<p dir="ltr" id="isPasted">In recent years, the rise of Generative Artificial Intelligence (AI) has been nothing short of revolutionary. This technology, capable of producing content that closely mimics human output, has paved the way for innovations across various fields. From writing convincingly real emails to creating impressive images, generative AI's capabilities are vast and transformative.</p><p dir="ltr">However, as with any technological advancement, there are two sides to the story. The same capabilities that offer numerous benefits also pose significant risks, particularly concerning cybersecurity. Specifically, one of the most concerning developments has been the enhancement of phishing schemes, making them more sophisticated and challenging to detect than ever before. This article explores the rise of generative AI, how it's changing the phishing landscape, and best practices to avoid becoming a victim.&nbsp;</p><h1 dir="ltr">The Evolution of Generative AI</h1><p dir="ltr">Generative AI is marked by its ability to learn from a vast dataset of existing digital content and generate new, unique outputs that can pass for human-created. This process involves complex algorithms and neural network models that analyze patterns, styles, and structures within the data they're fed. As a result, generative AI can produce a wide range of outputs, including textual content, images, music, and even synthetic voices. Its applications are far-reaching, offering potential benefits in areas such as content creation, entertainment, education, and beyond. <sup>[1]</sup></p><p dir="ltr">However, the power of generative AI extends beyond positive use cases. Its very capabilities, particularly in mimicking human communication styles and generating personalized content, have opened new avenues for cybercriminals. These advancements have led to a new generation of phishing attacks that are significantly more difficult to identify and combat.</p><h1 dir="ltr">The Transformation of Phishing Tactics</h1><p>Phishing schemes have long been a staple in the arsenal of cybercriminals. Traditionally, these attacks involved sending generic, often poorly written emails, attempting to lure recipients into divulging sensitive information or downloading malicious software. While effective to a degree, these attempts were easier to spot and avoid due to their lack of personalization and sophistication. <sup>[2]</sup></p><p>Enter generative AI, and the landscape of phishing has changed dramatically. With the ability to analyze and replicate communication styles, generative AI enables cybercriminals to craft highly convincing and personalized messages. These messages can mimic the tone, style, and even specific phrases used by individuals or organizations, making them far more likely to deceive recipients.</p><h1 dir="ltr">Understanding AI-Enhanced Phishing</h1><p>The core threat of AI-enhanced phishing is its personalization and realism. Generative AI can create emails, text messages, or social media messages that look and sound like they're from a trusted source, such as a colleague, friend, or a reputable organization. This level of personalization is achieved by analyzing publicly available data or previously breached information to tailor attacks to individual targets. <sup>[3]</sup></p><p><span class="fr-img-caption fr-fic fr-dib" style="width: 790px;"><span class="fr-img-wrap"><img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzE0Mzg4NjY3Mjg2LWN5YmVyMi5wbmciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 100%px;" class="fr-fic fr-dib"><span class="fr-inner"></span></span></span></p><p dir="ltr" id="isPasted">Phishing attacks begin with tricking users out of their important credentials. Image credit:&nbsp;<a href="https://www.valimail.com/guide-to-phishing/" target="_blank">Vailmail</a></p><p><br></p><p dir="ltr" id="isPasted">For instance, a generative AI-powered phishing email might reference recent transactions, use language that matches the supposed sender's usual tone, or mimic the layout and design of legitimate correspondence. With such attention to detail, these fraudulent messages are incredibly persuasive, increasing the likelihood that recipients will comply with their requests, whether that involves providing passwords, financial information, or other sensitive data.</p><h1 dir="ltr">The Signs of AI-Generated Phishing Attacks</h1><p>Despite their sophistication, AI-generated phishing attacks are not foolproof. There are still telltale signs that can help discerning individuals identify them. These include slight inconsistencies in language or format, unusual requests, or links to websites that, upon closer inspection, have subtle differences from legitimate addresses. Moreover, these messages might lack the personal touch or in-depth knowledge that genuine communications from friends or colleagues would have, relying instead on information that could be publicly accessed or inferred.</p><h1 dir="ltr">Strategies for Personal and Organizational Protection</h1><p dir="ltr">Naturally, the advancement of AI-enhanced phishing schemes necessitates stronger defensive measures, both at personal and organizational levels. Awareness is the first step; understanding that no one is immune to these attacks is crucial. From there, adopting a multi-layered approach to security can significantly mitigate risks. <sup>[4]</sup></p><h2 dir="ltr">For individuals:</h2><ul><li dir="ltr"><p dir="ltr">Be Skeptical of Unsolicited Communications: Always approach unexpected requests for information or action with caution, even if they appear to come from known contacts or organizations.</p></li><li dir="ltr"><p dir="ltr">Verify Independently:&nbsp;If a message asks for sensitive information or to perform a specific action, verify its authenticity through an independent channel. For example, if you receive an email from your bank asking for personal details, contact the bank directly using a phone number from their official website.</p></li><li dir="ltr"><p dir="ltr">Use Advanced Security Features:&nbsp;Enable two-factor authentication (2FA) wherever possible. This adds an extra verification step that can protect your accounts even if your password is compromised.</p></li><li dir="ltr"><p dir="ltr">Regularly Update Software:&nbsp;Ensure that your operating system, applications, and anti-virus software are up to date to protect against known vulnerabilities.</p></li></ul><h3>For organizations:</h3><ul><li dir="ltr"><p dir="ltr">Conduct Regular Training: Employees should be regularly trained on the latest cybersecurity threats and how to recognize phishing attempts. Simulated phishing exercises can be particularly effective.</p></li><li dir="ltr"><p dir="ltr">Implement Strict Information Handling Policies: Limit the amount of personal and sensitive information that can be shared or accessed based on job roles.</p></li><li dir="ltr"><p dir="ltr">Adopt Advanced Security Technologies: Utilize email filtering, intrusion detection systems, and AI-based security solutions that can identify and block phishing attempts.</p></li><li dir="ltr"><p dir="ltr">Establish Clear Reporting Procedures:&nbsp;Employees should know how to report suspected phishing attempts promptly, allowing IT security teams to respond quickly.</p></li></ul><h1 dir="ltr">The Role of Continuous Education</h1><p dir="ltr">As generative AI continues to evolve, so too will the tactics used by cybercriminals. For this reason, staying informed about the latest developments in AI and cybersecurity is essential. For individuals, this means staying abreast of the latest security advice and best practices. For organizations, it involves regular training sessions and updates on cybersecurity trends and threats. <sup>[5]</sup></p><p dir="ltr">Awareness campaigns, workshops, and online courses can play significant roles in educating the public and employees about the dangers of AI-enhanced phishing schemes and how to protect against them. Knowledge is power, and in the context of cybersecurity, it's also the best defense.</p><h1 dir="ltr">Looking Ahead: The Future of AI in Cybersecurity</h1><p dir="ltr">The dual-use nature of generative AI in cybersecurity presents a continuous game of cat and mouse between cybercriminals and defenders. As AI technologies become more sophisticated, so too do the tools and strategies to combat malicious use. Future developments in AI could offer more robust detection mechanisms, identifying and neutralizing phishing attempts before they reach their intended targets. Similarly, advancements in natural language processing could enable more effective filtering of phishing content, while machine learning models might predict and block new phishing tactics.<sup>[6]</sup></p><p dir="ltr">However, as technology advances, the complexity and novelty of phishing attacks will likely increase as well. A proactive and adaptive approach to cybersecurity, emphasizing technological solutions and human vigilance and education, will be necessary to combat these advances.</p><h1 dir="ltr">Conclusion</h1><p dir="ltr">The rise of generative AI has brought with it an era of enhanced phishing schemes, presenting new challenges in the realm of cybersecurity. While these sophisticated attacks pose significant risks, the combination of advanced security measures, continuous education, and heightened awareness provides a formidable defense. As we navigate this evolving landscape, staying informed, cautious, and prepared is essential for protecting personal and organizational integrity in the digital age. Through collective effort and the strategic application of technology, we can mitigate the threats posed by AI-enhanced phishing and secure our digital future.</p><h3 dir="ltr">References</h3><ol><li dir="ltr"><p dir="ltr"><a href="https://www.techtarget.com/searchenterpriseai/definition/generative-AI" target="_blank">https://www.techtarget.com/searchenterpriseai/definition/generative-AI</a></p></li><li dir="ltr"><p dir="ltr"><a href="https://www.phishing.org/what-is-phishing" target="_blank">https://www.phishing.org/what-is-phishing</a></p></li><li dir="ltr"><p dir="ltr"><a href="https://withpersona.com/blog/ai-phishing-attacks" target="_blank">https://withpersona.com/blog/ai-phishing-attacks</a></p></li><li dir="ltr"><p dir="ltr"><a href="https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams" target="_blank">https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams</a></p></li><li dir="ltr"><p dir="ltr"><a href="https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing" target="_blank">https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing</a></p></li><li dir="ltr"><p dir="ltr">https://sennovate.com/the-role-of-artificial-intelligence-in-detecting-phishing-attacks/</p></li></ol>

Generative AI has opened up an entirely new world of cybersecurity threats. 


