In this webinar, Lars Lydersen, senior director of product security at Silicon Labs, delves into the historical data of how adversary capability has evolved, and discusses how these can be extrapolated into the future. This understanding gives a necessary background to evaluate what security functionality is necessary in an IoT design. Even with advanced security functionality, there will always be unknown unknowns, and it will be necessary to secure against attacks and adversaries of the future. Lars will also discuss the typical properties of an attack that can be thwarted via updates, why enabling software updates is needed, and the consequences for IoT designs. Watch the complete webinar, here: http://bit.ly/2wyiTDB

1. Why the IoT Needs Upgradable Security
L A R S LY D E R S E N , S E N I O R D I R E C T O R O F P R O D U C T S E C U R I T Y

2. Why the IoT Needs Upgradable Security
L A R S LY D E R S E N , S E N I O R D I R E C T O R O F P R O D U C T S E C U R I T Y

3. Meet Lars, the Quantum Hacker

4. IoT of Guns
Smart Engineers What you see You aimed
here
The gun
shot here
4

5. Don’t Break My Heart
5

6. Classical Cyber Security
Proprietary
6

7. IoT Security
Proprietary
/
 Increased attack
surface
 Accessibility to
hardware
 Limited
processing power
in end nodes
7

8.  Security/privacy
 Easy of use
 Functionality
 Cost
Security/privacy is a balancing act
8

9. Class
Hobbyist /
script-kiddie
Advanced
hackers
Security researchers Nation state attacks
Motivation Fun, curiosity, fame Fame, financial
Curiosity, improve
security, novel ideas
and attacks
Espionage, sabotage
Resources
Limited, commodity
hacking equipment
Semi-specialized
equipment. Experts in
single domain
Ultra-specialized
equipment. Experts in
multiple domains
Unlimited
Exponentially increasing cost of security
Who is the adversary? Why do they attack?
9

10. Commoditization of attacker tools: DPA
Before ca. 1998
Nation state?
No public knowledge
about DPA?
Ca. 1998 – ca. 2015
Cryptographic Research, now Rambus,
publishes papers on DPA and starts selling
DPA equipment at a prohibitive price
Security researchers
2015 - now
Chipwisperer on Kickstarter
for $300. Analysis software
on Github
Hobbyists
10

11. DPA today
11

12. Commoditization of attacker tools: EMI
2017 - now?
Nation state?
No public knowledge
about EMI?
? –2017
Risecure sells EM Probe
stations at a prohibitive price
Security researchers
Someone made a $350 probe
station from a 3D printer and
will put it on github (Badfet)
Hobbyists
12

13. EMI today
13

14. What is the right security level?
Time
Level of security
Adversary strength
Today End of life for device
 Adversary strengthens
 Always new, novel attacks
 Must upgrade security during lifecycle
 Not all attacks are patchable
 Need strong HW security today
Choice of
security
level
14

15. Who is the adversary of 2035?
15

16. Secure boot is needed to enable upgradability
 Signatures verify authenticity
 Must use asymmetric crypto
 Only requires public keys in the device
 May provide confidentiality
 Difficult find loopholes in image
 Protect IP
 Must put keys in immutable memory
16

17. M E M O R Y R E Q U I R E M E N T S
How much overhead do you need?
How to manage the memory budget?
H O W
Directly connected?
Forced updates?
W H O
Who is authorized to push updates?
How is the authorization enforced?
Deploying upgrades
Memory
Bootloader RTOS Com Stack
App data Overhead
17

18.  Security is not binary
 Consider the adversary of the future
 Upgradable security is necessary in IoT
Summary
18

19. Thank you!