IoT/Embedded vs. Security : Learn from the Past, Apply to the Present, Prepare for the Future

Abstract

It is expected there will be 50 billion IoT/embedded connected devices by 2020. At the same time, multiple recent studies revealed that IoT/embedded devices and their software/firmware is plagued with weaknesses and vulnerabilities. Moreover, various recent and prominent attacks, such as the Mirai botnet targeting Commercial Off-The-Shelf (COTS) IoT/embedded devices, and the ROCA attack targeting secure embedded hardware chips (in their many form-factors), clearly demonstrate the need to secure the many layers and components of the highly fragmented and heterogeneous ecosystem of IoT/embedded devices. In this paper we aim to explore, discuss and exemplify some research aspects and directions that could be used to help improve the long-term security posture for IoT/embedded devices.