The Rise of Generative AI and Enhanced Phishing Schemes

<p id="isPasted">Health-monitoring apps can help people manage chronic diseases or stay on track with fitness goals, using nothing more than a smartphone. However, these apps can be slow and energy-inefficient because the vast machine-learning models that power them must be shuttled between a smartphone and a central memory server.</p><p>Engineers often speed things up using hardware that reduces the need to move so much data back and forth. While these machine-learning accelerators can streamline computation, they are susceptible to attackers who can steal secret information.</p><p>To reduce this vulnerability, researchers from MIT and the MIT-IBM Watson AI Lab created a machine-learning accelerator that is resistant to the two most common types of attacks. Their chip can keep a user’s health records, financial information, or other sensitive data private while still enabling huge AI models to run efficiently on devices.</p><p>The team developed several optimizations that enable strong security while only slightly slowing the device. Moreover, the added security does not impact the accuracy of computations. This machine-learning accelerator could be particularly beneficial for demanding AI applications like augmented and virtual reality or autonomous driving.</p><p>While implementing the chip would make a device slightly more expensive and less energy-efficient, that is sometimes a worthwhile price to pay for security, says lead author Maitreyi Ashok, an electrical engineering and computer science (EECS) graduate student at MIT.</p><p>“It is important to design with security in mind from the ground up. If you are trying to add even a minimal amount of security after a system has been designed, it is prohibitively expensive. We were able to effectively balance a lot of these tradeoffs during the design phase,” says Ashok.</p><p>Her co-authors include Saurav Maji, an EECS graduate student; Xin Zhang and John Cohn of the MIT-IBM Watson AI Lab; and senior author Anantha Chandrakasan, MIT’s chief innovation and strategy officer, dean of the School of Engineering, and the Vannevar Bush Professor of EECS. The research will be presented at the IEEE Custom Integrated Circuits Conference.</p><h2><strong>Side-channel susceptibility</strong></h2><p>The researchers targeted a type of machine-learning accelerator called digital in-memory compute. A digital IMC chip performs computations inside a device’s memory, where pieces of a machine-learning model are stored after being moved over from a central server.</p><p>The entire model is too big to store on the device, but by breaking it into pieces and reusing those pieces as much as possible, IMC chips reduce the amount of data that must be moved back and forth.</p><p>But IMC chips can be susceptible to hackers. In a side-channel attack, a hacker monitors the chip’s power consumption and uses statistical techniques to reverse-engineer data as the chip computes. In a bus-probing attack, the hacker can steal bits of the model and dataset by probing the communication between the accelerator and the off-chip memory.</p><p>Digital IMC speeds computation by performing millions of operations at once, but this complexity makes it tough to prevent attacks using traditional security measures, Ashok says.</p><p>She and her collaborators took a three-pronged approach to blocking side-channel and bus-probing attacks.</p><p>First, they employed a security measure where data in the IMC are split into random pieces. For instance, a bit zero might be split into three bits that still equal zero after a logical operation. The IMC never computes with all pieces in the same operation, so a side-channel attack could never reconstruct the real information.</p><p>But for this technique to work, random bits must be added to split the data. Because digital IMC performs millions of operations at once, generating so many random bits would involve too much computing. For their chip, the researchers found a way to simplify computations, making it easier to effectively split data while eliminating the need for random bits.</p><p>Second, they prevented bus-probing attacks using a lightweight cipher that encrypts the model stored in off-chip memory. This lightweight cipher only requires simple computations. In addition, they only decrypted the pieces of the model stored on the chip when necessary.</p><p>Third, to improve security, they generated the key that decrypts the cipher directly on the chip, rather than moving it back and forth with the model. They generated this unique key from random variations in the chip that are introduced during manufacturing, using what is known as a physically unclonable function.</p><p>“Maybe one wire is going to be a little bit thicker than another. We can use these variations to get zeros and ones out of a circuit. For every chip, we can get a random key that should be consistent because these random properties shouldn’t change significantly over time,” Ashok explains.</p><p>They reused the memory cells on the chip, leveraging the imperfections in these cells to generate the key. This requires less computation than generating a key from scratch.</p><p>“As security has become a critical issue in the design of edge devices, there is a need to develop a complete system stack focusing on secure operation. This work focuses on security for machine-learning workloads and describes a digital processor that uses cross-cutting optimization. It incorporates encrypted data access between memory and processor, approaches to preventing side-channel attacks using randomization, and exploiting variability to generate unique codes. Such designs are going to be critical in future mobile devices,” says Chandrakasan.</p><h2><strong>Safety testing</strong></h2><p>To test their chip, the researchers took on the role of hackers and tried to steal secret information using side-channel and bus-probing attacks.</p><p>Even after making millions of attempts, they couldn’t reconstruct any real information or extract pieces of the model or dataset. The cipher also remained unbreakable. By contrast, it took only about 5,000 samples to steal information from an unprotected chip.</p><p>The addition of security did reduce the energy efficiency of the accelerator, and it also required a larger chip area, which would make it more expensive to fabricate.</p><p>The team is planning to explore methods that could reduce the energy consumption and size of their chip in the future, which would make it easier to implement at scale.</p><p>“As it becomes too expensive, it becomes harder to convince someone that security is critical. Future work could explore these tradeoffs. Maybe we could make it a little less secure but easier to implement and less expensive,” Ashok says.</p>

A new chip can efficiently accelerate machine-learning workloads on edge devices like smartphones while protecting sensitive user data from two common types of attacks — side-channel attacks and bus-probing attacks. Image: Chip figure courtesy of the researchers; MIT News; iStock.

Researchers have developed a security solution for power-hungry AI models that offers protection against two common attacks.

This tiny chip can safeguard user data while enabling efficient computing on a smartphone

Harnessing cutting-edge technology to optimize energy efficiency, comfort, and security in modern buildings

Building Management: The Power of Building Automation Systems

<p id="isPasted">While embedded systems tend to lack the processing horsepower of servers or even modern personal computers, the sheer number of devices is making them an increasingly valuable target for bad actors looking to run illegal botnets and cryptocurrency mining operations. One of the first major security-related wake-up calls for embedded system designers was the 2016 Nest thermostat botnet attacks. Given the consumer-facing nature of the particular Internet of Things (IoT) coupled with an increased sensitivity regarding privacy and security; the Nest botnet caused a huge amount of discussion. Those discussions tended to center on how companies should build security into their low-cost IoT products and how consumers can safely operate the devices in their homes and businesses.</p><p>With the growing threat of cyberattacks, it is essential that developers keep security considerations in mind throughout the design process. By following some practical tips and recommendations, developers can guard against a wide range of attack scenarios. Read on for an outline of security measures developers can use in their embedded designs.</p><h2>Build Secure</h2><p>While there are numerous chip architectures, operating systems, and communications protocols; many IoT devices tend to be built around Arm<sup>®</sup>-based architectures, and if they run an OS it tends to be a Linux distribution. This commonality is good in many ways; lower costs and faster development times; it also comes with quite a few negatives. Attack vectors tend to become “one-size-fit-all”, especially for devices running a Linux-based OS. To mitigate the threats associated with widespread devices that share a common architecture, developers should implement the following “quick win” security design principles:</p><ul><li>Do NOT hardcode passwords into the firmware. Also, do not use a common default password for all devices. Require the user to create a custom username and password during device initialization.</li><li>Do NOT enable insecure protocols such as HTTP, FTP, or Telnet by default. Data going off the device via wired or wireless protocols must be strongly encrypted. Avoid “homebrewed” encryption solutions.</li><li>Ship the device with the most restrictive configuration possible and let the end-user make a proactive decision to reduce security-related settings.</li><li>All mechanisms used to access the devices should require authentication and authorization controls. Two-factor authentication (2FA) should be used if practical.</li><li>All user-facing inputs should be filtered to avoid injection-type attacks.</li><li>Implement a secure device management interface for the end-user that will allow them to manage their assets, update devices, monitor devices, and securely decommission the devices that have reached their end-of-life (EOL).</li><li>Over-The-Air (OTA) update mechanisms must be validated on-device. The update files must be sent encrypted en route to the device. Lastly, ensure there are anti-rollback features to prevent a device from being reverted to a previous, insecure firmware.</li><li>If third-party software libraries are used in the design of your device, they must be continually monitored to ensure that third-party updates are integrated and that they do not become deprecated. Abandoned software projects can become nasty vulnerabilities for your device. Change the third-party software default passwords before committing them to your project.</li><li>Limit what sensitive data should be stored on the device. Store such information in a secure enclave only.</li><li>Remember that with the IoT that embedded systems are only one part of a larger ecosystem. Ensure that security is built into the cloud, desktop, and mobile applications as well. Ecosystem security is only as strong as the weakest link.</li><li>Consider establishing a bug bounty program to encourage end-users and security researchers to submit flaws in a secure, responsible manner.</li></ul><p>Physical access to a device tends to be the game-over situation for devices. That doesn’t mean that there aren’t things that can be done to make it harder physically exploit these types of devices. Entire books have been written on making circuit boards and associated enclosures tamper-resistant but for a few “quick wins” consider the following physical design rules-of-thumb to harden your device:</p><ul><li>Pins for debugging ports such as JTAG and UARTs are very useful when developing and testing a device. They are also tempting targets for those seeking to reverse engineer a device with ill-intent. Obfuscating these pins and/or removing header pins for production units is recommended. Note that this will come at the expense of making it more difficult to troubleshoot once fielded. Designers must consider a balance between security and maintainability.</li><li>The use of adhesives, ultrasonic welding, and/or specialty security screws can make it more difficult to open a device.</li><li>Applying a non-conductive epoxy over sensitive components can obfuscate their identity and purpose.</li><li>You might be tempted to use older components that might have vulnerabilities. Be aware of the counterfeit components as well. If a deal seems too good to be true, it probably is. Balancing security and time-to-market considerations is not a decision to be taken lightly.</li><li>Multilayer boards can be used to route traces in a way that makes it harder to discern how the board functions.</li></ul><p>Some of the following recommendations might be a bit much for consumer-grade IoT devices. However, as we will elaborate on later, industrial control systems and defense systems would likely benefit from these more robust physical security measures:</p><ul><li>Build security features into the board itself, such as microswitches, mercury switches, or magnetic switches that can detect if a board is being unintentionally handled or opened. Nichrome wire or fiber optics can also be used. If the wire or fiber is negatively impacted by someone trying to tamper with a device, then there will be a detectable change in the current flow of the wire or the behavior of photons through the fiber.</li><li>Side Channel or glitching attacks, while perhaps not common, provide a unique advantage to adversaries in that they use the laws of physics against a device and thus are very difficult to prevent though can be detected. By attacking the timing or restricting the flow of electrons to a CPU, it’s possible to get a device to act in unintended ways that negate security features. Voltage and current sensors can be implemented onboard circuit boards to detect if glitching may be occurring, though there is potential for false positives.</li><li>Significant adversaries can employ x-ray machinery to peer into microchips and discover the topography of the transistors to determine function and more. Sensors that detect x-rays can be added to detect tampering, though can do nothing to prevent an adversary from extracting useful information.</li></ul><p>It should be noted that there is quite a dichotomy between the paradigms of security and openness. Security values obfuscation. Open hardware values understanding. Regardless, keep in mind the old adage that locks only keep honest people honest, and so too with security-at-large. For more information on how to build secure IoT devices, visit the Open Web Application Security Project (OWASP) IoT Project.</p><h2>Operate Secure</h2><p>Even if a manufacturer could implement all the best secure design principles in their product, they would be mostly for naught if the end-user does not operate their device in a secure manner.</p><ul><li>Change the default router name, router password, network name (SSID), and network encryption key. Be sure to use strong password principles and do not use the same password for both networks.</li><li>Segment your home network into two “virtual” networks so that IoT devices cannot be “seen” by the desktop computers, Network Attached Storage (NAS) devices, etc. To do this quickly and easily, use the guest network feature for your IoT network.</li><li>Most IoT devices rely on a smartphone app to control the device. Keep the app up to date and use 2FA for login if available.</li><li>Disable any features of your IoT devices that you do not intend to use.</li><li>Update the firmware of both your router and IoT devices on a regular basis.</li><li>When an IoT device reaches the end of life and no longer receives updates consider replacing it with a newer model.</li></ul><h2>Industrial Strength Security</h2><p>Consumer-facing IoT products may be plentiful, but their industrial counterparts, collectively&nbsp;<iframe id="65f2ad2682d39cfbc40c772a" width="250" class="specs-iframe" height="440" src="https://wevolver.com/iframe/specs/microchip-technology-evb-pci11400-pcie-switch-evaluation-board?iframe=true" frameborder="0" scrolling="no" data-lf-form-tracking-inspected-kn9eq4roawkarlvp="true" data-lf-yt-playback-inspected-kn9eq4roawkarlvp="true" data-lf-vimeo-playback-inspected-kn9eq4roawkarlvp="true"></iframe> referred to as Industrial Control Systems (ICS) manage numerous extremely important and potentially dangerous processes. Everything from energy production to factories uses embedded digital technology (referred to as Operational Technology or OT; in contrast to office-centric Information Technology or IT) to control the facilities and associated machinery responsible for performing the various processes. The ICS environment is sufficiently different from a strict IT environment that special considerations for hardening OT devices and ICS networks are warranted. The most fundamental principle is that ICS should not have a connection to the internet. While this seems like a no-brainer, it is surprising how often this fundamental rule is violated. For more information on how to secure ICS networks and devices, there are two security frameworks you should review: MITRE ATT&amp;CK for ICS and the MITRE ATT&amp;CK for Enterprise.</p><p>The nature of where ICS systems are typically found (e.g., areas that are environmentally, chemically, or otherwise hazardous) means ICS has been designed to prioritize the availability of the systems over confidentiality. From a positive perspective, this typically means there are redundant systems, and those systems are designed to fail safely. However, ICS systems can be left in operations for several decades and may not always be kept up-to-date. In addition, many of the protocols are older and were built with efficiency, not security in mind. Bottom line, security in the ICS or IIoT space is uniquely challenging and best practices may be difficult to implement. However, embedded developers for such machinery should be cognizant of the need to modernize their design practices and incorporate security into future designs and not treat it as a bolt-on afterthought.</p>

(Source: Nikolay N. Antonov - stock.adobe.com)

With the growing threat of cyberattacks, it is essential that developers keep security considerations in mind throughout the design process. By following some practical tips and recommendations, developers can guard against a wide range of attack scenarios.

