Security Evaluation Standard for IoT Platforms (SESIP)

Quantifying Benefits of SESIP Reuse
White Paper
May 2022

www.globalplatform.org|© 2022 GlobalPlatform, Inc.

Table of Contents
ABOUT US ........................................................................................................................ 3
Section 1:

Purpose ..................................................................................................... 4

Section 2:

Introduction ................................................................................................ 5

Section 3:

Business Drivers for Security Evidence ..................................................... 7

Section 4:

SESIP Toolbox ........................................................................................ 13

Section 5:

Composite Evaluations: The Bottom Line ............................................... 21

Section 6:

Benefits of SESIP Evaluations ................................................................. 24

Section 7:

Conclusion ............................................................................................... 26

Section 8:

Table of Figures ....................................................................................... 27

Section 9:

Table of Tables ........................................................................................ 27

www.globalplatform.org

2 / 27

ABOUT US
GlobalPlatform is a technical standards organization that enables the efficient launch
and management of innovative, secure-by-design digital services and devices, which
deliver end-to-end security, privacy, simplicity, and convenience to users. It achieves
this by providing standardized technologies and certifications that empower
technology and service providers to develop, certify, deploy, and manage digital
services and devices in line with their business, security, regulatory, and dataprotection needs. Key offerings include secure component specifications; the Device
Trust Architecture for accessing secure services within a device; the IoTopia
Framework for secure launch and management of connected devices; and theSESIP Methodology for IoT device certification.
GlobalPlatform technologies are used in billions of smart cards, smartphones,
wearables, and other connected and IoT devices to enable convenient and trusted
digital services across market sectors, including healthcare, government andenterprise ID, payments, smart cities, industrial automation, smart home, telecoms,
transportation, utilities, and OEMs.
GlobalPlatform standardized technologies and certifications are developed througheffective industry-driven collaboration, led by multiple diverse member companies
working in partnership with industry and regulatory bodies from around the world.

www.globalplatform.org

3 / 27

Section 1:

PURPOSEThe objective of developers of Internet of Things (IoT) devices is to bring to market
products that aim to operate a specific use case (home appliance, automotive,
industrial, entertainment, etc.). When this use case does not have a security or safety
purpose, developers focus more on functionality, usability, and performance than on
security, a domain in which they generally have limited competency. However,security increasingly becomes a concern in the IoT space, as devices, users, andservice providers are subject to a growing number of attacks. 1 The consumers of
those devices and services, in consumer and enterprise markets, are directly
affected by these security shortfalls.
As IoT device developers implement protection mechanisms in their products to raise
the consumers’ trust, it is important to verify that those mechanisms are adequate
through self-assessment or formal evaluation by a third party, a process that canincrease costs and delays.
The Security Evaluation Standard for IoT Platforms (SESIP) is a methodology
designed for IoT that leverages the concepts of composition and reuse, allowing
developers to focus on their core job and to reduce the pain of security assessment.
This paper aims to explain the benefits – in time, effort, and cost – of using SESIP
when evaluating the security features of IoT components, platforms, and products.
Note: As this paper illustrates, adoption of SESIP can significantly reduce the burdenof time, cost, and expertise required to bring secure products to market. SESIP is
not, however, a substitute for in-house security expertise and ongoing support.

The first six months of 2021 saw more than 100% growth in cyberattacks against Internet ofThings (IoT) devices [https://www.iotworldtoday.com/2021/09/17/iot-cyberattacks-escalate-in2021-according-to-kaspersky/]1

www.globalplatform.org

4 / 27

Section 2:

