martin heininger - security in embedded systems - the upcoming challenge

1. 1© HEICON – Global Engineering GmbH
HEICON Global Engineering GmbH
Kreuzweg 22, 88477 Schwendi
Internet: www.heicon-ulm.de
Blog: http://blog.heicon-ulm.de
Security in Embedded Systems –
The upcoming challenge

2. 2© HEICON – Global Engineering GmbH
HEICON is a specialized engineering company which provides consulting- and development support with a
focus on software-based embedded systems.
The efficient implementation of methods and processes is the area of our engagement.
Founding: 2018 Headquarter: South of Germany (Memmingen) Membership:
Employees: 1 Legal form: GmbH
Revenue Distribution:
HEICON
71% 72%
39%
16%
23%
20%
28%
36%
35%
6%
18%
14% 4%
3%
10% 11%
19%
1%
2% 8%
19% 18%
2% 8% 4% 5% 7%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
2013 2014 2015 2016 2017
Other Sectors
Military
Space
Railway
Industrial Automation
Automotive
Aerospace

3. 3© HEICON – Global Engineering GmbH
HEICON
Aero-
space
Auto-
motive
Railway Industry Defence Agri-
culture
HEICON - Starter
HEICON - Consulting
HEICON - Services
HEICON - Training
HEICON - Webinars

4. 4© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

5. 5© HEICON – Global Engineering GmbH
Megatrends - Security

6. 6© HEICON – Global Engineering GmbH
Megatrends - Security

7. 7© HEICON – Global Engineering GmbH
 Massive interconnection of previously independent
embedded systems
 Enabling malicious attacks on almost all existing
embedded systems
 Functional Safety relevant Products have to be
made secure
 Embedded systems have to be made secure
against external attacks
Megatrends - Security

8. 8© HEICON – Global Engineering GmbH
Some futuristic (?) scenarios:
 Mass shutdown of private household heating systems by attacking
software systems from market leaders
 Malicious remote control of highly automated cars Collapse of the
electricity supply in Europe due to deliberate wrong connection and
disconnection of large power plants or consumers
 Damage to health through intentional wrong control of medical
devices
 Remote-controlled crash of aircrafts
Megatrends - Security

9. 9© HEICON – Global Engineering GmbH
Megatrends - Security
Attack scenarios
 Denial of Service
 Men in the Middle

10. 10© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

11. 11© HEICON – Global Engineering GmbH
Current situation on Standards and Norms
Federal Office for Information Security Act:
German Federal Office for Information Security developed a procedure
for identifying and implementing security measures of the company's own
information technology (IT).
The aim of basic protection is to achieve an adequate level of protection
for IT systems; The basic IT protection catalogues recommend technical
security measures and infrastructural, organizational and personnel
protection measures.

12. 12© HEICON – Global Engineering GmbH
Current situation on Standards and Norms
ISO 27001:
 Definition of security requirements and objectives for information
security
 Cost-efficient management of security risks
 Ensuring compliance with laws and regulations
 Process framework for the implementation and management of
measures to ensure specific information security objectives
 Definition of new information security management processes
 For auditors to determine the degree of implementation of guidelines
and standards

13. 13© HEICON – Global Engineering GmbH
Terminology,
concepts and
models
Master glossary
of terms and
abbreviations
System security
compliance
metrics
IACS security
lifecycle and
use-case
1-1 1-2 1-3 1-4
Req. for an
IACS security
mgt system
Implement. guid-
ance for an
IACS security
mgt syst.
Patch manage-
ment in the
IACS
environment
Installation and
maintenance
req. for IACS
suppliers
2-1 2-2
2-3 2-4
Security
technologies for
IACS
Security risk
assessment and
system design
System sec req.
and security
levels
3-1 3-2 3-3
Technical
security req. for
IACS
components
4-2
General
Policy and Procedures
System
Component
Product
development
requirements
4-1
Current situation on Standards and Norms
IEC62443:

14. 14© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

15. 15© HEICON – Global Engineering GmbH
Solution approaches
Security Safety
 Security Analyse
 Security Plan
 Design Security into the systems
 Minimize systematic failure
 Hazardous and Risk Analysis
 Safety Plan
 Design Safety into the System
 Minimize systematic failure

16. 16© HEICON – Global Engineering GmbH
Solution approaches
Security
 Security Analyse  rather difficult as systems to be analysed are not
fixed
 Security Plan  Open point how much effort should be spent as
much more dynamic is there compared to safety
 Design Security into the systems  Probably the most important point
 Minimize systematic failure  Probably also very important

17. 17© HEICON – Global Engineering GmbH
Solution approaches
Security
Design Security into the systems: Examples
 Avoid back door attacks by making the RTOS interfaces secure
 Limit the times when embedded system is online
 Use the IT-Security mechanisms to make your Embedded System secure
 Create technical mechanisms to speed up security updates for you Embedded
Systems (Functional Saftey constraints have to be solved)

18. 18© HEICON – Global Engineering GmbH
Solution approaches
Security
Minimize systematic failure: Example
 Use Security Coding guidelines (e.g. MISRA Security guidelines)
 Specify your system by professional requirements including the Security aspects
 Do systematic and professional security testing

19. 19© HEICON – Global Engineering GmbH
Solution approaches
Defense
in depth
strategy
Security
Guidelines
Security
Require-
mentsSecurity
V&V
Testing
Security
By
design
Security
Imple-
mentation
Security
Management
Defense in
depth
strategy

20. 20© HEICON – Global Engineering GmbH
Contact - Publications
Contact:
HEICON – Global Engineering GmbH
Martin Heininger Dipl.-Ing(FH)
Kreuzweg 22
D-88477 Schwendi
Tel.: +49 7353 - 98 17 81
Mobil: +49 176 - 24 73 99 60
martin.heininger@heicon-ulm.de
http://www.heicon-ulm.de
Publications:
Testing power electronics according ISO26262, ATZ 04/15
Monthly: Blog article about Functional Safety Topics: http://blog.heicon-
ulm.de