Practical Tips for Embedded System Security

Are you an EE looking for a new podcast?  Here's a list of MacroFab Circuit Break episodes to get you started. 

The Perfect Binge! Top 8 Circuit Break Episodes for New Listeners

<h1 id="isPasted">Cybersecurity &amp; the Supply Chain: Safeguarding PCBA Builds</h1><section><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626033-1712161626033.png" alt="Cybersecurity supply chain first" class="fr-fic fr-dii"><p>In today's hyper-connected world, the intersection of cybersecurity and the global supply chain has become increasingly crucial, particularly for electronics organizations. The growing reliance on digital technology and the Internet of Things (IoT) has given rise to new challenges, exposing vulnerabilities in cybersecurity measures and creating opportunities for cybercriminals.</p><p>In this blog post, we'll explore the current state of cyberattacks, the staggering financial and reputational costs of cybercrime, and the steps organizations can take to protect their Printed Circuit Board Assembly (PCBA) builds while fulfilling their ethical obligations to end users and the wider community.</p><h2></h2><h3>The State of Cyberattacks</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626427-1712161626426.png" alt="State of cyberattacks" class="fr-fic fr-dii"><p>As we delve into the murky world of cyber threats, it's essential to understand the various attacks prevalent today. The cost of cybercrime is on the rise. With businesses becoming increasingly digital, the opportunities for cybercriminals are growing. In 2022, the estimated global cost of cybercrime was a staggering $600 billion, expected to rise in the coming years.</p><p>The digital world has observed a striking surge in ransomware assaults in recent years. These pernicious attacks not only freeze critical business functions, potentially leading to significant operational losses, but they can also inflict substantial financial penalties and tarnish an organization's reputation. Prominent cases such as the Colonial Pipeline incident in 2021 serve as stark reminders of the potential scale and real-world implications of these attacks.</p><p>The rapidly expanding ecosystem of the Internet of Things (IoT) is increasingly falling under the crosshairs of cybercriminals. This interconnected network of devices, particularly integral and of interest to the electronics industry, often lacks stringent security protocols, making them prime targets for exploitation. Notably, the Mirai botnet attack of 2016, which commandeered IoT devices to launch distributed denial of service (DDoS) attacks, illustrates the inherent vulnerabilities of these systems.</p><p>Persistent threats from nation-state actors continue to menace government institutions and organizations, drawn by the cache of sensitive information they harbor. The U.S., with its vast digital infrastructure and wealth of data, remains a high-profile target, enduring an incessant barrage of cyberattacks. Examples of this include the SolarWinds hack of 2020, widely attributed to a nation-state actor, which infiltrated numerous U.S. government agencies.</p><h2></h2><h3>How Cybercrime and PCBA Design Interconnect</h3><p>PCBA design plays a significant role in determining the security and integrity of electronic devices, as it influences the effectiveness of security measures, exploitable vulnerabilities, and how resilient electronic devices are to cyber threats.</p><p>In this context, a well-executed PCBA design, integrating robust security practices, can help safeguard against cybercrime. Conversely, a poorly designed PCBA can create vulnerabilities that cybercriminals can exploit, leading to data breaches, unauthorized access, and other malicious activities.</p><p>Here are some specific ways PCBA design can enhance or undermine cybersecurity:</p><ul><li><strong>Device Vulnerabilities</strong>: PCBA design plays a crucial role in determining the security of electronic devices. If a PCBA is poorly designed, it may have vulnerabilities that can be exploited by cybercriminals. For example, inadequate security measures, weak authentication mechanisms, or insufficient protection against tampering could make the device more susceptible to cyberattacks. Several <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-42114" target="_blank">modern DRAM devices</a> were affected by a novel Rowhammer attack in 2021.</li><li><strong>Malware and Backdoors</strong>: Cybercriminals may target PCBA design to introduce malware or backdoors into electronic devices. By compromising the PCBA design process or the supply chain, attackers can inject malicious code into the firmware or hardware of the device, allowing them to gain unauthorized access, control the device remotely, or steal sensitive information.</li><li><strong>Data Breaches</strong>: PCBA design flaws can also contribute to data breaches. If a PCBA lacks proper encryption mechanisms or fails to implement secure communication protocols, cybercriminals may intercept or manipulate data transmitted by the device, leading to the compromise of sensitive information.</li><li><strong>Countermeasures</strong>: Conversely, PCBA designers need to incorporate cybersecurity measures into their designs to mitigate the risks of cybercrime. This includes implementing secure communication protocols, strong encryption algorithms, secure authentication mechanisms, and physical protection against tampering. By considering cybersecurity during the PCBA design process, designers aim to minimize vulnerabilities and enhance the overall security of the device.</li><li><strong>Forensics and Investigation</strong>: In the aftermath of a cybercrime incident, PCBA design can play a role in forensic analysis and investigation. Experts may examine the PCBA design, firmware, or components to identify potential vulnerabilities, backdoors, or traces of tampering. This analysis can help in understanding the nature of the cyberattack, attributing it to specific actors, and taking appropriate measures to prevent future incidents. After the SolarWinds supply chain attack in 2020, cybersecurity experts investigated both the affected software and the hardware it interacted with.</li></ul><p>The impact of PCBA design on cybersecurity cannot be overstated. A poorly designed or delivered product with design flaws or vulnerabilities not only risks user data and privacy but also puts individuals and organizations at risk of financial loss and reputational damage.</p><p>As such, it is imperative for companies to invest in robust PCBA design processes, incorporate best practices for security, and conduct thorough testing and evaluation to identify and address potential vulnerabilities.</p><p>To avoid the financial repercussions of delivering a product leading to a cyber breach, companies should ensure they maintain continuous high standards for PCBA design and protection during manufacturing by working with a trusted manufacturing partner who takes security seriously. By prioritizing cybersecurity, companies can contribute to a safer digital landscape, bolster user trust, and mitigate the risks associated with cybercrime.</p><h2></h2><h3>The Cost of Cybercrime</h3><p>Cybercrime carries far-reaching financial implications. For example, in the U.S., the average cost of a data breach in 2022 was estimated to be $8.64 million. Moreover, the time it takes to identify and remediate a breach is also a significant factor in the overall cost. On average, it takes organizations 280 days to identify and contain a breach, during which the cybercriminals can cause substantial damage.</p><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626668-1712161626668.png" alt="Cost of cybercrime graph1" class="fr-fic fr-dii"><p>Source: <a href="https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/" target="_blank">Cybercrime Magazine</a><br>Projections suggest that by 2025, the annual cost of cybercrime will skyrocket to $10.5 trillion, almost tripling the cost recorded in 2015.</p><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626744-1712161626744.png" alt="Cost of cybercrime graph2" class="fr-fic fr-dii"><p>Source: <a href="https://www.statista.com/statistics/273575/us-average-cost-incurred-by-a-data-breach/" target="_blank">Statista</a></p><p>Furthermore, reputational damage, loss of customer trust, and potential legal repercussions can have far-reaching effects hard to quantify but are just as damaging.</p><h2></h2><h3>Protective Measures for Electronics Organizations Against Cyber Threats</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626943-1712161626943.png" alt="Protective measures" class="fr-fic fr-dii"><p>The cost of cybercrime is expected to soar in the coming years. Global expenditure in the cybersecurity market is projected to rise by $5.7 trillion between 2023 and 2028, reaching a staggering $13.82 trillion by 2028. Electronics organizations are particularly vulnerable, as cyberattacks can lead to intellectual property theft, product counterfeiting, and fraud.</p><p>To address these challenges, manufacturers must adopt a comprehensive approach to cybersecurity. This section outlines several data-driven steps manufacturers can take to protect themselves against cyber threats.</p><h3></h3><h3>Uphold IP Confidentiality Throughout Manufacturing</h3><p>For electronics organizations, ensuring the protection of intellectual property (IP) during the manufacturing process is of paramount importance. This is due to the potential of cyberattacks and theft. Here are some actionable steps to guarantee IP confidentiality throughout manufacturing:</p><ul><li><strong>Secure File Sharing</strong>: Adopt secure practices for sharing design files with contract manufacturers (CMs). Measures could include file encryption, password protection, and the use of secure file transfer protocols. Access to design files should be strictly limited to necessary personnel.</li><li><strong>Trusted Partners</strong>: Maintain a strong relationship with CMs known for protecting sensitive information. Perform regular security audits to verify compliance and ensure they have robust cybersecurity defenses.</li><li><strong>Non-disclosure Agreements (NDAs)</strong>: Establish NDAs with CMs and other partners who handle sensitive design files. These agreements should stipulate each party's responsibilities concerning IP protection and penalties for breaches.</li><li><strong>Design Obfuscation</strong>: Consider employing techniques that make unauthorized understanding or reverse-engineering of design files challenging. These could include splitting designs across multiple files or using proprietary file formats.</li><li><strong>Monitoring and Tracking</strong>: Consistently oversee and track the handling of design files throughout the manufacturing process. Implement a system that records access to sensitive files</li><li><strong>Manufacture in IP-strong locations</strong>: Manufacturing in countries with robust IP laws, like the USA and Mexico, further protects designs against cyber attacks.</li><li><strong>Employee training</strong>: Train employees on the importance of IP protection and the potential consequences of IP theft. Encourage a culture of cybersecurity awareness and vigilance within the organization. Ensure all manufacturing partners do the same.</li></ul><p>By taking these proactive measures, electronics organizations can significantly reduce the risk of IP theft during manufacturing, helping maintain their competitive edge and protect their investments in research and development.</p><h3></h3><h3>Mitigate Counterfeit Component Risks through Strategic Sourcing</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161627129-1712161627129.png" alt="Mitigate conterfeit component risks" class="fr-fic fr-dii"><p>A 2020 study by the Alliance for Gray Market and Counterfeit Abatement (AGMA) found that counterfeit components in the technology industry lead to an estimated loss of $28 billion in revenue annually. Ensuring components are sourced from reliable and verified suppliers can help mitigate this risk.</p><p>Not only can counterfeit components lead to system instability, failures, or unusual behaviors that can aid a cyberattack, but they can also allow embedded malware and hardware trojans to be activated once the PCBA they're attached to has been used. By doing so, hackers can gain unauthorized access to sensitive data or disrupt the device's operations.</p><p>To mitigate these risks, companies should maintain the integrity of their supply chain by vetting suppliers carefully and by using secure hardware and software design practices to protect against threats.</p><h2></h2><h3>Conclusion</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161627252-1712161627252.png" alt="Cybersecurity supply chain conclusion" class="fr-fic fr-dii"><p>In conclusion, the rapidly evolving landscape of cyber threats and the significant financial and reputational damages that cyberattacks can inflict necessitate proactive measures to safeguard businesses, particularly in the electronics industry. As cybercrime costs continue to rise, organizations must prioritize implementing robust cybersecurity strategies to protect their valuable assets and intellectual property.</p><p>By adopting various data-driven protective measures, such as detection and prevention tools, employee training, response planning, IP protection, and secure strategic sourcing, organizations can effectively mitigate cyber risks and create a more resilient and secure environment for their operations. Proactive investment in cybersecurity is essential for the survival of individual businesses and plays a crucial role in maintaining the integrity and security of the global supply chain.</p></section><h4>Discover How MacroFab Can Keep Your IP Safe&nbsp;</h4><p><a href="https://www.macrofab.com/prototyping/intellectual-property/" target="_blank">PROTECT YOUR BUILDS WITH MACROFAB</a></p><p><br></p>

