Linutronix - Security

Trust in an embedded product is more important than ever in times of networked devices. People expect a system to work according to plan. Applications trust that the operating system works correctly and does not falsify data. Servers in the cloud rely on the identity of connected devices being correct.

Unfortunately, the recent past has shown that embedded devices have often been used as a gateway for malware or for targeted attacks on infrastructure. Outdated software, the lack of secure updates and the longevity and frequency of these devices make them a prime target for attack.

Devices in the industrial internet (IIoT, Industry 4.0) must therefore be "secure" and generate trust. To this end, they should, if possible, meet the following security requirements:

A) Hardware
A secure root-of-trust by means of hardware (HSM, TPM or similar)

b) Software
This usually means the operating system. For example, a secure update must be possible so that errors can be corrected. And it must also be guaranteed that a rollback to an older, buggy version is not possible

c) Device management
The question whether the cloud is needed for this or "just" a server is of secondary importance. What is really important is that the devices in the field can authenticate themselves securely when logging on. And then the devices can be handled via device management, certificates can be renewed or changed, updates can be applied and misbehaviour (as a possible consequence of an attack) can be detected in time.

Whether all these requirements have to be implemented or how they should be implemented, depends on the definition of the safety level of each individual device. You should also bear in mind that more and more requirements are being imposed by legal and regulatory authorities.

Linutronix supports you in defining your requirements and their implementation within the Linux BSPS for your specific component. We offer special workshops for this purpose, in which we discuss the possible measures with you.
We are also happy to support you in analysing your existing Linux-based devices in order to find out to what extent they meet the requirements for network security (cyber security).