The Internet of Things can be seen as a brilliant opportunity for the progression of embedded systems. IoT mobile devices like smartphones, tablets, and wearables are already ubiquitous. As the Internet of Things market is expanding, it is expected that non-mobile IoT systems will outnumber the current IoT-enabled mobile devices that we are familiar with.

With each passing day, embedded systems are getting smaller and smarter, enabling us to get more things done than before. As more functionalities are embedded in smaller device footprints, there is an upsurge in the security concerns as well. Device vendors prefer to add new features that often crowds out the basic security systems, thus launching devices that underwent perfunctory security testing.

Embedded security breaches that we have witnessed

• Before a decade, TJX credit card breach compromised 94 million credit and debit card numbers. An unknown number of intruders stole all this data from one of its systems over a period of more than 18 months. Later, it was discovered that the reason for this breach was an insecure wireless network connection.
• Rebug, a custom firmware for Sony PlayStation had access to the developer-only network and allowed “illegal” operations.
• Multifunction printers that had access to sensitive company data on many corporate networks.

In the past, there have been several well-structured attacks on numerous embedded devices, ranging from toasters to vehicle control systems. A majority of embedded systems are secured using password protection and encryption protocols such as SSL (Secure Socket Layer) or SSH (Secure Shell), but apparently, it is not enough to make the devices secure.

Multiple layers of protection, including encryption, authentication, firewalls, security protocols, intrusion detection, and intrusion prevention systems usually guard enterprise data. Despite this, embedded systems do not have firewalls and are only protected by passwords in most of the cases.

Why is the security of embedded systems neglected?

When it comes to the security of embedded devices, several assumptions are made such as:

— embedded devices are not vulnerable to cyberattacks

— embedded devices are not attractive targets for hacking

— embedded devices get sufficient security with encryption and authentication

All of the above-mentioned assumptions are no longer valid. As the number of sophisticated embedded attacks has increased, greater security measures are required for embedded systems.

What are the current challenges in maintaining the security of embedded systems?

Unlike standard PCs, embedded systems are designed to perform a designated set of tasks. These devices are typically designed to minimize the processing cycles and reduce the memory usage, as there are no extra processing resources available. Considering this, the security solutions developed for PCs will not solve the issues of embedded devices. In fact, most of the embedded devices will not support the PC’s security solutions.

This imposes a number of challenges for embedded systems security, some of them are:

Irregular security updates

Most of the embedded systems are not upgraded regularly for security updates. Once the embedded device is deployed, it keeps running on the software that it came with for years and even decades. If the device needs a remote software update, a capability needs to be designed into the device to allow security updates since the embedded operating system may not have automated capabilities to allow easy firmware updates that ensure embedded security.

Attack replication

As embedded devices are mass produced, the same version of devices have the same design and built as other devices in the lot. Considering this, there will be millions of identical embedded devices. If someone is able to successfully hack any of the devices from the lot, the attack can be easily replicated across the rest of the devices.

Dependability

Many critical aspects such as utility grids, transportation infrastructure, and communication systems are controlled by embedded systems. The modern society relies upon several facilities, many of them, in turn, rely on embedded devices. Cyberattacks would lead to an interruption in the functioning of embedded systems, which may have some catastrophic consequences.

Device life cycle

Embedded devices have a much longer lifespan as compared to PCs. One can easily spot embedded devices in the field that are a decade old, still running on the same system. So, when a manufacturer plans to develop an embedded system, they need to consider the potential threats that may arise in the next two decades. On top of developing a system that is secure against current threats, manufacturers need to match the security requirements of the future, which is a great challenge in itself.

Industrial protocols

Embedded systems follow some set of industrial protocols that are not protected or recognized by enterprise security tools. Enterprise intrusion detection system and firewalls can save the organizations from enterprise specific threats, but are not capable of providing security against industrial protocol attacks.

Remote deployment

Numerous embedded devices are deployed in the field, outside the enterprise security perimeter. Therefore, these remote or mobile devices may be directly connected to the internet, without the security layers provided in the corporate environment.

All the above-mentioned challenges need to be addressed during the embedded device design and development, considering both hardware and firmware aspects. Only if the embedded device is secure, it will be able to run the intended tasks.

Wrapping Up

The question isn’t if an embedded device is secure, the question is if an embedded device is secure enough. Different embedded devices require a different level of security, depending on the function it carries out.

The level of embedded security needs to be considered in the early phase of device design. Instead of relying on the enterprise security tools, embedded devices should come with a security system, so they can stand up against threats even outside the enterprise security perimeter.

eInfochips has a vast experience in creating secure and robust embedded devices. For developing a secure embedded system for your business, contact our team.