The Linux Security Hardening Checklist for Embedded Systems

There is no silver bullet to security, and even more importantly, there is no single source of truth for what security options are available, what they do, and what impacts they have, or even how they all work together.

In this post, we will enumerate the many security mechanisms that can be operationally deployed in an embedded system running Linux in order to secure that system from common software attacks. While the traditional approach to security relies on the CIA triad of confidentiality, integrity, and availability, the majority of this post is primarily focused on the principles and enforcement of integrity.

LinuxJonathan KlineFebruary 9, 2021Linux, SELinux, Cyber Security

The Most Secure Linux for Embedded Systems – Hint, It’s Not Enterprise Linux

Don’t get upset.

We fully acknowledge that the hard-working people who make enterprise type Linux distributions want to help their customers achieve secure systems and they strive to improve the security posture of their distributions all the time.

However, there are two major areas where these developers run up against a nearly insurmountable wall.

First, they use a different threat model. An enterprise distribution of Linux is designed with a threat model suited to datacenter/cloud deployments, but embedded and cyber-physical systems face a wider array of threats including situations where the attacker may have physical access to the system.

Second…

LinuxDan NolandDecember 9, 2020Linux, SELinux, Cyber Security, Secure Boot, Data At Rest

Linux and Hypervisor Hardening — Applying a Secure by Design Philosophy

Star Lab has long believed that Secure by Design is the best strategy for approaching security problems. To understand why this principle guides our work, you first need to understand the difficult class of problems we hope to address.

Linux, VirtualizationDan NolandApril 14, 2020Linux, SELinux, Cyber Security, Virtualization, Design

Beyond SELinux: Enforcing Confidentiality and Integrity for Applications and Data

One question we frequently get is “Why would I use something like Titanium Security Suite, instead of other Linux Security Modules (LSMs) like SELinux or AppArmor?”. In short, there’s no reason you can’t use both. SELinux and Titanium primarily differ in their threat model, concept of operations (CONOPS), and flexibility.

LinuxJonathan KlineMarch 31, 2020Linux, SELinux, Cyber Security

A Brief Tour of Linux Security Modules

I’m guessing, if you’re reading this post, you already have some familiarity with Linux Security Modules (LSMs). If you’ve used SELinux or AppArmor then you’ve used an LSM. If you’ve used any modern Linux distribution or Android-based device, you’ve (probably) used an LSM.

Technology ProtectionShaun RuffellNovember 21, 2019Linux, SELinux