Driving Security Into Connected Cars: Threat Model and Recommendations