GM and the delicate dance of automotive cybersecurity - Roadshow

"We're deploying a defense and depth strategy, so defensive systems in layers on our vehicles," said Massimilla. "We're engineering our systems to be upgradable over time, to be able to address vulnerabilities as they're identified."

And while that inteal red team will be doing their best to identify those flaws early, Massimilla and his team are realistic enough to know that they'll never test every possible combination. For that they need outside help.

To get that, General Motors is partnering with HackerOne, a company that helps organizations of all sizes connect with security researchers around the globe. Through HackerOne, companies can go so far as to post bug bounties, giving independent hackers financial incentive to report findings through the right channels.

"We're very, very good in the automotive space," said Massimilla. "But interacting with researchers is a bit of a new field for us, so leveraging relationships with something like HackerOne will be very valuable."

Massimilla is also ensuring GM takes a leadership role at the various automotive standards bodies, chairing the FCA group for cybersecurity, and Massimilla himself serving as Vice Chair of the Auto Alliance's Information Sharing and Analysis Center (ISAC), an industrywide collaboration focused on information-sharing and threat-identification.

2017 Chevy Bolt in the flesh at CES... See full gallery

1 - 5 of 29

Next Prev

It's a delicate balance, though, as the road to cybersecurity is littered with the bodies of those corporate entities that were too confident in their abilities. "You never say you're a leader in this space, because it puts a target on you. But at the same time we're operating in a way that we're developing leadership. The resources that we're developing are to put us in a good position."

One of the major conces surrounding automotive cybersecurity has to do with researchers' ability to dig into these systems. Indeed, thanks to bills like that proposed last year by National Highway Traffic Safety Administration, the very act of an outsider looking for a vulnerability within a car's systems may become illegal. Massimilla takes a pragmatic stance on the situation: "There's been a lot of bills, a lot of discussion on Capital Hill on many aspects around cybersecurity... Right now there's nothing out there that says it is illegal, and therefore we want to embrace it as an organization."

That said, there's a limit to the amount of openness that General Motors can offer. "Security through obscurity is a really bad idea," Massimilla said. "At the same time, automotive systems are extremely complex." The amount of proprietary systems involved, often from third-parties, means that taking the drastic step of going open source isn't really an option here.