This document discusses security challenges for embedded systems and potential solutions. It provides an overview of HEICON, a German engineering company specialized in embedded software. The document outlines trends like increased interconnectivity exposing embedded systems to attacks. It also summarizes relevant industry standards and norms for security and embedded systems. Potential solutions discussed include designing security into systems through techniques like secure interfaces and access control as well as implementing defense-in-depth strategies.

1. 1© HEICON – Global Engineering GmbH
HEICON Global Engineering GmbH
Kreuzweg 22, 88477 Schwendi
Internet: www.heicon-ulm.de
Blog: http://blog.heicon-ulm.de
Security in Embedded Systems –
The upcoming challenge

2. 2© HEICON – Global Engineering GmbH
HEICON is a specialized engineering company which provides consulting- and development support with a
focus on software-based embedded systems.
The efficient implementation of methods and processes is the area of our engagement.
Founding: 2018 Headquarter: South of Germany (Memmingen) Membership:
Employees: 1 Legal form: GmbH
Revenue Distribution:
HEICON
71% 72%
39%
16%
23%
20%
28%
36%
35%
6%
18%
14% 4%
3%
10% 11%
19%
1%
2% 8%
19% 18%
2% 8% 4% 5% 7%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
2013 2014 2015 2016 2017
Other Sectors
Military
Space
Railway
Industrial Automation
Automotive
Aerospace

3. 3© HEICON – Global Engineering GmbH
HEICON
Aero-
space
Auto-
motive
Railway Industry Defence Agri-
culture
HEICON - Starter
HEICON - Consulting
HEICON - Services
HEICON - Training
HEICON - Webinars

4. 4© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

5. 5© HEICON – Global Engineering GmbH
Megatrends - Security

6. 6© HEICON – Global Engineering GmbH
Megatrends - Security

7. 7© HEICON – Global Engineering GmbH
 Massive interconnection of previously independent
embedded systems
 Enabling malicious attacks on almost all existing
embedded systems
 Functional Safety relevant Products have to be
made secure
 Embedded systems have to be made secure
against external attacks
Megatrends - Security

8. 8© HEICON – Global Engineering GmbH
Some futuristic (?) scenarios:
 Mass shutdown of private household heating systems by attacking
software systems from market leaders
 Malicious remote control of highly automated cars Collapse of the
electricity supply in Europe due to deliberate wrong connection and
disconnection of large power plants or consumers
 Damage to health through intentional wrong control of medical
devices
 Remote-controlled crash of aircrafts
Megatrends - Security

9. 9© HEICON – Global Engineering GmbH
Megatrends - Security
Attack scenarios
 Denial of Service
 Men in the Middle

10. 10© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

11. 11© HEICON – Global Engineering GmbH
Current situation on Standards and Norms
Federal Office for Information Security Act:
German Federal Office for Information Security developed a procedure
for identifying and implementing security measures of the company's own
information technology (IT).
The aim of basic protection is to achieve an adequate level of protection
for IT systems; The basic IT protection catalogues recommend technical
security measures and infrastructural, organizational and personnel
protection measures.

12. 12© HEICON – Global Engineering GmbH
Current situation on Standards and Norms
ISO 27001:
 Definition of security requirements and objectives for information
security
 Cost-efficient management of security risks
 Ensuring compliance with laws and regulations
 Process framework for the implementation and management of
measures to ensure specific information security objectives
 Definition of new information security management processes
 For auditors to determine the degree of implementation of guidelines
and standards

13. 13© HEICON – Global Engineering GmbH
Terminology,
concepts and
models
Master glossary
of terms and
abbreviations
System security
compliance
metrics
IACS security
lifecycle and
use-case
1-1 1-2 1-3 1-4
Req. for an
IACS security
mgt system
Implement. guid-
ance for an
IACS security
mgt syst.
Patch manage-
ment in the
IACS
environment
Installation and
maintenance
req. for IACS
suppliers
2-1 2-2
2-3 2-4
Security
technologies for
IACS
Security risk
assessment and
system design
System sec req.
and security
levels
3-1 3-2 3-3
Technical
security req. for
IACS
components
4-2
General
Policy and Procedures
System
Component
Product
development
requirements
4-1
Current situation on Standards and Norms
IEC62443:

14. 14© HEICON – Global Engineering GmbH
Current situation on Industry Standards and Norms
Solution approaches
Megatrends – Security
Contact

15. 15© HEICON – Global Engineering GmbH
Solution approaches
Security Safety
 Security Analyse
 Security Plan
 Design Security into the systems
 Minimize systematic failure
 Hazardous and Risk Analysis
 Safety Plan
 Design Safety into the System
 Minimize systematic failure

16. 16© HEICON – Global Engineering GmbH
Solution approaches
Security
 Security Analyse  rather difficult as systems to be analysed are not
fixed
 Security Plan  Open point how much effort should be spent as
much more dynamic is there compared to safety
 Design Security into the systems  Probably the most important point
 Minimize systematic failure  Probably also very important

17. 17© HEICON – Global Engineering GmbH
Solution approaches
Security
Design Security into the systems: Examples
 Avoid back door attacks by making the RTOS interfaces secure
 Limit the times when embedded system is online
 Use the IT-Security mechanisms to make your Embedded System secure
 Create technical mechanisms to speed up security updates for you Embedded
Systems (Functional Saftey constraints have to be solved)

18. 18© HEICON – Global Engineering GmbH
Solution approaches
Security
Minimize systematic failure: Example
 Use Security Coding guidelines (e.g. MISRA Security guidelines)
 Specify your system by professional requirements including the Security aspects
 Do systematic and professional security testing

19. 19© HEICON – Global Engineering GmbH
Solution approaches
Defense
in depth
strategy
Security
Guidelines
Security
Require-
mentsSecurity
V&V
Testing
Security
By
design
Security
Imple-
mentation
Security
Management
Defense in
depth
strategy

20. 20© HEICON – Global Engineering GmbH
Contact - Publications
Contact:
HEICON – Global Engineering GmbH
Martin Heininger Dipl.-Ing(FH)
Kreuzweg 22
D-88477 Schwendi
Tel.: +49 7353 - 98 17 81
Mobil: +49 176 - 24 73 99 60
martin.heininger@heicon-ulm.de
http://www.heicon-ulm.de
Publications:
Testing power electronics according ISO26262, ATZ 04/15
Monthly: Blog article about Functional Safety Topics: http://blog.heicon-
ulm.de