Hackers can access sensitive data and disrupt device operations by activating embedded malware or hardware trojans in counterfeit components.  How can you avoid these issues? 

Cybersecurity and the Supply Chain: Safeguarding PCBA Builds

<p dir="ltr" id="isPasted">Wearable electronic devices designed to be worn while in use are becoming more popular and powerful as they can monitor various aspects of human health, activity, and environment. However, these devices also face challenges such as limited battery life, data privacy, and network bandwidth. To overcome these challenges, edge computing and AI/ML are emerging as key technologies that can enable wearable devices to process data locally, reduce latency, and enhance user experience.&nbsp;</p><p dir="ltr">As wearable technologies evolve to meet market needs, new devices are upgrading features such as basic BLE connectivity by adding the ability to run AI algorithms on neural processors on-device rather than in the cloud. This reduces the amount of data that needs to be transmitted over the network, saving energy and bandwidth. With the AI/ML models running in silicon, wearable devices can, therefore, learn from data and perform tasks such as recognition, classification, prediction, and optimization without incurring additional latency, data costs, and power consumption. However, these improvements require greater processing power and capabilities from embedded microcontrollers (MCUs) and application processors. At the same time, consumers expect longer battery life from their wearables. Thus, new chips must balance connectivity and higher processing power with low power consumption while maintaining a small enough package size.&nbsp;</p><p dir="ltr">This case study explores the challenges for the next generations of wearable MCUs with a specific look at <a href="https://alifsemi.com/" target="_blank" rel="noopener noreferrer">Alif Semiconductor's®</a> Balletto™ family of BLE-enabled MCUs for wearable applications.</p><h2 dir="ltr">The current landscape</h2><p dir="ltr">The wearables market, which includes common accessories such as smart bands, smart rings, smartwatches, and medical devices, such as glucose monitoring devices is projected to grow to USD 118.16 billion by 2028 at a 13.8% CAGR. Demand for multimedia devices, smartphones, fitness trackers, and health wearables drives growth. Increasing health awareness fuels interest in fitness tracking devices for activities like cycling and running, contributing to market expansion.<sup>[2,3]</sup></p><p dir="ltr">Wearables have evolved significantly in recent years, presenting enhanced capabilities in various domains, such as AI processing and wirelessly transmitting data. New market demands have driven the expansion of wearable features. For example, the COVID-19 pandemic made blood oxygen sensing a must-have feature for many smartwatches. As a result, Apple and Samsung included blood oxygen monitoring in their smartwatches in 2020.</p><p dir="ltr">Wearables incorporate edge AI-based solutions to process huge amounts of data in real-time. AI-enabled microcontrollers are a must to carry out these large AI/ML workloads efficiently and quickly. The integration of artificial intelligence enables new features, such as:</p><ul><li dir="ltr"><p dir="ltr">Tracking and analyzing changes in users’ health data.</p></li><li dir="ltr"><p dir="ltr">Sending users alerts for noise levels or air quality.</p></li><li dir="ltr"><p dir="ltr">Personalize your device based on your tracked activity.&nbsp;</p></li></ul><p dir="ltr">Equally important as collecting and processing user data is the ability to wirelessly share data between devices. As such, Bluetooth connectivity has risen as a top requirement for wearables including functionalities, such as:&nbsp;</p><ul><li dir="ltr"><p dir="ltr">Sending an alert to emergency services if a fall is detected.</p></li><li dir="ltr"><p dir="ltr">Sharing important health updates with an approved health care professional.</p></li><li dir="ltr"><p dir="ltr">Sharing workout metrics with a friend to stay motivated.</p></li></ul><h2 dir="ltr">Bluetooth LE changes the status quo in wearables</h2><p dir="ltr">Among the many low-power wireless technologies on the market, Bluetooth Low Energy (BLE) technology is uniquely suited for wearable devices that require long battery life measured in days or even weeks before needing to be recharged. BLE allows wearables to easily connect and communicate with other devices, such as smartphones, tablets, exercise equipment, or even other wearables.&nbsp;</p><p dir="ltr">This enhances the device's functionality by enabling it to share exercise data, receive timely notifications, and more. Increasingly, wearable devices are adding audio support for which BLE is uniquely positioned. With the addition of support for the Low Complexity Communication Codec (LC3), BLE is now capable of use cases such as broadcast audio and shared or group listening experiences with LE Audio’s Auracast feature. For example, a wearable device can use the on-device neural processor such as Arm’s Ethos-U55 to run a convolutional neural network (CNN) model for gesture recognition or activity classification based on the motion data captured by inertial measurement units (IMUs). The device can then use BLE to communicate with other devices or a smartphone app to provide feedback or instructions to the user.&nbsp;</p><p dir="ltr">In the Smart Home, wearables can be integrated into a smart home system, with AI algorithms learning the user's habits and preferences to automate various home appliances. BLE 5.4's enhanced performance and range can facilitate efficient communication with many IoT devices in the home. For example, a wearable could learn that a user likes to listen to calming music when they get home from work and automatically instruct the smart speaker to play the user's favorite playlist when they walk through the door.&nbsp;</p><p dir="ltr">Additionally, features allow wearables to be located precisely, while location-based services (LBS) such as personalized fitness coaching (created by learning from a user’s previous workout data) can be enabled. It can suggest workout routines tailored to the user's fitness goals and current health status. The wearable device can recognize the user’s activity and posture using an ML model that runs on the Ethos-U55 core and sends the data to a cloud service via Enhanced Attribute Protocol (EAP). This could enable personalized, reliable, and secure fitness tracking for the user.&nbsp;</p><p dir="ltr"><span class="fr-img-caption fr-fic fr-dib" style="width: 768px;"><span class="fr-img-wrap"><img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzEzMTY0MTY0MDQ1LVdob29wLUJvZHlUcmFpbmluZy1Ub3AuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 100%px;" class="fr-fic fr-dib"><span class="fr-inner">Next-gen wearables will enable highly-personal fitness tracking. Credit: WHOOP.</span></span></span></p><p dir="ltr">&nbsp;AI/ML algorithms can be trained to detect patterns in biometric data gathered by wearables, such as heart rate, blood pressure, and oxygen saturation levels. BLE's enhanced broadcast communication mechanism (EAD, PAwR) can allow these devices to send real-time health risk alerts to other devices, such as a smartphone, even in congested or high-interference environments. For example, a wearable could alert a user or a healthcare provider if it detects signs of an impending health crisis like a heart attack or stroke.&nbsp;</p><p dir="ltr">When you combine AI-enabled MCUs with BLE, wearables become more personalized, efficient, secure, and useful in our everyday lives. Alif Semiconductor <a href="https://alifsemi.com/press-release/first-ble-matter-wireless-microcontroller-with-neural-co-processor-for-ai-ml/" target="_blank">has just announced</a> their Balletto family of BLE and Matter microcontrollers<b id="isPasted">&nbsp;</b>with neural processing for AI/ML workloads, which seeks to exceed the standard for low-power BLE operations.</p><h2 dir="ltr">Hardware accelerated machine learning</h2><p dir="ltr">To meet the market-need for state-of-the-art wearables, Alif Semiconductor offers AI/ML-enabled microcontrollers with dedicated NPU accelerators that allow heavy AI/ML workloads to run without compromising battery life. <a href="https://alifsemi.com/products/balletto/" target="_blank" id="isPasted">The Alif Balletto family</a> of microcontrollers introduces the world's most power-efficient microcontroller with on-device secure AI/ML processing, top-notch security, and ample peripherals for applications requiring integrated Bluetooth Low Energy and 802.15.4-based connectivity.