Cybersecurity and Embedded Systems
The need to secure embedded systems
Do you drive a car? have you in the last five years flown on an airplane? Have you purchased any goods that were shipped to your location? If you have answered Yes to any of these, then embedded systems have played a role in your life.
Generally, you can separate the cybersecurity area of operations into the enterprise and embedded systems. The enterprise is the systems we learn so much about in school and for certifications. These are the efforts to secure servers, data located on these, communication, etc. Embedded systems are a bit different. These are the modules in your vehicle controlling and monitoring steering, tire pressure, GPS, and other functions required for the machinery to operate.
While the functions are distinct, there is a complication. Each of these systems interact with others. The data collected and commands are used by the other systems. This is especially the case as transportation system become more connected and autonomous systems are used more. This includes vehicles, airplanes, arm equipment, and other equipment being engineered to operate without human interaction and direction. These systems need to communicate quickly and clearly. Imagine a vehicle of your choice, receiving incorrect or malicious information and data from a "trusted" source. With someone else in control, there could be immediate and serious consequences for anything in or near the equipment.
All is not lost though. There are steps to assist with securing these systems. The first step is to conduct a threat assessment for the device or module. This has to be done end-to-end, and include all aspects, including hardware, software, data, communications, and anything else involved with the equipment. The analysis itself is static for that point in time. The analysis should be part of the product's lifecycle. When there is a change or update, this needs to be addressed again. The update may affect other parts of the system, and create other issues.
The next step is to review the current advanced security designs and use these to the fullest extent possible. There are a number of these including virtualization and hypervisors.
There are further steps to follow based on the individual environment. The important aspect to acknowledge is the embedded systems are very different and need to be tested and secured in a specific manner.
About the Author - Charles Parker, II has been working in the info sec field for over a decade, performing pen tests, vulnerability assessments, consulting with small- to medium-sized businesses to mitigate and remediate their issues, and preparing IT and info sec policies and procedures. Mr. Parker’s background includes work in the banking, medical, automotive, and staffing industries.