The 2024 PSA Certified Security Report states that 80% of technology decision makers say compliance with security regulation is their top priority in 2024. While this might make you feel like security is finally taking center stage in IoT development, not all regulations are created equal. 

For example, while Europe’s Cyber Resilience Act (CRA) matches the National Institute of Standards and Technology (NIST) Cybersecurity Framework in many ways, the European CRA is mandatory, while in the US the Cybersecurity Framework is not. 

If you’re building an IoT device, whether security is currently regulated or not, you should prepare your device to meet these regulations, given the heavy focus the government is starting to put on security. To succeed in meeting regulations and securing your device, there are five best practices you should follow.

Best practice #1: Start with a TMSA

A Threat Modeling and Security Analysis (TMSA) is like a security roadmap for your product. It's a process that helps you think ahead about what could go wrong and how to prevent it. Imagine you're building a new house—you'd want to know where the weak spots are before someone tries to break in, right? TMSA is about doing the same thing but for your IoT device or software.

Related:How to Select the Right Amount of Flash Memory

The process is relatively straightforward. First, you identify what’s valuable in your system—things like sensitive data or critical functions. Then, you think about who might want to compromise those assets, whether it’s hackers, competitors, or the random challenges of technology. After that, you explore the different ways those threats might try to get in, like a burglar figuring out how to pick a lock or sneak through a window.

Once you’ve got a clear picture of the risks, you can put more robust locks on the doors, add alarms, or maybe even rethink the layout to make it safer. The goal is to ensure your product is as secure as possible from the get-go, rather than trying to fix things after a problem arises. And just like you’d regularly check your home security, a TMSA is something you revisit to keep up with new threats and challenges as they come up.

It’s all about being proactive and making security a natural part of your development process so your product is well-protected and ready for the real world.

Best practice #2: Select a secure microcontroller

The TMSA is a natural place to start because it helps you identify the threats and how to mitigate them. The output is a roadmap, or a set of requirements for your systems security. Once you have those requirements, you can use them to select the right pieces of hardware that can help you to secure your product. 

Related:Electronics Industry Bolsters Root of Trust Security Efforts

The most natural first selection is a secure microcontroller. Not all microcontrollers are created equally, even though we might like to think they are. The hardware capabilities of the microcontroller may determine how secure, and what techniques you’ll use to secure your product. 

For example, several years ago, as Christmas break was approaching, a potential customer contacted me requesting a secure bootloader be designed and built in a week so they could launch their product by January 1^st. Upon evaluating their needs, I discovered they had selected a microcontroller without a hardware-based Root of Trust, hardware-accelerated encryption engine, memory protection unit, or secure execution environment. 

While some things could be done to secure the system, simple, fundamental security items were missing because they didn’t perform a TMSA early in their development cycle and tried to “bolt-on” security at the end. 

A secure microcontroller is a critical component in securing an IoT product. It provides:

• A hardware-based Root-of-Trust

• Cryptographic accelerators

• Secure execution environment

• Memory Protection Units (MPUs)

Related:5 Elements to a Secure Embedded System, Part 5: Secure Storage

Make sure that if you are designing an IoT product, that you select a secure microcontroller. 

Best practice #3: Implement secure communication protocols

Once you’ve got the right microcontroller, the next step is ensuring that the data traveling to and from your device is locked down tightly. In the world of IoT, data is constantly on the move—between devices, cloud servers, mobile apps, and more. If that data isn’t adequately secured, it’s like sending a postcard in the mail—anyone who intercepts it can read its contents. To prevent this, secure communication protocols like TLS (Transport Layer Security) or DTLS (Datagram Transport Layer Security) should be implemented to encrypt data in transit. These protocols create a secure tunnel between your device and the server, ensuring that data stays confidential and untampered. Additionally, consider using mutual authentication, where the client and server verify each other’s identities before establishing a connection. This helps fend off man-in-the-middle attacks, where an attacker tries intercepting and altering communications.

Remember, secure communication is not just about encryption; it’s about ensuring that your devices speak a language only they and the intended recipient can understand. By doing so, you’re safeguarding the integrity and privacy of your users' data, which is critical in maintaining trust and compliance with security regulations.

Best practice #4: Regularly update and patch firmware

Security isn’t a one-and-done deal—it’s an ongoing process. As new vulnerabilities are discovered, your device's firmware must be updated to address these issues. That’s why having a robust mechanism for regularly updating and patching firmware is essential.

Think of your firmware as your device's brain. If it’s compromised, the whole system is at risk. But simply pushing out updates isn’t enough—you need to ensure these updates are delivered securely. Implement over-the-air (OTA) updates that use secure methods to verify and authenticate new firmware before it’s installed. 

For example, you should only install signed software. Signed software is encrypted using your company key so the product can authenticate it as an official update and verify its integrity. This ensures that only trusted updates make it onto your devices, protecting them from being compromised by malicious actors.

Additionally, it’s essential to have a plan for handling updates after your product is deployed. Will you issue patches immediately as vulnerabilities are discovered, or will you have a regular update schedule? Whatever your approach, ensure you’re prepared to support your product throughout its lifecycle. Your customers are counting on you to keep their devices secure long after they’ve left the store.

Best practice #5: Certify your device for security

Finally, after you’ve done the hard work of securing your IoT product, it’s time to get it certified. Certifications like PSA Certified or FIPS 140-2 offer a seal of approval that your device meets stringent security standards. This helps you stand out in the market and gives your customers peace of mind knowing that your product has been rigorously tested and validated by a third party.

Certification also plays a crucial role in regulatory compliance. As more governments and industries adopt strict security requirements, having a certified product can help you avoid legal pitfalls and ensure your device is ready for global markets. It’s like having a passport for your product—it proves that it’s safe to use and ready to go wherever needed.

Your next steps

To secure your own IoT products, you need to take the next step. I recommend looking at the best practices we just discussed and identifying any that you aren’t currently following. For example, if you don’t have a TMSA, make that your number one priority. That will help you to identify the threats that your system will face. 

Remember, there is no such thing as a perfectly secure system. Anything can be hacked. The trick is to identify the real threats to your system and data and take the steps to mitigate the success of such an attack. Security through obscurity doesn’t work. So don’t get caught in the headlines; consider implementing security early in your development cycle.  Your customers and your shareholders will thank you.

Happy Coding!