Open Source Summit + ELC North America 2020

Security is a key feature in every connected product. But the real question is: what do you want to secure? Do you want to protect the Intelectual Property? Or maybe the integrity of your product? Do you want to secure data at rest? And what about data in transit? These and other questions can be answered with a proper threat modeling process so potential threats can be identified and mitigated. In this talk, an example of threat modeling to identify the security requirements of an embedded Linux system will be discussed, and a wide range of tools and techniques to implement the security requirements will be presented, including secure/verified boot, data integrity and encryption, authentication, port scanning, TPM and key management, secure firmware update and patching, secure coding, sandboxing and containers, TEE, mandatory access control (SELinux, AppArmor, etc).