Lecture
How to Be a Secure Component in the Embedded Product Supply Chain
- at -
- Hall C5C5.100
- Language: English
- Type: Workshop
Lecture description
"A system-on-module may be designed for secure operation, but its security properties only help an integrator when they can be configured, tested, documented, and maintained in the finished product. Using embeddedTS' NXP i.MX-based hardware as a working example, Marta Rybczynska and embeddedTS will examine what it takes to supply a component that supports a customer’s CRA assessment.
The session will trace the handoff from component to product: identifying the supplied hardware, firmware, and software; describing the boot chain and configurable security features; defining assumptions about the carrier board and operating environment; and specifying what the integrator must implement. It will connect those decisions to CRA risk assessment, product security and vulnerability handling requirements, and requirement to give integrators information needed for their own compliance work.
The example will also examine the operational handoff: software component records, vulnerability contacts, update responsibilities, support periods, and the evidence needed when a component changes. Attendees will leave with a concrete model for documenting security responsibilities across the supplier–integrator boundary."
The session will trace the handoff from component to product: identifying the supplied hardware, firmware, and software; describing the boot chain and configurable security features; defining assumptions about the carrier board and operating environment; and specifying what the integrator must implement. It will connect those decisions to CRA risk assessment, product security and vulnerability handling requirements, and requirement to give integrators information needed for their own compliance work.
The example will also examine the operational handoff: software component records, vulnerability contacts, update responsibilities, support periods, and the evidence needed when a component changes. Attendees will leave with a concrete model for documenting security responsibilities across the supplier–integrator boundary."