&nbsp;</p><p dir="ltr">The Balletto family boasts the powerful Arm® Cortex®-M55 core, equipped with double-precision FPU and Helium Vector Extensions, operating at a remarkable speed of up to 160MHz. Arm Ethos-U55 is a dedicated NPU accelerator that offloads AI/ML operations from the Cortex-M55 processor, allowing the M55 cores to operate in very low-power modes. This is especially important for wearables like hearing aids, which need to have a long battery life. Equally as important for wearables is having a small form-factor design, which Balletto can provide in a sub 16mm ² package. &nbsp;&nbsp;</p><p dir="ltr">Balletto’s Ethos™-U55 Neural Processing Unit (NPU) can improve the performance and efficiency of speech recognition machine learning models by up to two orders of magnitude, excluding the 5-10x improvement already provided by the Cortex-M55 core over previous generation Cortex-M CPUs. This is ideal for wearables that rely on voice commands, improving processing speed and lowering latency.&nbsp;</p><p dir="ltr"><span class="fr-img-caption fr-fic fr-dib" style="width: 768px;"><span class="fr-img-wrap"><img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzEyODQyNDU1ODU5LWFsaWYgbWFpbiAyLnBuZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 100%px;" class="fr-fic fr-dib"><span class="fr-inner">Balletto and Ensemble families. Image credit: Alif Semiconductor.</span></span></span></p><h3 dir="ltr" id="isPasted">Battery-friendly microcontrollers powered by Alif’s aiPM™ technology&nbsp;</h3><p dir="ltr">The Balletto family also tackles a common problem seen by previously existing AI/ML-powered microcontrollers: short battery life. Connected wearables or mission-critical devices like hearing aids depend on long battery life for users. Their ability to function is hindered when there is a need for heavy local processing and AI/ML. Balletto MCUs are the most power-efficient in their class, thanks to Alif's innovative aiPM technology. This technology manages all aspects of the device, including individual processing cores for real-time control, neural processing, DSP and audio, deep security, and radio protocols capable of BLE 5.4 with LE Audio, Thread, and Matter. Balletto devices also include a wide range of interfaces and large memories, all monolithically integrated inside extremely small packages. This makes them ideal for demanding battery-powered applications such as wearables and hearables.</p><p dir="ltr">Alif Semiconductor’s aiPM technology manages the power usage of the device through 8 power domains. It activates only the necessary chip sections and deactivates them when not in use, resulting in a highly efficient always-on region when there is a high requirement for local processing and AI/ML. The integrated dual-PA and on-chip antenna gives customers control of the reliability-range equation by providing tuning options of 4 dBm or up to 10 dBm Bluetooth transmit power. &nbsp;Balletto’s Bluetooth radio has a receive current of 1.5mA and a transmit current of 2.0mA, making it power conscious.</p><p dir="ltr">Additionally, off-die peripherals produce higher energy consumption for wearables, while Balletto’s on-die solution fosters maximum efficiency. Utilization of the internal bus fabric effectively lowers access time, dynamic power, and standby power, ultimately providing more granular and precise power control at a lower cost.&nbsp;</p><h3 dir="ltr">Balletto family multi-layered security</h3><p dir="ltr">In addition to handling processing requirements, microcontrollers for wearables must ensure data security. Alif Balletto microcontrollers provide exceptional security features with multiple layers of protection, including:</p><ul><li dir="ltr"><p dir="ltr">Root of Trust</p></li><li dir="ltr"><p dir="ltr">Unique device ID for each individual chip</p></li><li dir="ltr"><p dir="ltr">Dedicated security processor</p></li><li dir="ltr"><p dir="ltr">Dedicated protected memory</p></li><li dir="ltr"><p dir="ltr">Configurable firewalls that regulate access of each CPU to sections of memories and individual peripherals and extend the capabilities of the standard Arm Trust Zone security partitioning</p></li></ul><p dir="ltr">Alif Semiconductor is the only company in this market segment that injects at manufacturing, a unique public key infrastructure (PKI) key pair to support immutable&nbsp;hardware root of trust (RoT) from secure boot to strong authentication and remote software attestation capabilities.</p><p dir="ltr">As a result, the personal data acquired by sensors and processed by the Alif Balletto microcontrollers are secured against third-party attacks.</p><p dir="ltr">Users can securely manage all aspects of the device lifecycle, including key management, certificate management, remote updates, and more. Legacy MCUs may stop at TrustZone, but Alif takes you beyond TrustZone to ensure that multi-core devices are protected by not allowing two CPUs to access the same Secure domain and share secrets.&nbsp;</p><h3 dir="ltr">Graphics and imaging</h3><p dir="ltr">The Balletto family includes a number of hardware features to help offload traditionally CPU-intensive workloads from the MCU/MPU cores to improve performance and keep current consumption in check. One such feature is an integrated 2D graphics accelerator that can help speed up drawing operations by 4-10x compared to an unaccelerated system. This, combined with a set of imaging and display interfaces, which include parallel as well as MIPI-CSI2 and MIPI-DSI interfaces for 24-bit RGB displays and 8 to 16-bit cameras, provide everything needed for responsive and buttery-smooth graphics on pixel-dense screens.</p><h2 dir="ltr">Conclusion</h2><p dir="ltr">As the wearable technology market continues to expand, the convergence of edge AI and BLE technology has enabled wearables to become smarter, more efficient, and more secure. Alif Semiconductor's Balletto family of MCUs represents a significant leap forward in meeting the ever-growing demands of the wearables market. These innovative solutions empower wearables to not only collect and process data but also to provide real-time, personalized, and secure experiences, all while maintaining long-lasting battery life and optimizing form factor. The future of wearables is here, and it's exciting.</p><h3 dir="ltr">References</h3><ol><li dir="ltr"><p dir="ltr">GlobeNewswire. <a href="https://www.globenewswire.com/en/news-release/2023/03/15/2627702/0/en/2023-2028-Smart-Wearables-Market-Size-Share-and-Trends-Analysis-Report-By-Y-O-Y.html" target="_blank">2023- 2028 Smart Wearables Market Size, Share and Trends Analysis Report By Y-O-Y</a>.</p></li><li dir="ltr"><p dir="ltr">businesswire. <a href="https://www.businesswire.com/news/home/20220104005806/en/Global-Wearable-Technology-Market-Trends-Analysis-Report-2021-2028-Adoption-of-Fitness-Trackers-and-Health-based-Wearables-is-Anticipated-to-Propel-Growth---ResearchAndMarkets.com" target="_blank">Global Wearable Technology Market Trends &amp; Analysis Report 2021-2028: Adoption of Fitness Trackers and Health-based Wearables is Anticipated to Propel Growth - ResearchAndMarkets.com.</a></p></li></ol><h3>Further Research</h3><p dir="ltr">Ramesh Nair, 2023. “<a href="https://www.safetymint.com/blog/smart-wearables/" target="_blank">Smart Wearables: Advancing Safety in the Workplace</a>”</p><p dir="ltr">StartUs Insights, 2023. “<a href="https://www.startus-insights.com/innovators-guide/wearables-trends/" target="_blank">Top 10 Wearables Trends in 2023</a>”</p><p dir="ltr">GlobalData, 2022. “<a href="https://www.medicaldevice-network.com/comment/wearable-technology-iot/" target="_blank">Wearable technology market continues to rise</a>”</p><p dir="ltr">Lisa Eadicicco, 2022. “<a href="https://www.cnet.com/tech/mobile/smartwatches-have-measured-blood-oxygen-for-years-but-is-it-useful/" target="_blank">Smartwatches Have Measured Blood Oxygen for Years. But Is This Useful?</a>”</p><p dir="ltr">Fi Forest, 2022. “<a href="https://www.pharmaceutical-technology.com/sponsored/wearables-managing-complexities-data-privacy-consent/" target="_blank">Wearables: managing complexities in data privacy and consent in healthcare tech</a>”</p><p dir="ltr">Industry News, 2022. “<a href="https://www.helpnetsecurity.com/2022/11/16/alif-semiconductor-telit/" target="_blank">Alif Semiconductor partners with Telit to develop and deploy IoT edge devices</a>”</p><p dir="ltr">Alif Semiconductor, 2023. “<a href="https://alifsemi.com/ensemble/" target="_blank">Supplying next generation scalable microcontrollers</a>”</p><p dir="ltr">Arrow, 2022. “<a href="https://www.arrow.com/en/research-and-events/articles/alif-semiconductor" target="_blank">Alif Semiconductor</a>”</p><p dir="ltr">Eduardo Montanez, 2022. “<a href="https://www.nxp.com/company/blog/nxp-i-mx-rt-mcu-technology-powers-our-smartwatch-future:BL-NXP-IMX-RT-MCU-TECHNOLOGY" target="_blank">NXP i.MX RT MCU Technology Powers Our Smartwatch Future</a>”</p>

Learn how bluetooth connected AI/ML microcontrollers are setting the bar for next generation wearables.

Leading Wearables into a New Era with Cutting-Edge Connected Bluetooth LE based MCUs

<h1 dir="ltr" id="isPasted">Introduction</h1><p dir="ltr">In an age where data is the new gold, and digital infrastructure forms the backbone of our society, the importance of data security cannot be overstated. Silicon-level security refers to the protective measures embedded at the hardware level of computing devices. It is a fundamental layer that underpins the reliability and trustworthiness of everything from consumer electronics to critical national infrastructure.</p><p dir="ltr">As we usher in the era of ubiquitous computing, with billions of connected devices exchanging data every second, the stakes for robust security have never been higher. The concept of silicon-level security isn't new; however, the complexity and sophistication of threats it must mitigate have evolved dramatically. Gone are the days when simple perimeter defenses were sufficient. Today's security architects must assume a posture of 'defense in depth', where multiple layers of security measures are integrated into the silicon itself.</p><p dir="ltr">This proactive approach to security is vital as the functionality and value of devices increasingly hinge on their ability to protect and process sensitive data securely. Whether it's financial transactions, personal information, or state secrets, the common denominator is the silicon that processes and stores this data. Thus, the integrity of silicon-level security mechanisms is a paramount concern, laying the foundation for trust in the digital age.</p><p dir="ltr">In the following sections, we'll delve into the intricate world of secure interface technologies, unpack the challenges faced by modern System on Chip (SoC) designs, and explore how advancements in technology are paving the way for stronger, more resilient security measures. &nbsp;&nbsp;</p><h1 dir="ltr">The Backbone of Security: Root of Trust and Cryptography IP</h1><p dir="ltr">At the heart of silicon-level security is the concept of a 'Root of Trust' (RoT), a set of functions trusted implicitly by the system due to their foundational role in ensuring overall security. The RoT provides a secure starting point for system boot and cryptographic operations and is immune to software-based attacks because it is often implemented in hardware. This secure cornerstone handles critical tasks such as secure boot, secure firmware updates, and cryptographic key management, ensuring that only authenticated code and communications are running on the device.</p><p dir="ltr">Adjacent to the Root of Trust is the role of Cryptography IP, which includes hardware-based cryptographic engines designed to perform encryption and decryption tasks. These cryptographic modules serve as the workhorses for data protection, enabling secure data storage and transmission, and are essential for functions like secure communications, digital signatures, and user authentication.</p><p dir="ltr">Both RoT and Cryptography IP are imperative for a secure boot process, which is the first step in a secure chain of events that occur when a device is powered on. During this process, the integrity and authenticity of the software stack are verified using cryptographic checks, establishing a secure execution environment from the outset.</p><p dir="ltr">To understand their importance, consider the analogy of a bank vault. In this analogy, RoT is the combination to the vault—highly confidential and used to validate the identity of individuals attempting to access the vault. Cryptography IP, on the other hand, is like the reinforced walls and time-locked doors—structural features that enforce security protocols and prevent unauthorized access.</p><p dir="ltr">These technologies also enable secure end-to-end communication, ensuring that data remains confidential and unaltered during transmission. With the proliferation of the Internet of Things (IoT) and connected devices, securing data in transit has become as crucial as securing it at rest.</p><p dir="ltr">Despite their robustness, the implementation of Root of Trust and Cryptography IP is not without challenges. Ensuring that these security measures themselves are impervious to exploitation requires meticulous design and regular updates in response to the evolving threat landscape. In the next section, we will examine the security challenges inherent in modern SoC designs and discuss how these foundational technologies can help mitigate those risks.</p><h1 dir="ltr">Securing the Core: Challenges in SoC Designs</h1><p dir="ltr">Modern Systems on Chip (SoCs) are marvels of integration, embedding processors, memory, I/O, and various other functionalities into a single chip. This consolidation brings vast benefits in terms of performance and power efficiency but also introduces a myriad of security challenges that must be navigated carefully.</p><p dir="ltr">One of the primary challenges is the increased attack surface. The very features that make SoCs powerful—connectivity, configurability, and smart functionalities—also make them more vulnerable to attacks. With more lines of code, there are more potential bugs or backdoors. With more interfaces, there are more points of entry for malicious actors.</p><p dir="ltr">Additionally, as SoCs become more complex, ensuring that every component is secure from design to decommission becomes harder. This complexity often results in a greater risk of side-channel attacks, where an attacker could infer sensitive information from power consumption, electromagnetic emissions, or even computation time.</p><p dir="ltr">Supply chain security presents another significant challenge. SoCs are global products, with materials and components sourced from and passing through multiple vendors and countries. Each step in this chain presents an opportunity for malicious actors to introduce vulnerabilities.</p><p dir="ltr">Moreover, the need for speed in markets means that security can sometimes be an afterthought, leading to vulnerabilities in the rush to get products to market. As a result, rigorous security testing and validation procedures are essential but can be overlooked or undervalued.</p><p dir="ltr">In dealing with these challenges, the industry has turned to a variety of mitigation strategies. One key approach is the concept of 'security by design', where security measures are considered at every step of the SoC design and manufacturing process. This approach includes using hardware-based security features, like those provided by secure enclaves and trusted execution environments, which can isolate sensitive operations from the main processor to protect them from software attacks.</p><p dir="ltr">Another strategy is regular security audits and updates. Even after an SoC is deployed, its security posture must be maintained and updated in response to new threats—much like how software is regularly patched.</p><p dir="ltr">Finally, leveraging advanced fabrication techniques and materials can reduce the physical vulnerabilities of SoCs, making them harder to tamper with or reverse engineer.</p><p dir="ltr">Navigating these challenges is a complex task, but it is one that is crucial for maintaining trust in technology. In the next section, we discuss how these strategies are put into practice, keeping SoCs secure against an ever-evolving array of threats.</p><h1 dir="ltr">Building Defenses: Mitigation Strategies for SoC Security</h1><p dir="ltr">To confront the security challenges in SoC designs, the semiconductor industry has developed a suite of mitigation strategies that bolster the defenses of these complex systems.</p><ul><li dir="ltr"><p dir="ltr"><strong>Secure Architectural Design:</strong> The first line of defense is secure architectural design. This includes the incorporation of hardware-based security features such as secure boot, trusted execution environments, and secure key storage. By integrating these elements at the design phase, SoCs are better equipped to handle unauthorized access attempts and ensure that critical operations remain uncompromised.</p></li><li dir="ltr"><p dir="ltr"><strong>Layered Security Approach:</strong> A layered security approach is critical for protecting against a wide range of potential attacks. This involves implementing multiple security layers that function together to protect the system. If one layer is breached, the subsequent layers provide an additional level of defense, making it more difficult for an attack to be successful.</p></li><li dir="ltr"><p dir="ltr"><strong>Dynamic Security Measures:&nbsp;</strong>Dynamic security measures, such as runtime monitoring and anomaly detection, are also key. These systems can detect and respond to suspicious behavior in real-time, providing a responsive layer of security that adapts to current threats.</p></li><li dir="ltr"><p dir="ltr"><strong>Encryption and Cryptography:&nbsp;</strong>Strong encryption and cryptography are indispensable in SoC security, safeguarding data both at rest and in transit. Advanced encryption standards and cryptographic algorithms are implemented to ensure that even if data is intercepted, it remains indecipherable without the appropriate keys.</p></li><li dir="ltr"><p dir="ltr"><strong>Regular Security Audits and Firmware Updates:&nbsp;</strong>Ongoing security audits and regular firmware updates ensure that security measures remain up-to-date in the face of evolving threats. This strategy includes the establishment of secure update mechanisms that prevent the installation of malicious firmware.</p></li><li dir="ltr"><p dir="ltr"><strong>Supply Chain Integrity:&nbsp;</strong>Protecting the integrity of the supply chain is another critical strategy. This involves measures such as secure manufacturing practices, tamper-evident packaging, and traceability of components to ensure that SoCs are not compromised at any point from fabrication to delivery.</p></li><li dir="ltr"><p dir="ltr"><strong>User Education and Access Control:</strong> Lastly, user education and strict access control policies are necessary to prevent inadvertent breaches. Users need to be aware of the security features of their devices and how to use them properly, while access control ensures that only authorized individuals can make changes to the system configuration or access sensitive information.</p></li></ul><p dir="ltr">By implementing these strategies, SoC designers and manufacturers can create more secure systems that are resilient in the face of both current and emerging security threats. However, the fast pace of technological change means that vigilance and continuous improvement are mandatory. Security is not a one-time achievement but an ongoing process of adaptation and reinforcement.</p><h1 dir="ltr">Conclusion</h1><p dir="ltr">Silicon-level security stands as a critical pillar in our digital era. Through exploring secure interface technologies, such as Root of Trust and Cryptography IP, we recognize their indispensable role in safeguarding modern SoCs. As we confront security challenges—from side-channel attacks to complex interface vulnerabilities—the need for a robust, multi-layered defense strategy becomes clear.</p><p dir="ltr">Securing silicon goes beyond a single solution—it's a continuous battle, balancing innovation with vigilance. As technology advances, so must our security strategies, integrating state-of-the-art features and adopting a culture of security-first in design and deployment.</p><p dir="ltr">The future hinges on our collective effort to ensure the trustworthiness of our digital foundations. In fostering this trust, the commitment to silicon-level security must remain unwavering, uniting stakeholders across the industry to fortify our digital landscape.</p><h1 dir="ltr">Synopsys' Impact on SoC Security</h1><p dir="ltr">In the realm of SoC security, <a href="https://www.synopsys.com/" target="_blank" rel="noopener noreferrer">Synopsys</a> offers critical technologies that sharpen the defenses of silicon interfaces. Their AI and Machine Learning tools not only expedite chip design but also imbue systems with smart threat detection, essential for anticipatory security. Their cloud solutions provide secure integrations essential for IoT devices dependent on cloud data management.</p><p dir="ltr">Their Design Technology Co-Optimization (DTCO) propels the creation of SoCs resistant to advanced threats by exploring new transistor architectures. Synopsys' emphasis on early-stage security integration through DevSecOps, alongside energy-efficient design practices, further strengthens SoCs against exploits like power analysis attacks.</p><p dir="ltr">Synopsys also pioneers in fortifying system integrity with its Multi-Die System solutions, safeguarding sensitive operations within SoCs. Their vigilance extends to software security, ensuring open-source components and software supply chains are robust against vulnerabilities from inception.</p><p dir="ltr">Through innovation and a strategic approach to security, Synopsys plays a pivotal role in the evolution of more secure digital infrastructures, demonstrating a comprehensive commitment to the advancement of SoC security.</p><h1 dir="ltr" id="isPasted">References</h1><p dir="ltr">[1] Dana Neustadter, Hezi Saar, Michael Posner, ‘How Security for SoC Interfaces Enhances Data Protection’, Synopsis, 4 Oct. 2022, [Online], Available from:&nbsp;<a href="https://www.synopsys.com/blogs/chip-design/soc-interfaces-security-enhance-data-protection.html" target="_blank">https://www.synopsys.com/blogs/chip-design/soc-interfaces-security-enhance-data-protection.html</a></p><p dir="ltr">[2] Marco Ciaffi, John Min, ‘Building security into an AI SoC using CPU features with extensions’, Embedded, 12 Apr. 2021, [Online], Available from:&nbsp;<a href="https://www.embedded.com/building-security-into-an-ai-soc-using-cpu-features-with-extensions/" target="_blank">https://www.embedded.com/building-security-into-an-ai-soc-using-cpu-features-with-extensions/</a></p><p dir="ltr">[3] Ruud Derwig, Nicole Fern, ‘Techniques for Ensuring Security in Processor-based SoCs’, Synopsis, [Online], Available from: <a href="https://www.synopsys.com/designware-ip/technical-bulletin/ensuring-security-processor-socs.html" target="_blank">https://www.synopsys.com/designware-ip/technical-bulletin/ensuring-security-processor-socs.html</a></p><p dir="ltr">[4] Landry J., ‘What Is Hardware Root of Trust?’, Dell, 22 July 2022, [Online], Available from: <a href="https://www.dell.com/en-us/blog/hardware-root-trust/" target="_blank" rel="noopener noreferrer">https://www.dell.com/en-us/blog/hardware-root-trust/</a></p>

Silicon-level security is crucial in protecting the hardware of computing devices, serving as a foundational layer for data integrity and system reliability in our increasingly digital world.


Silicon-Level Security: A Deep Dive into Secure Interfaces

Network System Control Center Operator Working

Dive into our comprehensive guide on defense in depth layers, unravelling the complexities of multi-tiered security strategies for robust protection.