INTRODUCTION

The core capability of an IoT device developer is generally in a particular domain
outside of security. For example, an IP camera developer knows about image
compression and little about data encryption. However, to serve the camera
surveillance market, the security of the camera requires encryption of the video
streams. It makes sense that the developer acquires this security capability from anexisting security component, rather than trying to develop it independently. To makethis possible, the developer needs to understand the security capability of thecomponent (what it does), the strength of that capability for their specific use case(how good it is), and whether it helps to meet the business and use cases fromcompliance, risk management, and accountability standpoints.
The possibility of adding specific security functionality by integrating existing security
components into their devices helps IoT device developers to focus on their core job
and to rely on security specialists to bring the necessary protection mechanisms totheir devices. However, IoT device developers need to ensure that the security
components they integrate have been properly evaluated to prove they offer thenecessary level of protection against the threats they are intended to counter.
On the other side, for security component providers, the methodology used toevaluate their security products needs to ensure that the time, effort, and costinvested in such evaluation are acceptable to guarantee the affordability andtimeliness of their products.
The SESIP methodology allows security evaluations to be performed in a cost andtime effective manner and has been specifically designed for IoT platforms andcomponents. The simplicity of the language used to express security functional
requirements, the applicability to an IoT threat model, and the user-friendliness makeSESIP an easy-to-use evaluation methodology. In addition, by supporting
composition and reuse, SESIP further reduces the cost and time of such anevaluation.
Although a ‘simple’ IoT product may not look very complex, it is generally anassembly of several individual hardware and software components providing
functionalities such as encryption/decryption, memory management, random number
generation, operating system, boot, and of course applications that perform theactual functions of the product. Each of these components can offer many potential
entry points for attacks that might result in compromise of the entire product.
Any security vendor can claim to provide excellent security capabilities, while its
competitors can claim the same. For IoT device developers, a first challenge istherefore to identify the components with the security capabilities that meet theirneeds. Another challenge is that even when IoT device developers select appropriate
security components or platforms, they need to ensure that the components or
platforms are integrated in a way that provides the needed security assurance to thefinal IoT device.

www.globalplatform.org

5 / 27

A previous GlobalPlatform white paper about SESIP Composition 2 outlined theimportance of reusing evaluation results 3 to support the certification of Information
and Communications Technology (ICT) products which are more and more built ascomposite products assembling a number of lower-level components.
The security evaluation of composite products comprising already evaluatedelements, as well as reuse of evaluation results across certification schemes, canreduce the cost and duration of security certifications.

2
Composition and Reuse White Paper – Introducing the Security Evaluation Standard for IoT
Platforms (SESIP) [https://globalplatform.org/wp-

content/uploads/2021/06/GP_Composition_and_Reuse_WP_v1.0_PublicRelease.pdf]
3

Evaluation results consist of certificates and composition guidance.
www.globalplatform.org

6 / 27

Section 3:

BUSINESS DRIVERS FOR SECURITY EVIDENCE

As the number of IoT devices grows rapidly, with predictions ranging from 50 to 70
billion by 2025, up to 1 trillion by 2035, 4 the number of security incidents involving IoT
products grows accordingly. This increase of incidents results in consumer distrust,which is a major inhibiting factor to the deployment of billions of IoT devices in the
coming years. 5
Demonstrating the security capabilities of IoT devices becomes a solution to reduce
this distrust, and security testing/evaluation is a means to achieve this demonstration.
As an evaluation methodology specially developed for IoT, SESIP is the tool that will
facilitate the success of this demonstration to bring to market IoT products that are
secure, protect the users’ confidentiality and privacy, and protect the access andcommunication to remote services.
Before presenting the benefits of SESIP, this chapter looks at the multiple businessdrivers that require developers of IoT devices to demonstrate the security assurance
level of their products. Some drivers result from external demand such as compliancewith regulatory obligations and industry standards, or conformity to market accessrequirements and particularly to rules established by service providers. Other drivers
result from internal requirements such as accountability, risk management, anddifferentiation.
The figure below represents those various business drivers, which are further
described in the subsequent sections.

