Using FOSS to Protect Embedded Systems Data in Transit
summary
Argues security is a marathon: build a foundation from day one and iterate. Recommends concrete controls: network zoning (keep startups to two to four zones max), VLANs per function, chokepoints enforcing authentication/authorization, and stateful packet filtering with Linux + nftables. Shows an implemented pattern on a 10‑port EV charger example—per‑port MCU VLANs, gateway using Zephyr with mbedTLS and WireGuard (MACsec on the rack link, VPN/IPSec to cloud, TLS to apps)—and explains key provisioning, rotation and NTP needs.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:39Embedded cybersecurity challenges
- 6:36Marathon mindset for security
- 7:18Data states and network security
- 9:00Threat analysis basics
- 11:26Secure network architecture
- 12:53Segmentation and choke points
- 15:50Industrial zones and layers
- 20:24Security conduits principles
- 22:14Secure zones and rules
- 23:44VLANs for isolation
- 26:17How VLANs work
- 27:19VLANs in automotive and IoT
- 28:24VLANs on Linux and Zephyr RTOS
- 30:10Packet filtering basics
- 31:13Linux netfilter and NF tables
- 32:16Stateful filtering and enforcement
- 33:22Filtering for forensics
- 33:44Packet filtering on Zephyr RTOS
- 34:06VPN and IPSec encryption
- 35:56TLS for app security
- 37:20TLS in Linux and Zephyr RTOS
- 38:03MACsec for physical security
- 39:05Dependencies for conduits
- 40:51Choosing security mechanisms
- 41:33Security across OSI layers
- 42:57EV charging use case
- 46:37Summary
- 47:22Q&A
related talks
29mEnabling a secure IoT from design to deployment
31mSecuring the Internet of Things
35mIoT Cornerstones of Security
32mELC 2013 Security: Best Practices for Embedded Systems
31mEmbracing FOSS in Embedded Development: From Proprietary to Modular and Collaborative
28mKeeping Networks Secure: The Open Way
27mFlowFence: Practical Data Protection for Emerging IoT Application Frameworks
12mTowards an Architecture for Trusted Edge IoT Security Gateways