Hardware Podcasts

#000: How New IoT Security Regulations Will Shape the Industry's Future

Coredump Sessions · 17 Sept 2024 · 1h 03m · Episode 1

What this episode covers

François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Memfault, Pebble, Nordic, Silicon Labs, ST Micro, Texas Instruments, Shimano, Cypress, FCC, NIST
Tools
Yocto, MC Boot
Also
Zephyr, FreeRTOS, PSA Certified, Matter

Related episodes from other shows

Other shows on the same ground, closest first.

  • IoT For All Podcast · 28m

    The State of IoT Development | The Eclipse Foundation's Frédéric Desbiens | Internet of Things Podcast

    Frédéric Desbiens, IoT and Edge Computing Program Manager at The Eclipse Foundation, discusses findings from the 2024 IoT & Embedded Developer Survey Report, highlighting industrial automation and automotive as leading sectors. He details the shift toward sustainability, the critical importance of security measures like post-quantum cryptography and over-the-air updates, and the growing adoption of safety-critical certifications such as ISO 26262. The conversation also covers the rise of open-source hardware, specifically RISC-V and the Open Hardware Foundation, alongside protocol trends like MQTT and SPOT Plug.

    Connected products & IoTSecurity & privacy
    7 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • IoT For All Podcast · 44m

    Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036

    Ken Munro, Partner at Pen Test Partners, explains how his team conducts 'vanilla research' by purchasing and breaking embedded IoT devices to find security vulnerabilities, such as the My Friend Kayla doll and smart heated drinks cups. He argues that security is often treated as an afterthought by startups, leading to catastrophic failures when wrong chipsets are chosen early in development, making over-the-air updates impossible. Munro details the responsible disclosure process, noting that when vendors ignore or stonewall reports, companies often go out of business, and he advocates for government regulation like California's SB 327 to enforce reasonable security controls.

    Security & privacyStarting a product company
    8 chapters

  • Global Medical Device Podcast · 42m

    #407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing

    Christian Espinosa, founder of Blue Goat Cyber, explains why medical device cybersecurity must be integrated from the requirements phase to ensure patient safety, citing real-world risks like skin burns from hacked acne lasers and missed sepsis diagnoses. He details the FDA's September 2023 regulatory overhaul, which mandates Software Bill of Materials (SBOMs), static/dynamic testing, and risk assessments tied to patient harm, noting that traditional IT security vendors often fail to meet these specific medical device standards. Espinosa warns that waiting until the last minute to address security can lead to catastrophic delays, costly retrofits like disabling hardware features due to lack of secure boot support, or even abandoned projects.

    Security & privacyCertification & compliance
    8 chapters

  • IoT For All Podcast · 28m

    What’s Driving Change in the IoT Industry? | Bsquare's Ralph C. Derrickson & Matthew Inglis

    Ralph C. Derrickson, President and CEO, and Matthew Inglis, Vice President of Engineering, from Bsquare, discuss the evolution of the IoT industry, emphasizing that devices must be secure, always-on, and capable of operating at the speed of the device. They highlight specific use cases including intelligent retailing with 50,000 point-of-sale devices, smart meters for iTron involving millions of nodes, and facility management for Arcus to prevent costly truck rolls. The guests explain that regulatory changes, such as the UK's Product Security and Telecommunications Infrastructure (PSTI) Act, are driving mandatory security practices like removing default passwords and ensuring software updatability. They advise device makers to focus on business models, lifecycle management, and the high cost of operation rather than just initial manufacturing costs.

    Security & privacyConnected products & IoT
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Coredump Sessions. The episode itself belongs to its publisher.