Skip to the content
COREDUMP #008: Navigating the Changing IoT Security Landscape: A Survival Guide for Product Leaders
Chapters
-
| Introduction and Guest Introduction
-
| The Unseen Costs of Cybersecurity Regulation
-
| OTA Updates: Security Savior or Hidden Risk
-
| CRA vs. Other Regulations: What Matters Most
-
| The Rise of Runtime Security Monitoring
-
| Why Manufacturers Are Freaking Out About CRA
-
| The Hidden Cost of Legacy Firmware
-
| Inside the Automotive Cybersecurity Playbook
-
| eBPF: The Next Frontier in IoT Security
-
| Coffee Machines, Coffee Attacks, and Unexpected Entry Points
Listen to the Podcast
About the Webinar
In today’s Coredump Session, we dive into the evolving landscape of IoT security regulations with Giovanni Alberto Falcione, CTO at Exine. From the impact of the EU’s CRA to the complexities of OTA updates, Giovanni, François, and Thomas unpack what these new requirements mean for product engineers and how to navigate the increasingly stringent security landscape.
Key Takeaways:
- The EU’s Cyber Resilience Act (CRA) mandates stringent security measures for all connected devices marketed after December 2027, with a particular focus on runtime security monitoring.
- OTA updates are essential for mitigating vulnerabilities in the field but can also introduce challenges in regulatory compliance.
- Giovanni highlights that less than 1% of IoT device manufacturers actively monitor cybersecurity state awareness, a critical area of compliance under CRA.
- Implementing a Software Bill of Materials (SBOM) and tracking Common Vulnerabilities and Exposures (CVEs) are low-hanging fruit for product teams to start bolstering security.
- eBPF technology offers powerful, low-impact monitoring capabilities that can detect unauthorized activities at the syscall level without kernel-level intervention.
- Companies need to plan for at least five years of security updates under CRA, with potential for longer support based on device lifecycles.
- Even seemingly innocuous devices, like coffee makers, can pose significant cybersecurity risks as entry points for broader attacks.
- Giovanni emphasizes that while regulation can stifle innovation, it also raises the bar for security practices across the board.
Speakers
Chief Technology Officer, Exein
Giovanni Alberto Falcione
Giovanni Alberto Falcione is the CTO at Exein, where he leads the development of advanced security solutions for embedded and connected devices. With a background in theoretical physics and machine learning, Giovanni previously founded an AI energy startup (Twenty Watts) and worked as a machine learning engineer. He holds a BSc in Physics from King’s College London and an MSc in Machine Learning from UCL jointly awarded by the Gatsby Computational Neuroscience Unit and DeepMind.
CEO & Founder, Memfault
François Baldassari
François Baldassari is the CEO and Co-Founder of Memfault. An embedded software engineer by trade, François was driven to start Memfault by his passion for tooling and automation in software engineering. Prior to Memfault, he ran the firmware team at Oculus and built the operating system at Pebble. François has a BSc in Electrical Engineering from Brown.
CTO & Co-Founder, Memfault
Chris Coleman
Chris Coleman is the CTO and Co-Founder of Memfault. Prior to founding Memfault, Chris was an embedded software engineer at Pebble and Fitbit where he led efforts across the firmware stack and developed a reputation for tracking down and fixing challenging firmware bugs. That, coupled with his passion for using tooling to efficiently deliver high-quality hardware products, drove him to start Memfault.