NCC Group have recently hosted two PHD researchers from the Cybersecurity Centre for Doctoral Training hosted at Universities of Bristol and Bath. These collaborative research placements enable the students to engage with industry on short research projects aligned with their areas of research interest.
In this write up, Deborah Amanor talks about her research looking into security assurance for Co-Operative Intelligent Transportation Systems. Whilst these systems show potential across a wide variety of use cases, they face many hurdles as they have to co-exist with legacy infrastructure and platforms. Safety and security assurance must therefore consider how these complex systems will interact and how threat actors might leverage this complexity to achieve their goals.
Introduction
My PhD research focuses on security assurance for legacy vehicles operating in Cooperative Intelligent Transportation Systems (C-ITS). Modern Connected and Autonomous Vehicles (CAVs) are designed for operational lifetimes spanning decades. However, the security assumptions they were built on erode over time as threats evolve, vendor support ends, and their components can no longer accommodate modern security controls. My research aims to investigate and develop an approach on how these legacy systems can remain trustworthy participants in C-ITS, even as their operational environment evolves and they operate beyond active cyber security support or maintenance.
As part of my CDT training, I undertook a two-week industry placement at the NCC Group Cheltenham office from 13th to 24th July 2026. The placement provided the opportunity to engage with industry experts and stakeholders involved in cyber security and transport technologies, to gain insight on how my research can be aligned with industry needs.
My Experience and What I Learnt
The time I spent with the NCC Group has been nothing short of insightful and rewarding. The discussions with Dr. Liz James and a representative from the Department for Transport (DfT) challenged some of my existing assumptions and shifted my thinking on how to approach my research.
One perspective that emerged from these discussions was the need for an ITS adoption curve to conceptualise and map the progression of ITS deployment. From my discussion with the DfT, I learnt that the UK’s strategy for vehicle integration in the ITS is currently focused on connectivity services and the bandwidth requirement that enable vehicles to receive real-time traffic information (RTTI) from local authorities. Prior to this conversation, I had assumed that vehicle-to-vehicle (V2V) applications were already part of the UK’s ITS landscape and had been considering V2V as a primary application area for my research. However, through this discussion, I discovered that V2V services and the integration of legacy vehicles are not currently priorities within the UK’s ITS roadmap. This prompted me to reconsider the context in which my research is positioned and to recognise the importance of understanding the wider trajectory of ITS development. Developing an ITS adoption timeline will be a useful step in identifying the applications and services being introduced, understanding their maturity, and determining where security assurance challenges are likely to emerge throughout the ITS lifecycle.
I was also prompted to consider alternative use cases to which my research could be applied. One area that emerged during discussions was the maritime sector. Similar to the automotive domain, the maritime industry continues to rely heavily on legacy systems while introducing new digital and automated technologies. Ports, for example, use automation to manage logistics and communications, creating highly interconnected environments that involve multiple stakeholders. What makes this particularly interesting from a research perspective is that the threat landscape is as broad as that of road transport. The coexistence of legacy and modern systems, combined with the large number of stakeholders involved, introduces significant security and assurance challenges. It highlights the complexities of managing security across systems owned and operated by different parties and raises questions about how trust can be effectively managed across such interconnected environments.
Another angle that my research could potentially take is the malicious use of ITS infrastructure itself. This discussion encouraged me to think beyond vulnerabilities in individual vehicles and instead consider the types of messages that are expected to be exchanged within an ITS environment like the Decentralized Environmental Notification Message (DENM) issued when an event or hazard is present. From this perspective, it becomes important to understand what actions a threat actor is likely to take, what is physically and computationally feasible, and how a compromised system might behave in practice. This raised an interesting question: if we assume that an ITS component has already been compromised, are there observable indicators that could reveal the compromise? Rather than focusing solely on preventing attacks, there may be value in identifying outlier behaviours and developing practical heuristics that can be assessed at runtime to detect abnormal system behaviour. This appeared to be an area of particular interest to industry, as runtime monitoring could provide a practical means of identifying security issues within operational ITS deployments.
The discussions also introduced me to the concept of the Operational Design Domain (ODD), which defines the specific conditions and environments in which an automated vehicle is approved to operate. This prompted me to think about the relationship between security and ODD assurance. If a cyberattack alters a vehicle’s operational environment or causes it to operate outside its intended ODD, then safety can be directly affected. For example, the degradation of the ODD for a heavy goods vehicle could have consequences not only for the vehicle itself but also for the surrounding transport infrastructure and road users. This led me to consider how security assurance can be used to maintain confidence that a vehicle is operating within its approved ODD, and how policy and regulation may support this objective. Exploring the provisions within the Automated Vehicles Act could provide useful insight into how assurance requirements are being formalised and how incentives can be created for manufacturers and operators to maintain secure and safe operation throughout the vehicle lifecycle.
Summary and Action Plan
This placement has influenced the way I think about my PhD and the different directions my research could take. The discussions have revealed the challenges that industry is actively concerned about and the areas where future security assurance challenges are likely to emerge in the ITS. As I continue to refine the scope of my research, these conversations have helped me think more critically about how to position my work so that it remains both academically relevant and aligned with industry needs. Going forward, I plan to take the following actions:
- Develop an ITS Adoption Curve: I plan to develop an ITS adoption curve to map the progression of ITS technologies within the UK. This will help me understand the maturity of different ITS applications and identify where future security challenges may arise.
- Explore Simulation of DENM: Using simulation environments like OMNeT++ and VEINS framework, I plan to explore potential protocol vulnerabilities and misuse scenarios of DENM and how that could impact the integrity of the ITS.
I am grateful for the opportunity to spend time with the NCC Group and for the connections that were established through this placement. As my research develops, I hope to continue leveraging these relationships to test my assumptions, gain industry feedback, and ensure that the challenges I am investigating remain grounded in real-world needs and deployment realities.