The e-mobility industry is complex with many layers and stakeholders. The communication chain is long, and a lot of business-related and personal data is exchanged. With mass EV adoption and big players entering the industry, the need to protect all the information and even the grid has increased manifold.
Like electric vehicles, the EV charging ecosystem is an easy target for cyber security threats. Violations by malicious actors can make EV chargers unusable and even jeopardise grid security.
Why should you worry?
A plug-in EV is connected to a charge station, which is then connected to the back-office system of a charge point operator (CPO), or to a third-party platform provider, like GreenFlux. This is where all the magic takes place to offer a seamless experience to EV drivers.
Drivers use RFID cards or mobile apps to start and pay for charging sessions. For interoperable networks or EV roaming, the back-office system is connected to many e-mobility service providers (eMSPS) and other entities. There is data generated about location, charging time, and average power drawn during every charging session. The data is used for driver authorisation, setting prices, preparing invoices, and troubleshooting charge point errors, to name a few.
Due to the high degree of connectivity and data exchange, this communication chain is most prone to security breaches. Research shows an EV infected by malware can also infect the charge station and other EVs that charge using the same station. And the mobility of EVs can be used to spread the malware to other charge stations. Or hackers can target the data exchange between the charge point and the back-end platform and mobile app. Or firmware updates and physical charge points can be exposed to unauthorised interference.
To safeguard this data, a CPO can make sure its communication chain with all involved stakeholders is safe. This can be done by ensuring all its partners have information security measures in place. Or a CPO can opt for an ISO 27001 certified back-end provider who would ensure no unauthorised person can alter the communication in the EV charging ecosystem.
What is ISO 27001 certification?
Information security is an overarching term referring to processes and methodologies in place for protecting all kinds of information, including customers’ personal data.
ISO 27001 is the widely known international standard focussed on information security. The standard provides an outline to protect the data through a set of standardised policies and procedures.
ISO 27001 mandates maintaining an accurate information security management system (ISMS) and assures high-level security as it:
- Provides an excellent framework to protect data and information from any form of unauthorised access.
- Defines plan-do-check-act (PDCA) cycles for critical security processes.
- Detects and prevents security breaches.
- Complies with legal requirements.
- Adopts a management process to ensure information security controls meet the organisation and its customers’ security requirements.
Why does GreenFlux care?
We are a multi-tenant SaaS company that offers an EV charging management platform to CPOs and EMSPs for managing their operations. We are proudly ISO 27001 certified, meaning an independent auditor confirms the authenticity of our security measures every year. This confirms security is one of the core pillars and backbone of our company’s business as for us:
- Information is an asset: We deal with a lot of confidential data via charge tokens and charge cards that generate customers’ personal information. In some cases, company-wide information and data about customers’ core businesses are available in our platform. We consider information as an asset and take responsibility to protect this data.
- Trust is a must: We believe our customers must completely trust us and our platform. And we have gained this faith by adhering to high-level security standards, having our baseline security measures in place, and committing to always safeguarding data. The ISO certification further confirms that we are a reliable and responsible partner in the EV market.
- Data must be encrypted: As all information is processed in the cloud, any security breach within the chain of communication can impact EVs, charge stations, or even the grid. To prevent this from happening, all important data processed by our platform is always encrypted.
- Staff needs to be trained: Our employees are trained to deal with confidential data. This applies not only to digital data, but also to physical information in the office. We follow a clean desk policy and physical documents are handled based on the classification (public, confidential, secret, etc.), among other things.
- Damage control matters: In case of cyber threats, we have a robust backup and recovery mechanism ready in case of data loss. GreenFlux recently completed its yearly surveillance audit wherein it was praised for its efficient disaster management process in place.
- Continuous evaluation is mandatory: Our team of security experts regularly monitors and updates the security measures. We follow feedback loops, known as PDCA (plan-do-check-act), which helps in continuously examining risks and re-evaluating adequate measures.
What should you do?
To grow as a CPO in the industry, you want to keep your business and customers’ data safe and secure.
You can easily and smartly do this by opting for an ISO 27001 certified back-end provider, like GreenFlux, for managing your EV charging operations.
With great power comes great responsibility – be a responsible CPO in the industry and expand your business safely with us! Give us a shout.
