SPECIAL FEATURES Tools & Software Embedded Trends

COVER STORY Cybersecurity: the challenge of protecting critical assets SPECIAL FEATURES Tools & Software Embedded Trends CONTENT Tools & Software Cybersecurity: the challenge of protecting critical assets 34 Embedded system access – changing the paradigm of electrical test 37 System suppliers keep a watchful eye on signal integrity 40 Embedded Trends Cheap, fast and low power 43 Automotive electronics trends 43 Trends on the horizon 44 The future of microcontrollers 45 Industrial motor control demands precision speed and isolation 46 Model-based design keeps the entire system in focus 47 Instrumentation revisited 48 United hard- and software development 49 Product News 50 COVER STORY Cybersecurity: the challenge of protecting critical assets SPECIAL FEATURES Tools & Software Embedded Trends Cover Photo Wind River 3 December 2012 TOOLS & SOFTWARE Cybersecurity: the challenge of protecting critical assets This article is presented by Wind River As more and more devices connect to the Internet, the risk of security threats increases exponentially. As a result, security is now a fundamental concern for embedded systems, and extensive media coverage of threats such as Stuxnet-like worms has only heightened the sense of urgency. To address this need, Wind River has developed the strategies and tools necessary to implement an effective approach to embedded security. These threats have demonstrated the huge fication, can be utilized to manage the risk. A ready occurred. But choosing the appropriate impact that can result for compromised sys- broad range of tools and methodologies exists combination of tools and the correct method- tems. The consequences of similar attacks on to support standards-based approaches to in- ology can become extremely complex without critical infrastructure could be devastating - creasing the security of an embedded device. a structured approach. A step-by-step process and in the case of safety-critical systems, life Alone, these technologies and processes can is most likely to lead to a successful layered se- threatening. The reputation of an organization rarely provide adequate security for an embed- curity protection scheme in the product, and and brand can also suffer from a successful at- ded platform, but the creation of a layered se- Wind River has the tools to help at every step. tack, as evidenced by recent cases in the media. curity architecture comprised of these solutions When devices malfunction or sensitive infor- can build a security strategy of significant depth The challenges in creating a secure embedded mation is stolen, the effect on the public trust to harden devices against security attacks. platform are different from enterprise security. is extremely damaging. Effective countermea- An embedded device does not have the inherent sures must be implemented to prevent systems Truly effective security must be designed into protection of layered systems, such as dedicated from being compromised and sensitive infor- a device as a core requirement. Just as quality firewalls and security devices, that are prevalent mation from being stolen in a coordinated in- cannot be tested into a device, security re- in traditional IT enterprise systems. Embedded dustrial espionage attack. To address this need, quirements must be included as part of the devices are often deployed in remote and inac- Wind River has developed the strategies and device development process before it is released cessible areas, such as power control stations, tools necessary to implement an effective ap- - but this is not always possible for devices in oil pipelines, or hostile environments. There- proach to embedded security. With more than an existing infrastructure. Some security-hard- fore, it is necessary to implement greater device 30 years of experience in the development ening techniques address the retrofit use case intelligence to be able to react against external and certification of safe and secure solutions that is applied to a device that has been de- threats in an appropriate manner. An embed- for critical infrastructure, our team understands ployed. This is suboptimal but may be adequate ded device may have fewer resources available the security challenges of embedded devices in controlled environments. than a traditional IT enterprise system, making and has proven strategies to improve security it difficult or even impossible to use traditional in a broad range of deployment scenarios. Designing in security is more likely to be suc- protection solutions such as antivirus protec- cessful and less expensive in both the short and tion. The desired level of protection must be Today, there is a growing trend toward the long term. For example, installing an antivirus balanced against what is attainable within the adoption of internationally recognized security tool in a running device can be effective only if constraints of the device to achieve an appro- standards. Proven standards, such as the Com- regular updates and system scans are planned priate degree of security as well as device per- mon Criteria for the evaluation of systems, IEC along with the installation. Conscientiously an- formance. An embedded device in critical in- 62351 for secure implementation of substation alyzing the security threat landscape at the be- frastructure has very clear uptime requirements. automation communication, and system ro- ginning of the project is always more efficient Bringing it down can cause protective functions bustness testing from Wurldtech Achilles certi- than trying to recover from damage that has al- to fail or critical processes to run into a dan- December 2012 4 TOOLS & SOFTWARE must be designed using an appropriate architecture sufficiently robust to counter all of the identified threats. A good design will ensure that the following key objectives are achieved: Identify known and consolidated software techniques to mitigate the threats identified in the assessment step. Avoid all the common pro- gramming mistakes that can introduce vulnerabilities and provide a hook for attackers. A trivial but dangerous example is copying data from one place to another without ensuring there is enough space in memory. A list of pro- gramming guidelines should be produced for developers to follow. These guidelines can also build a base for application testing. Depending on the threat environment, determine whether a secure boot scheme is required, as well as a secure management framework to enable secure updates to the system. Identify subsystems of the software architecture that differ in criticality Run-time test coverage reduces the risk of untested changes slipping through based on their confidentiality, robustness, and life cycle requirements. Separation of these dif- gerous state. An IT system with an antivirus questions: What are my security requirements ferent levels of criticality can be required with- or white-listing function may prevent leaking and goals? What am I trying to protect - device out adding to the hardware costs. data, but this method may turn out to be functionalities (uptime, quality of service) or lethal on a critical device. Security is a dynamic information (data in motion, data at rest)? Am 3. Run-Time Selection: Once the software ar- process. Every day hundreds of new threats I concerned about intellectual property protec- chitecture is defined, the next step is to select are discovered, so it is crucial to have a security tion (tampering)? What impact would the iden- the appropriate runtime system. In addition architecture that can respond to new threats tified security threats have? What possible flaws to security requirements, there may be per- with agility. The security design process can are already present in the product’s design? formance and safety certification requirements be outlined in five key steps. Are there mitigations that could already be ap- that will be determining factors in the selection. plied, depending on the device use case? Are If a commercial off-the-shelf (COTS) product 1. Threat Assessment: Security, as with safety, there secure coding standards available that is selected, the vendor can usually offer assis- depends on following a disciplined process help to reduce the introduction of vulnerabilities tance and support in responding to newly throughout the development life cycle. At the during implementation? Does the device need identified threats, reducing the burden on the beginning of the project, it is important to un- to comply with security certification standards device manufacturer. In addition, partitioning derstand the fundamental risk management such as Common Criteria and IEC 62351 or can increase security by isolating applications issues such as the purpose of the device or undergo Wurldtech Achilles certification? and offering multi-OS capabilities. asset, the value of the asset, its deployment environment, and the likely attack vectors to 2. Software Architecture and Design: Once the The run-time system should also provide a ro- which it will be exposed. A good threat assess- threat assessment has taken place and the re- bust middleware foundation that allows trusted ment will provide answers to the following quirements have been gathered, the system connectivity. This foundation can include func- TOOLS & SOFTWARE tions for authorization, authentication, and to ensure that the software will handle these time offerings include VxWorks-based solutions auditing. Depending on potential compliance anomalous conditions without causing degra-

Load more