Hardware Podcasts

515: Script Boomers

Embedded.fm · 27 Nov 2025 · 1h 10m · Episode 515

What this episode covers

Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
OWASP, CISA, NIST, CHEST, Ubiquiti, Stop the Bleed
Products
Raspberry Pi, AWS Greengrass
Also
CVE, Microcorruption, SANS Holiday Hack Challenge

Related episodes from other shows

Other shows on the same ground, closest first.

  • IoT For All Podcast · 18m

    Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

    Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

    Embedded firmwareSecurity & privacy
    8 chapters

  • Coredump Sessions · 58m

    #008: Navigating the Changing IoT Security Landscape: A Survival Guide for Product Leaders

    Giovanni Alberto Falcione, CTO at Exine, joins Memfault's François Baldassari and Thomas Sarlandie to discuss the impact of the EU's Cyber Resilience Act (CRA) on IoT security. They analyze the shift from voluntary standards like NIST 800-53 to mandatory compliance, highlighting the critical need for runtime security monitoring and Software Bill of Materials (SBOM) tracking. The conversation details how eBPF technology enables low-overhead anomaly detection and how OTA updates are essential for mitigating vulnerabilities in the field.

    Security & privacyEmbedded firmware
    6 chapters

  • The Pragmatic Embedded Podcast · 36m

    Embedded Cybersecurity Basics with Jacob Beningo

    Jacob Beningo, an embedded software consultant and co-founder of the Embedded Online Conference, explains how to integrate security into the embedded development lifecycle without relying on waterfall methods. He details the use of hardware-based isolation, specifically citing ARM TrustZone and Cypress/Infineon PSOC 64 microcontrollers, to establish a root of trust and secure boot processes. Beningo advocates for data-driven architecture and hardware abstraction layers to maintain agility when supply chain issues or security requirements force hardware changes, and introduces ARM's Platform Security Architecture (PSA) as a framework for threat modeling and certification.

    Security & privacyMicrocontrollers & dev platforms
    8 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • IoT For All Podcast · 44m

    Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036

    Ken Munro, Partner at Pen Test Partners, explains how his team conducts 'vanilla research' by purchasing and breaking embedded IoT devices to find security vulnerabilities, such as the My Friend Kayla doll and smart heated drinks cups. He argues that security is often treated as an afterthought by startups, leading to catastrophic failures when wrong chipsets are chosen early in development, making over-the-air updates impossible. Munro details the responsible disclosure process, noting that when vendors ignore or stonewall reports, companies often go out of business, and he advocates for government regulation like California's SB 327 to enforce reasonable security controls.

    Security & privacyStarting a product company
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Embedded.fm. The episode itself belongs to its publisher.