APRIL 2017

WHAT EMBEDDED AND IOT DEVELOPERS
THINK ABOUT IOT SECURITYA LOOK AT SURVEY DATA IN 2017

Trusted Computing Group3855 SW 153rd DriveTel (503) 619-0562
Fax (503) 644-6708
admin@trustedcomputinggroup.org
www.trustedcomputinggroup.org

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

©©
2017
2017
Trusted
TrustedComputingComputingGroup
Group| |AllAll
RightsRightsReserved
Reserved

Security is one of the frequently cited major concerns with increasing internet connectivity. Working withEmbedded Computing Design (ECD), the Trusted Computing Group (TCG) conducted an Internet of Things (IoT)
Security Survey January to February 2017 to find if and how designers were addressing these concerns.
With broad interest in IoT security and more specifically in embedded product/systems security, the IoT survey
targeted those currently involved in specifying, creating or otherwise in developing, testing and marketingembedded and/or IoT devices. This report analyzes the answers from 252 respondents, 231 of which provided
complete responses.

WHO RESPONDED?
What is your company’s role in embeddedand/or IoT products?

The first question asked,“What is your company’srole in embedded and/or IoTproducts?” The vast majority(over 80%) work for eithera device manufacturer orsystem integrator (Figure 1).

Software Vendor

Device Manufacturer

Network/Connectivity Provider

Components Provider

Systems Integrator

Services Provider

Storage or Cloud Services

Other (Please Specify)
01325

3850

Figure 1 Respondents had eight categories to specify theircompany’s role in embedded/IoT products.

What is your company’s role in embedded
and/or IoT products?

er Results by SalespersonThe second question dealt
with the person responding
to the survey and asked,“What is your role inembedded and/ or IoT
products?” In this case, thevast majority (again, over80%) are either a hardware
or software developer/engineer (Figure 2).

Software Vendor

Device Manufacturer

Network/Connectivity Provider

Components Provider

Systems Integrator

Services Provider

Storage or Cloud Services

Other (Please Specify)
013253850

Figure 2 Respondents had 10 categories to identify
the role they fulfilled in their company.
What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

© 2017 Trusted Computing Group | All Rights Reserved

THE ROLE OF TRUST IN
EMBEDDED AND IOT
PLATFORMSSURVEY RESULTS
In the survey, security was a part of the design considerationsfor 85% of the respondents and slightly less than 10% indicatedthat it was not. Of those who said security was not a part ofcurrent design criteria, the reasons range from not necessary,
not a customer requirement, too much trouble and too
expensive being almost equally weighted at slightly over 10%
each (Figure 3). The predominant reason with over 50% justifying
lack of attention to security in their design approach was that it
was handled in another part of the system.

In general, establishing trust inthings is somewhat similar toestablishing trust in people orbrands. There has to be a basis
for and ability to confirm trust.
For objects, a Root of Trust (RoT)
provides the starting point. A
standards-based RoT establishes thefoundation for building trust anda hardware root of trust (HRoT) is
widely accepted as more secure thansoftware that can be more easily
breached by attackers.

Is security currently part of yourdesign considerations?

10%

5%

TCG’s Trusted Platform Module
open standard defines a HRoT andits associated security aspects. The
TPM specification has been adopted
as an international standard ISO/IEC
11889:2015. Through NIST SP 800164 and National Security Agency(NSA) HAP, or High Assurance
Program and other programs,
the TPM is being implemented innumerous U.S government securityefforts.

Fundraiser Results by Salesperson
UNITS SOLD
13
1385%

YesNoNot Sure

1513

structure52or ecosystem in which product is used will provide security19TCG’s Trusted Platform Module
standard addresses secure device
identity, user authentication, secureboot, secure software updates,
secure communications (especiallywhen used in conjunction with TCG’s
Trusted Network Communications(TNC) specification, secure storage(especially when used with TCG’s
self-encrypting drives (SEDs)
specification) and privacy protection.

If no, why not?
Don’t Believe Necessary

Customer does not want security included

Too Much Trouble

Too expensive to include security

Another part of the overall infrastructure
stem in which product is used will provide security
or ecosystem in which product is used will
provide security

Other (Please Specify)

01530

Figure 3 Reasons to not consider security
in current designs.

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

4560

The recently announced TPM 2.0
implements a “library” approach thatallows users to choose applicableaspects of TPM functionality for
different implementation levels andlevels of security and extends thecomputing/server capability to avariety of embedded devices.

© 2017 Trusted Computing Group | All Rights Reserved6Other (Please Specify)

If yes, what elements of security are included inyour products and/or new designs?
Secure Device Identity

User Authentication

Secure Boot

Secure Software Update

Secure Communications

Secure Storage

Privacy Protections

Other (Please Specify)

Fundraiser Results by Salesperson
0
PARTICIPANT

1835 UNITS SOLD

Improve Reliability

49

Increase Safety

66

Protect Conﬁdential Data

68

Reduce Fraud

34

Avoid Recalls

19

Address Potential Liability

29

Protect User Privacy

46

Other (Please Specify)

45370

For those who indicatedthat security was anintegral part of theirdesigns, the security
elements included
in products and/or
new designs fall into
several categories(Figure 4). Ranging fromslightly less than 30%
privacy protection toalmost 70% for user
authentication, sevendistinct areas wereidentified as importantdesign considerations.

Figure 4 Security aspects included in respondents’products and/or new designs.

By addressing security,
the respondents and theircompanies’ goals ranged
from improving reliability,
increasing safety, reducing
fraud, avoiding recalls,
addressing potential
liabilities and protectinguser privacy with different
levels of importance (Figure5). Increased safety andprotecting confidential data
were the two leading goals
with over 65% for eachone. The lowest identified
goal was to avoid recallswith slightly less than 20%
addressing this goal.

