An EV charging network is a strange security animal. It's an IoT fleet — thousands of computers bolted to walls in public places. It's a payment system — sessions become invoices. And increasingly it's grid-adjacent infrastructure whose aggregate load is big enough to matter. Each identity brings its own threat model, and a network is only as strong as the weakest of the three.
This is a practitioner's tour of the layers, and the controls that earn their keep at each one.
Layer 1: the charger itself
The charger is the exposed edge: physically accessible, often unattended, sometimes in places where someone with a screwdriver and ten minutes attracts no attention.
What matters most:
- Firmware currency. Most real-world IoT compromises exploit known, already-patched vulnerabilities. The security value of a rollout system that makes updates routine is hard to overstate — a fleet you can patch quickly is a fleet whose vulnerability window is measured in days, not years.
- No shared secrets across the fleet. Every charger needs its own credentials. A fleet-wide password means one opened enclosure compromises the estate.
- Local interfaces. Maintenance ports, Bluetooth commissioning modes and debug interfaces should be disabled or authenticated in production configuration — and verified so, via config auditing, not assumed so.
- Physical tamper evidence. You won't stop a determined attacker with an enclosure lock, but tamper detection plus monitoring that notices behavioural change turns silent compromise into a visible incident.
Layer 2: the connection
Charger-to-backend traffic crosses public networks — usually cellular — and carries everything from meter values to firmware URLs.
OCPP formalises this as security profiles: from basic authentication over TLS up to mutual TLS with client certificates on the charger. The pragmatic guidance:
- TLS is the floor. Unencrypted OCPP has no place in production, full stop.
- Aspire to certificates, tolerate reality. Mutual TLS (profile 3) is the destination, but certificate lifecycle on embedded devices is genuinely hard — expiry, renewal, clock drift on devices that boot after months offline. A backend must handle the mix a real fleet presents, enforcing the strongest profile each device supports rather than the weakest the fleet shares.
- Firmware delivery is part of the trust chain. Signed artifacts, checksum verification before apply, and download over authenticated channels — the update mechanism is the most valuable thing to subvert, so it gets the most protection.
Layer 3: the platform
The backend concentrates everything: every charger, every session, every tariff. It is where an attacker gets the most leverage, and where the controls are most conventional — which is good news, because conventional controls are well understood:
- Identity done properly. Role-based access with least privilege — support restarts chargers but doesn't edit tariffs; finance reads reports but doesn't touch devices. Scoped API credentials per integration (a reporting integration holding write scopes is an incident waiting for a leaked key). Tenant isolation enforced at the platform layer, so one operator's compromise can't traverse to another's estate.
- Audit as a first-class feature. Every sensitive action — remote command, tariff change, rollout approval, permission grant — recorded with who, what, when. Audit trails are both deterrent and forensic capability, and tender evaluators increasingly ask to see them. (This is why every sensitive action in the AmpNexus platform lands in an immutable log.)
- Boring operational hygiene. Patched dependencies, secrets in vaults rather than config files, backups that are restore-tested. The unfashionable list that prevents the fashionable headlines.
Layer 4: process — where certifications fit
Certifications don't secure anything by themselves; they evidence that a discipline exists and is externally checked. Cyber Essentials demonstrates baseline hygiene is in place; ISO 27001 demonstrates a management system that keeps it in place as the organisation changes. (Our current status on both is on the security page.)
Two process controls deserve special mention because they're cheap and disproportionately effective:
- A responsible disclosure route. Security researchers will look at public charging infrastructure. A published contact and a genuine willingness to engage converts findings into fixes rather than headlines.
- Incident rehearsal. The first time your team walks through "a charger model has a published vulnerability" should not be the day it happens. Tabletop the scenario: identify affected devices (inventory!), stage the patch, communicate to site hosts, evidence the closure.
The takeaway
Nothing here is exotic. Charging security is patch discipline plus unique credentials plus TLS plus least-privilege plus audit plus rehearsed process — applied consistently across an awkwardly physical, awkwardly distributed fleet. The networks that get this right aren't the ones with the longest security page; they're the ones where updating firmware is so routine that patching a vulnerability is just Tuesday.
How AmpNexus approaches platform security, certifications and disclosure: ampnexus.co.uk/security.