Course in Vulnerability Management for Connected Vehicles
Online 300 h course in vulnerability management for connected vehicles. 6 modules with ISO/SAE 21434 (cybersecurity engineering), UNECE R155 (cybersecurity) and Wireshark. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the attack surface of a connected vehicle.
Apply the vulnerability management lifecycle of ISO/SAE 21434.
Design mechanisms for detecting and monitoring threats across a fleet.
Assess vulnerabilities through security analysis and testing.
Prioritise vulnerabilities using CVSS metrics and risk analysis.
Plan remediation through updates in line with UNECE R156.
Develop a vulnerability management process for a manufacturer.
Who it's for
- Automotive cybersecurity analyst wishing to specialise in Vulnerability Management in Connected Vehicles.
- Vulnerability management engineer wishing to specialise in Vulnerability Management in Connected Vehicles.
- VSOC analyst wishing to specialise in Vulnerability Management in Connected Vehicles.
- Penetration testing engineer wishing to specialise in Vulnerability Management in Connected Vehicles.
- Incident response manager wishing to specialise in Vulnerability Management in Connected Vehicles.
- OTA update engineer wishing to specialise in Vulnerability Management in Connected Vehicles.
- Engineering or science graduates looking to enter the automotive industry.
What you'll work with
- ISO/SAE 21434 (cybersecurity engineering)
- UNECE R155 (cybersecurity)
- UNECE R156 (software updates)
- ISO/IEC 29147 (vulnerability disclosure)
- ISO/IEC 30111 (vulnerability handling)
- ISO 24089 (software updates in road vehicles)
- CVSS (vulnerability scoring system)
6 modules · 300 h
1.1E/E architecture and domains1.2CAN, LIN, FlexRay and Ethernet buses1.3External interfaces: OBD, telematics and V2X1.4Infotainment and mobile connectivity1.5Keys and keyless entry1.6Electric vehicle charging: ISO 151181.7Cloud and backend services1.8Documented historical attacks1.9Sources of vulnerabilities: CVE and Auto-ISAC1.10Case study: attack surface mapping
2.1UNECE R155 requirements2.2Clauses 8 and 13 of ISO 214342.3Cybersecurity monitoring2.4Triage of cybersecurity events2.5Vulnerability analysis2.6CVSS scoring and its adaptation2.7Attack feasibility and impact2.8Treatment decision2.9Coordinated vulnerability disclosure2.10Workshop: triaging a vulnerability advisory
3.1Intrusion detection systems (IDS)3.2Vehicle Security Operations Centre (VSOC)3.3Security telemetry and logs3.4Threat intelligence3.5SBOM and component management3.6Software dependency analysis3.7Firmware scanning3.8Indicators of compromise3.9Fleet event correlation3.10Practice: analysing VSOC alerts
4.1Vehicle penetration testing4.2CAN and Ethernet protocol fuzzing4.3Firmware and binary analysis4.4ECU attacks and JTAG debugging4.5Wireless interface testing4.6Cybersecurity laboratory tools4.7Testing methodology and scope4.8Ethics and legality of testing4.9Bug bounty programmes4.10Laboratory: fuzzing on a CAN bench
5.1Patching and prioritisation5.2OTA updates and UNECE R1565.3SUMS and version management5.4Security of the update chain5.5Temporary mitigations5.6Communication with customers and authorities5.7Cybersecurity recall campaigns5.8End-of-support management5.9Remediation time metrics5.10Case study: response to a keyless entry vulnerability
6.1Selection of vehicle or ECU6.2Component inventory and SBOM6.3Monitoring sources6.4Triage process6.5Sample vulnerability analysis6.6Remediation plan6.7OTA integration6.8Process indicators6.9Report and presentation6.10Final review with the tutor
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the intake, which makes it possible to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Vector CANoe, Ghidra, Splunk, in free, academic or evaluation versions. Tests are studied using real procedures from vehicle penetration testing laboratories, monitoring in a Security Operations Centre (VSOC), and OTA update testing. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Identify the attack surface of a connected vehicle.
Apply the vulnerability management lifecycle of ISO/SAE 21434.
Design mechanisms for detecting and monitoring threats across a fleet.
Assess vulnerabilities through security analysis and testing.
Prioritise vulnerabilities using CVSS metrics and risk analysis.
Where this takes you
Requirements
- No prior degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours spread over 3 to 5 months. That is between 10 and 15 hours per week on average, compatible with a full-time job.
You will work with Wireshark, Vector CANoe, Ghidra and Splunk. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
An in-house diploma from SEIUM Institute upon passing the continuous assessment and the integrative project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or Postgraduate Diploma in the same area are recognised towards the advanced programme. Check the recognition policy when you enrol.
Related programmes
Course in Multimodal Technical Expert Assessment of Incidents
Online 300-hour course in multimodal technical expert assessment of incidents. 6 modules covering Ley 1/2000 de Enjuiciamiento Civil (expert evidence), UNE 197001 (criteria for preparing expert…
HFACS Methodology in Human Causes Course
Online course of 300 hours in HFACS methodology for human causes. 6 modules covering ICAO Annex 19 (Safety Management), ICAO Doc 9859 (Safety Management Manual) and…
Course in Technical Evidence for Regulatory Authorities
Online 300-hour course in technical evidence for regulatory authorities. 6 modules covering ISO/IEC 17025 (laboratory competence), ISO 14971 (risk management) and Adelard ASCE. Assigned tutor and…
More in Regulation, Safety, RAMS & Homologation
All Regulation, Safety, RAMS & Homologation programmes → · How to apply · Fees & financing · Scholarships