What are your goals in adding thesesecurity elements? (check all that apply)1

Improve Reliability
Increase Safety
Protect Conﬁdential Data
Reduce Fraud
Avoid Recalls
Address Potential Liability
Protect User Privacy
Other (Please Specify)
01835

5370

Figure 5 Identified security design goals with theirassociated significance to respondents.

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

© 2017 Trusted Computing Group | All Rights Reserved

With experts from industry leading hardware and software suppliers, TCG has been addressing security by
developing open specifications to improve the trust and security of computers, servers, networks and more
for well over 10 years. When asked if they were aware of the Trusted Platform Module for embedded trust andenabling security, respondents were essentially equally split between yes and no.
Within the next 12 months, 38% of the 251 respondents will consider inclusion of the TPM or trusted
computing concepts developed by TCG in their design, with 13% not including them and 49% not sure. Of
those who answered no or are unsure, 142 identified four specific alternatives being considered as well as
divine intervention to prevent security problems (Figure 6).
With the time invested considered quite valuable, over 80%+ of the respondents were interested in obtaining
the results of the survey.

Are you aware of the Trusted
Platform Module (TPM) forembedded trust andenabling security?

Fundraiser Results by Salesperson
PARTICIPANT

UNITS SOLD

Device Security Software

56

Network Security Software 51%

47

Gateway SecuritySo8ware

39

Cloud Security Services

29

Fervent Prayer

8Other (Please Specify)

949%

Yes

NoIf not, what other options for security
are you including?

Have you, or will you in the next
12 months, consider inclusion ofthe TPM or trusted computing
concepts your design?

Device Security Software

Network Security Software

Gateway Security Software

38%

Cloud Security Services

49%

Fervent Prayer

13%

Yes
No
Not Sure

Other (Please Specify)

01530

4560

Figure 6 Other options to avoid the risks of aninsecure product/system.

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

© 2017 Trusted Computing Group | All Rights Reserved

CONCLUSIONS
The goal of this survey was to determine and quantify the extent that embedded systems experts took
into account the need for trust and security in their product activities. With security as a part of the design
considerations for 85% of the respondents and the elements of security that are included in products and/or new designs and identified security design goals quantified, embedded systems experts, for the most part,
have prioritized the roll that security currently plays in their designs.
The high level of respondents who are interested in receiving the results of the survey indicates thatcompetitive and peer pressure could play a significant role in increasing security and trust in future designs.
The number of respondents who were unaware of TCG’s TPM indicates that there is a continuing need forincreased awareness among embedded engineers. Even those who were aware of the TPM may not be fullyup to speed with the latest version, TPM 2.0, targeted specifically for embedded applications.

RECOMMENDATIONS
Despite the reasonably high level of awareness shown by respondents, ongoing awareness efforts of theTrusted Computing Group should increase the ease of implementing security and desired level of trust in
current and future designs.
The recently release TPM 2.0 specification extends the benefits of hardware-based trust to embedded
applications. Specific market segments that have indicated a need for improved trust in embedded products
include smart vehicles, smart factories, smart buildings, smart homes and even smart cities – essentiallyany market where increased connectivity could attract hackers. In addition to unauthorized product/systemaccess, the hackers could obtain confidential data, proprietary information including financial transaction
details and in general wreak havoc on unprotected or poorly protected systems through access allowed byunprotected or poorly protected embedded and connected devices.
To avoid application security issues, embedded designers need to determine the implications that connecting
their product to the internet could have to the end system design and take appropriate actions to mitigate theproblems. The Trusted Computing Group and its member companies provide a variety of resources in theseefforts. TCG’s “Guidance for Securing IoT Using TCG Technology” is a specific starting point for the next step andincludes several references for further information. (See Below)

RESOURCES TO HELP DESIGNERS AND DEVELOPERS OF EMBEDDED SYSTEMSSUGGESTED READING FOR IMPROVED SECURITY/TRUST UNDERSTANDING
1.

“Trusted Platform Module 2.0: A Brief Introduction,” Trusted Computing Group

2. “Trusted Network Communications,” Trusted Computing Group
3. “Guidance for Securing IoT Using TCG Technology Version 1.0, Revision 21,” Trusted Computing Group
4. “Implementing Hardware Roots of Trust: The Trusted Platform Module Comes of Age,” SANS Institute
InfoSec Reading Room
5. “Why TPM 2.0?”

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017

© 2017 Trusted Computing Group | All Rights Reserved

6.

“Establishing Network Equipment Security,” Trusted Computing Group

7. An “open access” book intended to get one started with TPMs:
A Practical Guide to TPM 2.0 - Using the Trusted Platform Module in the New Age of Security, Arthur,
Challener, 2015
8. A reference book intended to help explain TPMs: Trusted Computing Platforms - TPM2.0 in Context,Proudler, Chen, Dalton; Springer, 2014

USER GUIDES/PUBLICATIONS
1. “Intel® Trusted Platform Module User Guide,” Intel
2. “ST33TPMF2ESPI, Trusted Platform Module 1.2 & 2.0 with TCG SPI interface,” STMicroelectronics
3. “OPTIGA™ TPM, Protecting integrity and authenticity of embedded devices and systems,” Infineon
Technologies
DEVELOPMENT KITS
1. “Get Started - Trusted Platform Module,” Microchip Technology

What Embedded and IoT Developers Think About IoT Security: A Look at Survey Data in 2017© 2017 Trusted Computing Group | All Rights Reserved