Unique Challenges Of Security Programs For Hardware/IoT Makers | CXO Panel | hardwear.io USA 2019

### Overview This panel discussion from hardwear.io USA 2019 features security leaders from hardware manufacturing, product security, and offensive security consulting. The session explores the unique challenges of building and maintaining security programs for hardware and IoT devices compared to traditional web and software environments. Topics include researcher engagement, vulnerability management, secure protocol adoption, user privacy, supply chain risks, and firmware attestation.

### Key Topics - **External Researcher Engagement:** Engaging hardware security researchers is hindered by high equipment costs, specialized skill sets, tamper-resistant packaging, and locked-down production hardware. Companies navigate this through bug bounties, private programs providing hardware, academic grants, training (such as UEFI education), and open-source tooling (e.g., Chipsec, EDK II/TianoCore initiatives, OpenThread, OpenWeave). - **Vulnerability Management & Hardware Lifecycle:** Unlike web software where patches deploy in hours, hardware patching involves long validation cycles across OEMs, ODMs, and CSPs, often relying on coordinated embargoes and firmware workarounds. Panelists emphasize secure-by-design principles, robust over-the-air (OTA) update mechanisms, defense-in-depth, and isolating secrets per device. - **Legacy Protocols & Standards:** Many hardware devices communicate over outdated or plain-text board-level interfaces (such as SPI and I2C) or older wireless standards. Modern microcontrollers and crypto co-processors now enable end-to-end link encryption without substantial overhead. Panelists discussed participating in standards bodies (e.g., Zigbee/Z-Wave, smart metering, PCI) while noting that mixed environments often default to the lowest common denominator of security. - **Consumer Privacy & Hardware Controls:** User education is often insufficient given pervasive data collection. Proposed solutions include simple hardware-level controls (physical lens covers, mute buttons, hardware kill switches for radios and sensors) alongside strong regulatory baselines and minimized data collection. - **Supply Chain Security & Manufacturing:** Addressing risks such as hardware implants and untrusted contract manufacturers involves generating cryptographic keys directly on-chip rather than at the factory, utilizing Hardware Security Modules (HSMs) and PKI, exploring blockchain for distributed manufacturing integrity, and performing random sample auditing (such as 3D X-ray inspection).

### Technical Details - **Per-Device Secrets:** Devices should generate secrets internally and avoid sharing global symmetric keys across product lines, ensuring that key extraction on a single physical unit does not compromise the wider ecosystem. - **Protocol Decoders and Openness:** Open-sourcing protocol decoders (e.g., Wireshark plugins and Scapy modules for 802.15.4, Thread, and Weave) helps the research community analyze communications without resorting to unnecessary reverse-engineering hurdles. - **Hardware Defenses:** Panelists highlighted Kerckhoffs's principle, secure elements, and trusted execution environments/enclaves to safeguard key material, while warning that security architectures must assume physical side-channel leakage or extracted secrets over time.

### Takeaways Hardware must be secure by design; security cannot simply be retrofitted post-production. Organizations must implement automated OTA updates, isolate device secrets, actively train and equip external researchers, and establish rigorous supply-chain verification to manage long-term device risk.