2.6 Security implications of embedded & specialized systems

Question 1

Embedded system: what is an embedded system ?

Answer 1

It’s an hardware or software build for a very specific purpose. Usually build with specific harware or to fits into particular sizes/cost.
Ex: traffic light controllers, digital watches, medical imaging systems

Question 2

Embedded system: what is a SoC and why it can be a security concern ?

Answer 2

System on a Chip allow the embedded system to run. The SoC has multiple components running on a single chip.
Security concerns are important because of the small size of the device (difficult to upgrade hardware, limited off-the-shelf security options)

Ex: raspberry pi

Question 3

Embedded system: what is an FPGA?

Answer 3

Field-programmable gate array is a type of hardware that can be find on embedded system. It is an integrated circuit that can be configured after manufacturing. It provide flexibility to the dev in case they want to add new software.

Ex: can be find in switches, router, firewall etc

Question 4

Embedded system: what is SCADA / ICS ?

Answer 4

• Supervisory Control and Data Acquisition System is a combination of hardware and software that enables the automation of industrial processes by capturing Operational Technology (OT) real-time data. SCADA connects the sensors that monitor equipment like motors, pumps, and valves to an onsite or remote server.
• SCADA requires extensive segment on the network and to be connect to internet for security reasons

Question 5

Embedded system: what is smart devices / IoT ?

Answer 5

• IoT are smart devices that can be connected to other types of systems insides homes and businesses.
• Important security concern as they are connected to internet

Ex: connected to phone AC, home automation (video doorbells), wearable technologies (watches, health monitors), faciility automation (temperature etc),

Question 6

Embedded system: what is a specialized embedded system ?

Answer 6

Type of embedded system that is very specialized:
- medical devices >because they are very specialized they may be running on older OS version
- Vehicles > internal network often accessible from mobile network (can control internal electronics)
- Aircraft > DoS could damage the aircraft and an outage would be problematic
- smart meter (temperature, water etc)

Question 7

Embedded system: what is VoIP?

Answer 7

Voice over Internet Protocol is a type of phone system that uses an internet connection to make and receive calls. It is a embedded system and each device is a computer (separate boot process, individual configurations, different capabilities)

Question 8

Embedded system: what is HVAC ?

Answer 8

Heating Ventilation and Air Conditioning (thermodynamics, fluid mechanics etc) are complex embedded system
Traditionnally not build with security in mind

Question 9

Embedded system: what are multifunction devices ?

Answer 9

All in one or multifunctions devices are everything you need in one single device. It uses sophisticated firmware
Ex: Printers, scanners and fax machines in one

Question 10

Embedded system: what is RTOS ?

Answer 10

• Real-Time Operating System is an OS with a deterministic processing schedule
• Extremely sensitive to security issues because it needs to be always available

Ex: military environment, indutrial, automobile

Question 11

Embedded system: is surveillance camera an embbeded system ?

Answer 11

Yes.

Question 12

Embedded system: is drone an embbeded system ?

Answer 12

Yes.

Question 13

Embedded system communication: how embedded system communicate to each other ?

Answer 13

Can use:
- 5G
- SIM card
- Narrowband
- Baseband
- Zigbee

Question 14

Embedded system communication: what is 5G ?

Answer 14

• Fith generation cellular networking (launched in 2020)
• Significant performance improvements (higher frequencies, 10 GB/second
• Significant impact on IoT: larger data transfers, faster networking

Question 15

Embedded system communication: what is SIM card ?

Answer 15

• Used to provide information to a cellular network provider (phone, tablets, embedded systems)
• Contains mobile details (IMSI, authentication info)
• Important to manage in large organization

Question 16

Embedded system communication: what is narrowband ?

Answer 16

• Communication analog signals over a narrow range of requencies
• Can be find in IoT equipment like SCADA

Question 17

Embedded system communication: what is baseband ?

Answer 17

• Generally a soingle cable with a digital signal
• The communication signal uses all of the bandwidth
• Bidirectional communication
• Same as ethernet standard

Question 18

Embedded system communication: what is zigbee ?

Answer 18

• Internet of Things networking
• Alternative to wifi and bluetooth (longer distance than bluetooth and less power consuption than wifi)
• Allow to IoT device to create a mesh network
• It communicates through the ISM band (Industrial, Scientific and Medical band) with a frequency of 900MHz and 2.4GHz in the US

Question 19

Embedded system constraints: what are the constraints with embedded system?

Answer 19

• Power: may not have access to main power source, batteries maintenance/replace
• Compute: low power CPUs so limited in speed, cost & heat consideration
• Network: may not have option for wired link, maybe in the middle of a field, wireless limitation
• Crypto: limited cryptographic options
• Inability to patch
• Authentication: limited auth options
• Range: purpose-built so may not provide additional functionality
• Cost: single purpose= low cost= quality affected
• Implied trust: diffult to verify the security posture (audit it)

Question 20

Embedded system constraints: why there are constraints with embedded system?

Answer 20

Embedded system may not usually fully capable computer so may have limited or missing features, upgradability limitations, limits in communication options: