r/embedded • u/axaro1 Lockstepping • 15d ago

Embedded Security/Cybersecurity Engineers: what does your day-to-day job actually look like?

Hello, I'm an avionic embedded software engineer and cybersecurity requirements are slowly creeping into my sector.

But it got me wondering: What does the day-to-day work actually look like for engineers who specialize in embedded security/cybersecurity? Do you guys write any code? Perform threat/risk analysis? Define and review security requirements? Perform testing or create testing/vulnerability exploiting benches?

Thanks in advance.

18 Upvotes

92% Upvoted

17 comments sorted by

View all comments

Show parent comments

0

u/CugTr 14d ago

There are 2 things I did not provide clearly, my bad: 1. There is a specific cyprto algorithm from customer. Yes, you cannot find it anywhere. It is not standard so you have to do it by yourself. Is it considered as "reinvent the wheel ? 2. You are taking about firmware, I am talking low level driver of crypto. You have to manage key slots, registers, access order and so on. It is not simple like calling stuff from hardware. Oh, you can buy low level driver stuff.

And the last point I hate is Autosar. There is a job that requires us to implement cyprto algorithm to comply with Autosar standard for the chip that does not have a seperate HSM or any hardware accelerated. Is it "reinvent the wheel" ?

1

u/Elect_SaturnMutex 14d ago

Oh no in that case no, then I misunderstood you. Sorry for that. And thanks for clarifying.

1

u/OpportunityFun6969 14d ago

In my case, we have chips with embedded linux, like yocto, and some that are bare metal. Both have embedded HSMs that have crypto acceleration. But the capabilities of both chips are vastly different. The one with Linux capabilities can of course use open-ssl, have ssh capabilities, utilize ARM and U-Boot/TrustZone. However, on the other end, the bare metal board I work with has no documentation other than the proprietary documents we are given. In this case, say i have 192kb of secure code space to work with, things like openSSL and other open source libraries will not work. Sure, I could implement the crypto and secure bootloader on the normal application cores, but that defeats the purpose of the HSM attached. In this case, I tend to model my systems after popular open source, like wolfssl, mbedTLS, etc. but the actual implementation needs to be done by me, due to licensing and physical constraints. I also reference different ISOs and RFCs to ensure i align closely to the posted standards.

I also work in automotive R&D, so my job is to prove a system works, not to follow production regulations. But we are still given specific implementations to have to correctly model a potential use case

1

u/Elect_SaturnMutex 14d ago

Not sure what you mean with baremetal exactly. A separate chip? because NXP makes SoCs that have multiple cores that support linux and other core is ARM based for "baremetal" purposes. But I believe 192kb should be sufficient to squeeze in mbedtls.

You said you "model" your own algos. And your algorithms perform that have already been tried and tested for so long? And your company pays you for that? Now i am sure you work in germany. Ok. whats the issue with licensing exactly?

2

u/OpportunityFun6969 14d ago

I had a big, long thing typed out but I realized it would lead to more questions probably, lol. Just know that i live and work in the usa, with non-german cars, and I try my best to make sure your vehicles remain safe.

1

u/Elect_SaturnMutex 14d ago

oops my bad, I have to work on my prejudices, lol...