Evaluation Engineering - 20

ESTABLISHING TRUST
IN CYBERSECURITY FOR
EMBEDDED SYSTEMS

173012511 © Blackboard373 | Dreamstime.com

CYBERSECURITY

by Alix Paultre, Editor

	 Cybersecurity has become a serious
issue in every aspect of electronics,
from server farms to the smallest and least
significant devices operating in the IoT.
Even something as minor as an intelligent
thermostat has been used as an attack
vector in a hacking theft. Establishing a
design's security protocols have become
a major part of device development, evaluation, and qualification.
One of the companies operating in the
Cybersecurity space is Sectigo, a provider
of automated digital identity management and web security solutions, and
is a Certificate Authority
offering a comprehensive
website security solution,
combined with TLS/SSL
certificates, DevOps, IoT,
Grau and enterprise-grade PKI
management. To get an overview on the
situation facing designers today, we spent
some time talking to Alan Grau, Vice
President of IoT/Embedded Solutions.
EE: Implementing security is something
that's done now before you turn the device on, and it's got to be done before the
product goes on the shelf. Well, you used
to be once upon a time, that's how you
did security, but now you can't just buy
a product, unbox it, turn it on and then

20

EVALUATION ENGINEERING NOVEMBER/DECEMBER 2020

implement security. You know what I
mean?
Alan Grau: In the embedded world, it's
very different, right? All the software and
firmware is baked into the device. Many
of the devices don't h ave an ability to update the firmware on them at all. And if
they do, firmware still has to come from
the OEM or from a trusted partner of the
OEM. So it's not an open platform, like a
PC or a Mac, where anybody can write
software for it. So for the PC world, users
can go and install applications after the
fact for security or for other reasons. So
it's a different world in that regard. And so,

you're absolutely right, it has to be baked
in by the OEM.
EE: Now, when looking at it from that
point of view right now, addressing the
fact that this has got to be done at the
OEM level, how would you, at what point
would you say, I need to start thinking
about it? I'm making, let's pick a random
application. I'm making a set of smart
glasses that take pictures when I blink
or something, it's got RF, that means
I got to worry about my RF protocols.
It's got storage, it's got a camera, all
you typical IoT-type device issues. So
at what point do I start thinking about
security in a device like that?
AG: Well, you should be starting at the
beginning, right? You're saying, okay, we
need to support RF on this. We need to
support, whatever the different capabilities are on it. And security has to be on
that list from day one or should be on that
list from day one, so that you can make
the right choice in terms of hardware platforms. Maybe you're going to look at it
and say, well, do we want to use Bluetooth
Low Energy for the protocol? Or do we
want to use some other protocol? And as
early on, is you can start thinking about
that, you can start looking at the security
ramifications of those choices. So, I think
it's definitely, got to be done just from that
very, very early point.
EE: Now, are there issues when you start
talking about security, we now have to
worry also about hardware security
http://www.Dreamstime.com
Evaluation Engineering

Table of Contents for the Digital Edition of Evaluation Engineering