Unraveling Defense in Depth Layers: A Comprehensive Guide

<p id="isPasted">Experts say 2021 was the year of ransomware, but things changed in 2022 as criminals realized an estimated 17 billion IoT devices represented an easier target. While IT hardware and software security has dramatically improved, the IoT has lagged.</p><p>Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts &ndash; for example, video from security cameras and patient information from medical wearables.</p><p>There is a steady stream of news items about cyberattacks affecting everyday businesses and well-known brands. These can result in financial losses, privacy breaches, or individuals being blocked from accessing critical services. But now key infrastructure is also proving a major target, posing a danger to health, energy, food, water, and communications.</p><h2><strong>IoT as a growing attack surface for cybercrime</strong></h2><p>This is a problem that&rsquo;s not going away. Inexpensive wireless components are proving a boon to connectivity. The price of turning a dumb device into a smart device can be as low as 10 cents, says security expert Mikko Hypp&ouml;nen. That&rsquo;s encouraging vendors to add wireless connectivity to many devices, even if the benefits might be minor. And Hypp&ouml;nen explains that whenever an appliance is connected, that also makes it vulnerable.</p><p>According to analyst firm IDC, there will be almost 42 billion IoT devices by 2025. The vulnerable products among that network will contribute to a cost of cybercrime that&rsquo;s set to grow to $10.5 trillion by the same year, according to research firm Cybersecurity Ventures. The growing number of connected devices creates a larger &lsquo;attack surface&rsquo;&mdash;the number of potentially unprotected targets a miscreant can seek to exploit. In addition, the large volumes of data gathered and transmitted by billions of connected IoT devices create a bigger target for interception.</p><h2><strong>Addressing the vulnerability of connected devices</strong></h2><p>Enhancing the <a href="https://www.nordicsemi.com/Support/Security" target="_blank">security</a> of the IoT is challenging. Cyber attackers benefit from the complexity of the network, as the more companies, equipment, devices, and software are involved, the more opportunities there are for exploitation. Such complexity emphasizes the importance of security being considered at all stages of a product&rsquo;s lifecycle - not just when it&rsquo;s in the field.</p><p>Even simple IoT products, smart thermostats, for example, should be endowed with a degree of protection. It&rsquo;s not expensive to build-in simple protection such as secure-boot and secure-update with anti-rollback. Secure boot ensures the device verifies that its original software, and any subsequent update, is authorized and is safe to run. Anti-rollback prevents an older (and potentially vulnerable) version of the firmware being reinstated.</p><p>Even greater security can be achieved by isolation. Isolation provides a barrier between the firmware responsible for potentially vulnerable interfaces and the security critical code. Non-critical information can still be extracted from the isolated area for general operation of the IoT device, but no security critical information is accessible beyond the isolated area. The device might also feature secure storage for security critical data and assets.</p><h2><strong>Changing IoT-customers&#39; expectations of security</strong></h2><p>In the wake of heightened awareness of cyber-attacks, public expectations of IoT devices have shifted. A survey by the U.K. government in 2020 found nine out of ten people now expect smart devices to have basic embedded features to protect user privacy and security.</p><p>In response, <a href="https://www.psacertified.org/" rel="noopener" target="_blank">PSA Certified</a>, a framework for securing connected devices, has brought together major stakeholders to consolidate a range of security approaches into a standardized approach for the IoT. It developed a <a href="https://www.psacertified.org/what-is-psa-certified/using-psa-certified/" rel="noopener" target="_blank">four-stage framework</a> that guides developers through the steps necessary to implement the right level of security for a product. Nordic itself has aligned with the framework.</p><p>Regulators in several countries are also outlining expectations and establishing minimum security standards for IoT products. In the EU, lawmakers recently introduced security standards that require internet-connected products to have &ldquo;appropriate levels of cybersecurity&rdquo;. In the U.S., recent Executive Orders on cybersecurity have led to the development of IoT security standards by The National Institute of Standards and Technology (NIST).</p><h2><strong>Unlocking the value of the IoT</strong></h2><p>Improved security can help developers of IoT solutions unlock stronger customer relationships, especially in contexts where reliability is critical. A prime example is the <a href="https://www.psacertified.org/products/fluence-wireless-flex-dimming-receiver/" rel="noopener" target="_blank">Wireless Flex Dimming Receiver</a> lighting solution from illumination company Fluence, which is built using Nordic&rsquo;s nRF52840 SoC and is PSA Certified.</p><p>The product is targeted at the agriculture sector and enables growers to increase the amount and quality of produce by optimizing lighting conditions. Its built-in security features make it resistant to disruption increasing industry&rsquo;s trust in connected commercial solutions. This trust must now extend to key smart infrastructure such as smart electricity distribution grids, education, and healthcare.</p><p>As wireless IoT suppliers like Nordic, industry consortiums like PSA Certified, and regulators around the globe work to prioritize digital security, we may finally see inherent high levels of protection that will unlock the full potential of the IoT.</p><hr><p>This article was first published on Nordic&#39;s&nbsp;<a href="https://blog.nordicsemi.com/getconnected" target="_blank" rel="nofollow" id="isPasted"></a><a href="https://blog.nordicsemi.com/getconnected?utm_campaign=2021%20wevolver" target="_blank" rel="noopener noreferrer">Get Connected Blog</a>. &nbsp;</p>

Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts – for example, video from security cameras and patient information from medical wearables.

Why cybercrime is an increasing threat to the IoT

<h2 dir="ltr" id="isPasted">Introduction</h2><p dir="ltr">GraphQL is a query language that provides a more efficient, powerful, and flexible alternative to RESTful APIs (GraphQL, 2023). A RESTful API is an architectural style for an application program interface (API) that employs HTTP requests to access and use data. GraphQL was developed as an alternative to RESTful APIs by Facebook in 2012 and was converted to an open-source platform in 2015. GraphQL allows clients to request data from the server in a more specific and tailored way, reducing the amount of data that needs to be transmitted. This not only reduces the resources used but also streamlines and accelerates the process of accessing data. In this article, we will discuss what is GraphQL, its pros and cons and security concerns that developers need to know.</p><h2 dir="ltr">Pros and Cons</h2><p dir="ltr">One of the main advantages of GraphQL is that it allows clients to specify the exact data they need, reducing the amount of data transmitted over the network. This can lead to faster load times and improved performance, especially on mobile devices where bandwidth is limited. Additionally, GraphQL provides a more intuitive and flexible way of querying data, allowing developers to define complex queries with ease. It also allows API maintainers to add or remove fields without impacting existing queries. Developers can build APIs with their preferred methods, and the GraphQL specification will ensure they function in predictable ways for clients.</p><p dir="ltr">Moreover, GraphQL also enables real-time data updates. Clients can subscribe to certain data and receive updates in real-time. This makes it easier to build reactive and interactive applications, which is especially important for real-time data scenarios.</p><p dir="ltr">On the other hand, one of the main disadvantages of GraphQL is that it can be more complex to implement than RESTful APIs. In GraphQL the major operation of a data query is done on the server side, which adds complexity for server developers. Moreover, it can be challenging to optimize queries efficiently. Additionally, caching can be more challenging since queries can be customized, and there is no one-size-fits-all solution. Another limitation of GraphQL is that it may require different API management strategies compared to REST APIs, particularly when considering rate limits and pricing.</p><h2 dir="ltr">Top Security Issues</h2><p dir="ltr">GraphQL presents some security issues that developers should be aware of. A primary security issues is the possibility of denial-of-service (DoS) attacks. Since GraphQL allows clients to define queries, an attacker could potentially craft a malicious query that would consume considerable server resources, leading to a DoS attack.</p><p dir="ltr">Another security issue is related to query depth and complexity. Attackers could craft a complex query that consumes a lot of server resources, leading to performance issues. This is because a GraphQL query is able to take in multiple actions, meaning that a developer cannot predict beforehand what amount of server resources will be utilized in an action. Therefore, the same strategy for limiting the number of requests on an API for cannot be used for GraphQL. Additionally, attackers could use GraphQL to perform data exfiltration attacks by creating queries that extract sensitive information from the server.</p><p dir="ltr">A common issue encountered in GraphQL-based applications is presence of flaws in authorization logic. While GraphQL helps implement data validation, it is up to the API developers to implement authorization and authentication checks. The multiple levels of resolvers used for GraphQL APIs significantly add to its complexity since authorization checks are required for both query-level resolvers and resolvers that load additional data.</p><h2 dir="ltr">Mitigation Strategies</h2><p dir="ltr">To mitigate the security issues presented by GraphQL, developers can take a number of preventive steps. First, they should limit the query depth and complexity by setting limits on the number of fields and nested objects that a query can have. Additionally, they should implement measures to limit the rate of queries to prevent DoS attacks. Developers should also sanitize user input to prevent injection attacks.</p><p dir="ltr">Authentication and authorization mechanisms should be applied to prevent unauthorized access to sensitive data. Another preventive measure is logging and monitoring of the system to detect and respond to any suspicious activity.</p><p dir="ltr">In addition to the security concerns, developers should also consider performance issues presented by GraphQL. Since GraphQL queries can be highly complex and customized, it can be challenging to optimize them and ensure that they are performing as intended. To address this issue, developers can employ batching and caching techniques to reduce the number of requests to the server.</p><h2 dir="ltr">Conclusion</h2><p dir="ltr">GraphQL is a powerful technology that, when implemented correctly, presents an extremely elegant methodology for data retrieval with several advantages over RESTful APIs. Due to the amount of queries and their complexity, GrqphQL is also prone to some security and performance issues that developers need to be aware of. By implementing the right mitigation strategies, developers can ensure that their GraphQL APIs are secure, reliable, and performant. Overall, GraphQL is a powerful tool that can help developers build more efficient and flexible applications, but it&#39;s important to approach it with caution and take the necessary steps to mitigate potential issues.</p><hr><h2 dir="ltr">References</h2><p dir="ltr">GraphQL, 2023.&nbsp;Homepage.&nbsp;[Online]&nbsp;<br>Available at: https://graphql.org/</p>

GraphQL is a query language that provides a more efficient, powerful, and flexible alternative to RESTful APIs (GraphQL, 2023). A RESTful API is an architectural style for an application program interface (API) that employs HTTP requests to access and use data.

What is GraphQL? Pros and Cons, Top Security Issues, and Mitigation Strategies

This article provides a detailed overview of the Modbus TCP protocol fundamentals, communication, data representation, security, daily life applications, and integration.

Modbus TCP: A Comprehensive Guide to the Protocol and Its Applications

Exploring the design, development, connectivity, security, and more aspects of IoT devices

Internet of Things: A Comprehensive Guide to its Engineering Principles and Applications

