentication. Owner apps that open and start a car warrant passkeys and step-up authentication for remote commands, with account takeover monitoring. See what is CIAM.

The identity controls that matter most

1. Server-side authorization on every dealer and admin API. Registration should not grant dealer rights, and 2FA must be enforced by the server, not the browser. Use ReBAC or ABAC policies tying each dealer to its own vehicles.
2. Phishing-resistant MFA and verified resets for staff and dealer users. Subaru's admin panel fell to a reset flow. See phishing-resistant MFA and account recovery.
3. Governed dealer and supplier access. Time-bound access with access certification, and automatic removal when a dealer employee leaves. See IGA.
4. Secrets scanning across supplier code. Toyota's key sat in public for almost five years. Scan supplier repositories too, and prefer short-lived credentials. See secrets management.
5. Vehicle PKI as a lifecycle, not a one-time issuance. Per-vehicle credentials, automated rotation and revocation, and hardware-protected signing keys for over-the-air updates. See PKI and the certificate lifecycle management guide.
6. PAM for plant-floor and telematics backends. Insider abuse of back-end privileges is the first threat R155 lists. See PAM.

Vendors and fit

• Workforce and dealer identity: Microsoft Entra ID or Okta, with SailPoint for dealer and supplier governance. See best IAM for enterprises and best IGA tools.
• Owner apps: Auth0, Microsoft Entra External ID or LoginRadius. See best CIAM for high scale.
• Vehicle and device PKI: Keyfactor or DigiCert. See best machine identity for enterprises.
• Secrets: GitGuardian for repository scanning and HashiCorp Vault for short-lived credentials. See best secrets management tools.
• Privileged access: Idira (formerly CyberArk); see best PAM for enterprises.

Background: identity for automotive.

Common pitfalls

• Dealer APIs that let any authenticated account act on any VIN.
• MFA enforced in the browser instead of on the server.
• Vehicle PKI treated as one-time issuance.
• Previous owners who keep app control after a sale.

Where it is heading

Software-defined vehicles make certificate automation central, CSMS certificates need renewal at least every three years under R155, and the US connected vehicle rule applies to software from model year 2027.

Frequently asked questions

What does UN R155 require for identity?

A certified Cybersecurity Management System whose risk assessment covers the Annex 5 threats, including staff privilege abuse, back-end server access, key extraction and access to owner data. It does not prescribe products.

How did researchers take over Kia vehicles?

By registering on Kia's dealer portal, which issued a token that could look up any VIN and reassign the vehicle's owner account. Kia said it fixed the flaw by August 2024 and that it was never exploited maliciously.

Is ISO/SAE 21434 mandatory?

No. It is a voluntary engineering standard. UN R155 is the mandatory rule for type approval in the EU and other UNECE 1958 Agreement parties that apply it.

Does NIS2 apply to car makers?

Yes, motor vehicle manufacturing is in Annex II, subject to the Directive's size thresholds.