Security is not something that can be easily added to a device. During the complete product lifecycle (i.e. design, development, production, field, failure analysis), developers have to think from an attacker’s point of view. Every security relevant feature has to be protected against external and internal threats.
What is a security relevant feature is not always obvious as any feature could potentially weaken the rest of the system.
The security literature is vast, changes every day, and System on Chip (SoC) developers/OEM users lack the time and base to find the relevant information needed for a secure development. Riscure is the established market leader in embedded system security and the source of the security relevant knowledge for the customers it serves.
The security is in essence a trade-off between protection, cost and time to market and therefore there will never be one right answer. However, there are best practices which can provide a significant barrier against the attackers. The purpose of this document is to stimulate the developer to self-assess the security of a SoC design by asking security relevant guiding questions. This list is no way “the final check list” but should be used as a starting point to build further questions upon so that all the security features and possible attack avenues, countermeasures are identified.