<h1 id="isPasted">What Is Secure Boot?</h1><p>In the context of Internet of Things security, Secure Boot refers to the process of authenticating a device&rsquo;s firmware and operating system against a known secure cryptographic key placed on the device at the time of manufacture. This authentication occurs every time the device is booted to validate that the firmware or code being loaded is the legitimate version that was placed there by whoever produced it.</p><p>With Secure Boot, a bad actor who gains physical access to a device embedded in an IoT system or product would be unable to boot the device with their own modified firmware or bootloader, as this wouldn&rsquo;t cryptographically match the secure key implemented by the manufacturer.</p><h3>Why Is Secure Boot So Important for IoT Device Security?</h3><p>Secure Boot is one of the most important security features in any IoT product. When physical products are connected to the Internet, they become vulnerable to cyberthreats&mdash;as such, manufacturers must not only consider physical security, but also cybersecurity practices pertaining to the device firmware, connectivity, and application ecosystems that surround their products.</p><p>One of the most common attack vectors for physical devices involves a bad actor getting physical access to an IoT device or gaining remote access via a port scan. Once they do this, they can assume control by booting the device with their own firmware. This can lead to undesirable device behavior, stolen business or customer data, or loss of the device.</p><p>Secure Boot makes this difficult&mdash;if not impossible&mdash;because the device is signed with a cryptographic key when it&rsquo;s manufactured. If the firmware doesn&rsquo;t match the key, the device simply won&rsquo;t work, thereby thwarting the bad actor.</p><p><em>Check out our&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/iot-security-checklist/" rel="noopener" target="_blank">IoT security checklist</a> for more common threats to IoT products.</em></p><h1>How Does Secure Boot Work?</h1><p>Secure Boot can be thought of as a series of validation layers that mutually check each other when a device powers on and loads its embedded software. A lot of physical device attacks take the form of manipulating the boot process into causing the device to behave in an incorrect manner, perhaps by loading manipulated software.</p><p><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1688035271667-01-Secure-Boot_Particle__1_.webp" style="width: 766px;" class="fr-fic fr-dib"></p><p id="isPasted">By using cryptography to protect the initial bootup instructions via strong encryption and then authenticate the next layer of instructions via digital signatures, a device will not allow itself to boot up modified or unsigned software. The P2 is the first Particle product to ship with the initial version of secure boot enabled, with more features to support additional layers on the way.</p><p>At Particle, we&rsquo;ve always performed a cloud-side firmware integrity check&mdash;meaning that when a device comes online and connects to our device cloud, we validate that the installed firmware matches what is expected of the code.</p><p>The Secure Boot process allows for a bottom-up check in addition to Particle&#39;s top-down approach, allowing the device to perform cryptographic validation offline before a cloud connection is established. This dual approach makes for a highly secure platform suitable for a variety of hardware applications.</p><h1>Examples of Secure Boot in Action</h1><p>So, which industries are designing products with Secure Boot functionality?</p><h3>Electric Vehicle Charging Manufacturers</h3><p>Many countries are moving forward with the electrification of the transportation industry. In particular, the U.K.&mdash;which has assumed a leading role in the movement&mdash;is taking great strides to ensure that EV infrastructure is not only widely available but connected.</p><p>The&nbsp;<a href="https://www.legislation.gov.uk/uksi/2021/1467/part/2/made" rel="noopener" target="_blank">Electric Vehicles (Smart Charge Points) Regulations 2021</a> legislation that took effect in the U.K. on June 30, 2022, requires all public and private EV chargers to be Internet-connected. These regulations include strict&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/ev-charger-security/" rel="noopener" target="_blank">security requirements for connected EV chargers</a>, including Secure Boot. More specifically, all EV chargers will have to support an enhanced security scheme that includes Secure Boot by January 1, 2023.</p><p>Here&rsquo;s a snippet of the regulatory requirements:</p><p>*(3) A relevant charge point must be configured so that&mdash; (a) it checks, when it is first set up by the owner, and periodically thereafter, whether there are security updates available for it; (b) it verifies the authenticity and integrity of each prospective software update by reference to both the data&rsquo;s origin and its contents and only applies the update if the authenticity and integrity of the software have been validated;</p><p>(4) A relevant charge point must be configured so that&mdash; (a) it verifies, via secure boot mechanisms, that its software has not been altered other than in accordance with a software update which has been validated in accordance with sub-paragraph (3)(b) above; (b) if an unauthorised change to the software is detected, it notifies the owner and does not connect to a communications network other than for the purposes of this notification.*</p><p>In the context of individual EV chargers or charger networks, Secure Boot is a vital security practice that prevents negative outcomes such as:</p><ul><li>Energy theft</li><li>Impeded charging</li><li>Stolen customer or business data</li><li>Access to system owners&rsquo; home Wi-Fi networks</li><li>Physical equipment and infrastructural damage due to malicious or improper usage</li></ul><h3>Industrial Control and Automation Systems</h3><p>As demonstrated by ongoing conflicts, the battlefield has evolved to include highly specialized operations against critical infrastructure and industrial control systems. Standards like the&nbsp;<a href="https://www.iec.ch/blog/understanding-iec-62443" rel="noopener" target="_blank">IEC62443</a> have been designed to reduce the risk of malicious actions to these types of devices.</p><p>It doesn&rsquo;t take much imagination to understand how damaging a targeted attack to critical infrastructure can be, which is why devices that have a direct impact on power, water, gas, and other utilities need to be specifically hardened against both remote and physical attacks.</p><h1>Implementing Secure Boot in Your Own IoT Products</h1><p>In this section, we&rsquo;ll dive into the major steps you need to take to build Secure Boot into your IoT products.</p><h3>Start With Secure Boot-Enabled Devices</h3><p>Many open source devices and platforms like Raspberry Pi and Arduino run a version of embedded Linux that leading penetration testing company Pen Test Partners said could lead to &ldquo;<a href="https://www.pentestpartners.com/security-blog/smart-car-chargers-plug-n-play-for-hackers/" rel="noopener" target="_blank">easy extraction of all stored data</a>, including credentials and the Wi-Fi Pre-Shared Key.&rdquo;</p><p>These modules are popular for prototyping, with some companies even using them in their production processes&mdash;but while they&rsquo;re inexpensive and easy to use, they often fall short of reasonable enterprise-grade security standards.</p><p>Most open source device firmware doesn&rsquo;t come with Secure Boot functionality off the shelf, and it&rsquo;s hard to tell if the proper security steps have been taken when devices are sourced from third-party manufacturers. This leaves devices open to bad actors who can get root access to the device firmware, run their own firmware on it, and assume device control as a result.</p><p>That&rsquo;s why hardware security must be your first concern when evaluating devices.</p><p>Because Particle owns its manufacturing and production capacities, every Particle device is signed with an individual key at the time of manufacture that&nbsp;<strong>ensures compliance with most Secure Boot requirements</strong>.</p><p>Our Secure Boot mechanism is backed by&nbsp;<a href="https://www.fortanix.com/company/pr/2022/01/fortanix-announces-industry-first-100th-production-customer-for-confidential-computing" rel="noopener" target="_blank">Fortanix HSM</a>, which is used in highly secure communications devices for enterprise and government use. Our newest&nbsp;<a href="https://www.particle.io/devices/enterprise-iot-wifi-modules/" rel="noopener" target="_blank">IoT Wi-Fi modules</a>, the Photon 2 and P2, are manufactured with built-in encrypted flash and&nbsp;<a href="https://www.arm.com/technologies/trustzone-for-cortex-a" rel="noopener" target="_blank">ARM TrustZone</a> technology.</p><ul><li><strong>Encrypted flash</strong> prevents malicious actors from taking chips off the board and reading their contents, as everything is garbled without the key set at the factory.</li><li><strong>ARM TrustZone is a well-known mechanism that provides a layer&mdash;or &ldquo;zone&rdquo;&mdash;of trust between the secure device functions and the operating system.</strong> With it, the parts of the device that generate cryptographically secure keys and the general user space where you write your firmware are separated by a layer of abstraction, ensuring the areas that require absolute integrity cannot be manipulated.</li></ul><p><em>Check out our in-depth comparison of&nbsp;<a href="https://www.particle.io/compare/particle-vs-arduino/" rel="noopener" target="_blank">Particle vs. Arduino</a> to see how Particle provides an extra layer of security out of the box.</em></p><h3>Use a Hardened and Stable Device Operating System</h3><p>Open source OSs often expose code irrelevant to a device&rsquo;s function, which makes the device vulnerable to potential threats like port scans. If you don&rsquo;t have a team that knows how to reduce the attack surface of the device firmware, you may unwittingly expose yourself&mdash;and your customers&mdash;to cyberthreats.</p><p>By contrast, Particle devices come pre-integrated with our embedded IoT operating system, Particle Device OS, which includes:</p><ul><li><strong>Minimal attack surface</strong>. Particle Device OS has no open ports and leverages only services that are essential to connect to the Particle Cloud. By removing the extra fluff included in most open source OSs, Particle Device OS is secure and ready to use right out of the box.</li><li><strong>Abstracted APIs</strong>. Particle Device OS abstracts the complex integration among microcontrollers, modems, peripherals, verified libraries, and your application firmware, setting up your product&rsquo;s physical device to work seamlessly and securely.</li><li><strong>Long-term support versions</strong>. Particle Device OS LTSs are independent branches of the operating system that are feature-frozen in time&mdash;in other words, they do not receive updates with new features, API changes, or improvements that change device function or standard behavior. These versions are covered by an extended support window to address bugs, regressions, and vulnerabilities.</li><li><strong>Over-the-air updates</strong>. Particle OTA Services lets you push OTA updates with a single line of code or a few clicks, making it simple to add new features, respond to security vulnerabilities, and change product behavior after you&rsquo;ve shipped. Learn more about&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/iot-ota/" rel="noopener" target="_blank">IoT OTA updates</a>.</li></ul><h3>Build a Secure and Encrypted Data Pipeline</h3><p>Security doesn&rsquo;t just happen directly on the device; the cloud side must also provide an extra layer of security through integrity checks to verify that the correct version of the firmware is running when the device boots. If an unexpected input or code change appears, your cloud solution should prevent booting and alert you.</p><p>Particle Cloud, our secure and reliable&nbsp;<a href="https://www.particle.io/platform/particle-cloud/" rel="noopener" target="_blank">IoT device cloud</a>, does this for you as soon as you turn on any Particle device.</p><p>Here&rsquo;s what Particle Cloud provides from a security standpoint:</p><ul><li>The modules are&nbsp;<strong>bound to your account only</strong>, with limited access and two-factor authentication employed for secure access to the cloud management interface. Your devices cannot be moved to another account for OTA reprogramming, and only you can unclaim a device from your account.</li><li>Devices are paired with the cloud platform and&nbsp;<strong>reverse-connect to a trusted endpoint used for further connectivity</strong>.</li><li>Devices are authenticated as they connect to the cloud using&nbsp;<strong>public key cryptography</strong>. This process assures that the cloud is what it purports to be and is not rogue.</li><li>Particle Cloud&nbsp;<strong>knows what firmware to expect</strong>. If that firmware doesn&rsquo;t show up when the device connects, the cloud will&nbsp;<strong>intervene in real time</strong> to fix the issue with an update, thereby protecting against firmware modification attacks.</li><li>Particle Cloud&nbsp;<strong>doesn&rsquo;t store event payloads or any proprietary information belonging to you or your customers</strong>. Rather, storage is limited to diagnostic data that is used solely to ensure optimal device performance and gets auto-purged regularly.</li></ul><p>Secure Boot is a foundational practice for securing IoT devices and products. Don&rsquo;t let your devices live out in the field with critical vulnerabilities&mdash;equip your products with Secure Boot-enabled devices and an integrated IoT Platform-as-a-Service to easily ship products without compromising security.</p>

Learn why Secure Boot, a process for authenticating IoT device firmware, is critical for building safer connected products.

What is Secure Boot? The Foundation of IoT Security.

<p>In this episode, we discuss how MIT researchers tackle the problem of counterfeit seeds by using unclonable labels made of silk nanoparticles. These labels help ensure that farmers are using genuine seeds, preventing losses and maintaining the integrity of crops.&nbsp;</p><p><span class="fr-video fr-deletable fr-fvc fr-dvb fr-draggable" contenteditable="false" draggable="true"><iframe height="200px" width="100%" frameborder="no" scrolling="no" seamless="" src="https://player.simplecast.com/b84075c2-bd3c-4a8f-b96b-c8dc6a2caa81?dark=false" class="fr-draggable" data-lf-form-tracking-inspected-kn9eq4roawkarlvp="true" data-lf-yt-playback-inspected-kn9eq4roawkarlvp="true" data-lf-vimeo-playback-inspected-kn9eq4roawkarlvp="true"></iframe></span><br></p><hr><p><span style='background-color: transparent; font-family: "PT Sans", serif; font-size: 22px; font-weight: 700; color: rgb(0, 0, 0);'>EPISODE NOTES</span></p><p>(0:40) - Tackling counterfeit seeds with "unclonable" labels 🌱🔐</p><hr><p id="isPasted">As always, you can find these and other interesting &amp; impactful engineering articles on Wevolver.com.</p><p>To learn more about this show, please visit our<a href="https://www.wevolver.com/profile/the.next.byte" target="_blank">&nbsp;shows page</a>. By following the page, you will get automatic updates by email when a new show is published. Be sure to give us a follow and review on<a href="https://podcasts.apple.com/nl/podcast/the-next-byte/id1548255861?l=en" target="_blank">&nbsp;Apple</a> podcasts,<a href="https://open.spotify.com/show/6lPPsRtegnivsRUEsQ09R7?si=IPMiah7xT_apJtPjqvXMlA" target="_blank">&nbsp;Spotify</a>, and most of your favorite podcast platforms!</p>

As a way to reduce seed counterfeiting, MIT researchers developed a silk-based tag that, when applied to seeds, provides a unique code that cannot be duplicated. Credit: Photograph courtesy of the researchers. Edited by Jose-Luis Olivares, MIT

cybersecurity

Profiles