Nick Kartsioukas joined us to talk about security in embedded systems. Common Vulnerabilities and Exposures (CVE) is the primary database to check your software libraries, tools, and OSs: <a href= "https://www.cve.org/">cve.org</a>. Open Worldwide Application Security Project (OWASP, <a href="http://owasp.org/">owasp.org</a>) has information on how to improve security in all kinds of applications, including <a href= "https://owasp.org/www-project-embedded-application-security/">embedded application security</a>. There are also cheatsheets, Nick particularly recommends <a href= "https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html"> Software Supply Chain Security - OWASP Cheat Sheet</a>. Wait, what is supply chain security? Nick suggested a <a href= "https://github.com/resources/articles/what-is-software-supply-chain-security"> nice article on</a> <a href="http://github.com/">github.com</a>: it is about your code and tools including firmware update, a common weak point in embedded device security. Want to try out some security work? There are capture the flag (CTF) challenges including the Microcorruption CTF (<a href="https://microcorruption.com/">microcorruption.com</a>) which is embedded security related. We also talked about the <a href= "https://www.sans.org/cyber-ranges/holiday-hack-challenge">SANS Holiday Hack Challenge</a> (also see <a href= "https://www.holidayhackchallenge.com/past-challenges/">Prior SANS Holiday Hack Challenges</a>). This episode is brought to you by <a href= "https://runsafesecurity.com/embeddedfm" target="_blank" rel= "noopener">RunSafe Security</a>. Working with C or C++ in your embedded projects? RunSafe Security helps you build safer, more resilient devices with build-time SBOM generation, vulnerability identification, and patented code hardening. Their Load-time Function Randomization stops the exploit of memory-based attacks, something we all know is much needed. Learn more at <a href= "http://runsafesecurity.com/embeddedfm">RunSafeSecurity.com/embeddedfm</a>. Some other sites that have good information embedded security: <ul data-rte-list="default"> <li> <a href= "https://www.usenix.org/system/files/1401_08-12_mickens.pdf">This World Of Ours</a> by James Mickens is an easy read about threat modelling </li> </ul> <ul data-rte-list="default"> <li> Cybersecurity and Infrastructure Security Agency (CISA) is at <a href="https://www.cisa.gov/">cisa.gov</a> and, among other things, they <a href="https://www.cisa.gov/sbom">describe SBOMs in great detail</a> </li> <li> National Institute of Standards and Technology (NIST) also provides guidance: </li> </ul> <ul data-rte-list="default"> <li> <a href= "https://www.nist.gov/internet-things-iot">Internet of Things (IoT) | NIST</a> </li> <li> <a href= "https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program"> NIST Cybersecurity for IoT Program</a> </li> <li> NIST SP800-213 IoT Device Cybersecurity Guidance for the Federal Government: <a href= "https://csrc.nist.gov/pubs/sp/800/213/final">Establishing IoT Device Cybersecurity Requirements</a> </li> </ul> <ul data-rte-list="default"> <li> There is a group of universities and organizations doing research into embedded security: National Science Foundation Center for Hardware and Embedded Systems Security and Trust (CHEST). <a href= "https://iucrc.nsf.gov/centers/center-for-hardware-and-embedded-system-security-and-trust/"> Descriptive overview</a> and the site is <a href= "https://www.nsfchest.org/">nsfchest.org</a> </li> <li> European Telecommunications Standards Institute (ETSI) - <a href= "https://www.etsi.org/technologies/consumer-iot-security">Consumer IoT Security</a> </li> <li> <a href= "https://www.theregister.com/2023/12/15/ubiquiti_camera_privacy/">Camera Ubiquiti configuration issue</a> (what not to do) </li> </ul> Finally, Nick mentioned <a href= "https://www.stopthebleed.org/">Stop The Bleed</a> which provides <a href="https://cms.bleedingcontrol.org/class/search">training</a> on how you can control bleeding, a leading cause of death. They even have <a href= "https://creators.spotify.com/pod/profile/stopthebleedpodcast/">a podcast</a> (and we know you like those). Elecia followed up with <a href= "https://www.fema.gov/emergency-managers/individuals-communities/preparedness-activities-webinars/community-emergency-response-team"> Community Emergency Response Teams (CERT)</a>. Call your local fire department and ask about training near you! <a href="https://embedded.fm/transcripts/515">Transcript</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

515: Script Boomers

Embedded

AI Chapters

AI Insights

Reviews