Figure 1 – Business Drivers for Security Evidence

4

The outlook for IoT investment to 2035, Philip Sparks, June 2017[https://community.arm.com/cfs-file/__key/telligent-evolution-components-attachments/01-1996-00-0000-01-30-09/Arm-_2D00_-The-route-to-a-trillion-devices-_2D00_-June-2017.pdf]

Harald Bauer, Ondrej Burkacky, and Christian Knochenhauer, “Security in the Internet ofThings”, McKinsey & Company, May 2017[https://www.mckinsey.com/industries/semiconductors/our-insights/security-in-the-internet-of-things]
5

www.globalplatform.org

7 / 27COMPLIANCE
Compliance aims to protect consumers, but it is also a major obstacle for IoT
developers. In an extremely fragmented market, with different security requirements
per verticals and regions, this represents a huge challenge. Developers areconfronted with hard decisions such as where they want to sell their products, andeventually pass the cost of the compliance effort to the consumer.
Device manufacturers and their suppliers face the challenge of proving compliance toexisting and emerging regulations and standards in the IoT domain, since evaluating
the trustworthiness of IoT devices will need more manpower than available
worldwide. 6 Even if we were able to test each of those potential trillion devices at therate of one per second, it would take thousands of years to complete the task.
3.1.1

REGULATIONIn Europe, the European Union (EU) Commission has adopted a Delegated Act
under the Radio Equipment Directive (RED) to expand cybersecurity requirements.
The EU Commission has shown an interest in developing an open standardization
request for essential requirements for a horizontal EU regulation on cybersecurity
under the NLF (New Legislative Framework), with a more generic scope, specifying
strategic objectives to cover cybersecurity requirements for multiple directives andregulations. Based on such open standardization requests, the European
Standardization Organizations (ESOs) will develop the necessary standards which
specify the security measures to support these requirements. Additionally, the Cyber
Security Act (CSA) provides the framework for certification of devices, processes,
and services while additional, complementary regulation such as the NIS (Network
and Information Security) Directive can provide the enforcement mechanism for suchcertifications.
In the US, California Senate Bill 327 (CA SB-327) mandates ‘reasonable security
features’ for connected devices. Other states such as Oregon, Illinois, Maryland, New
York, and Virginia are expected to release cybersecurity regulations. After publicationof ‘H.R.1668 - IoT Cybersecurity Improvement Act of 2020’, in 2021 the National
Institute of Standards and Technology (NIST) introduced associated guidance as
NIST SP 800-213. Currently, the Cyber Shield Act proposal is being considered for
IoT devices. Executive Order (EO) 14028, “Improving the Nation’s Cybersecurity”,
tasks NIST, in coordination with the Federal Trade Commission (FTC) and otheragencies, to develop a proposal for baseline security criteria for consumer IoT
devices, based on the NIST standard NISTIR 8259A ‘IoT Device Cybersecurity
Capability Core Baseline’.

6(ISC)2 CYBERSECURITY WORKFORCE STUDY, 2019; Strategies for Building and
Growing Strong Cybersecurity Teams [https://www.isc2.org/-/media/ISC2/Research/2019-

Cybersecurity-Workforce-Study/ISC2-Cybersecurity-Workforce-Study2019.ashx?la=en&hash=1827084508A24DD75C60655E243EAC59ECDD4482]

www.globalplatform.org

8 / 27

3.1.2

INDUSTRY

In order to satisfy new legislation mentioned in section 3.1.1, standards bodies
launch the development of certification frameworks (e.g. ETSI EN 303 645) andsome countries (e.g. Singapore, Finland, Germany) introduce security labels
awarded to ICT products that meet pre-defined security criteria.
Trade associations and members of the Testing, Inspection and Certification (TIC)
community maintain private labels as evidence of conformance to basic cybersecurity hygiene, while the market expects to see some consolidation of thoserequirements.

ACCESS TO REMOTE SERVICES
Section 3.1 addressed compliance from the perspective of meeting regulations
and/or industry standards. However, ICT products must also guarantee smoothconnection and access to remote services, and must therefore demonstrate
conformity to rules and protocols used by providers of such remote services.
The digital economy results from billions of everyday online connections amongpeople, businesses, devices, data, and processes. The backbone of the digital
economy is hyper connectivity which means growing interconnectedness of people,
organizations, and machines in the IoT.
IoT devices are the entry point to remote services and collect data fueling thoseservices. Untrustworthy IoT devices can provide bad data that impacts the quality ofservices. The ability of service providers to maintain the quality of their services has adirect impact on their bottom line, and their capacity to live and thrive in the digital
ecosystem.
The IoT device market being characterized by quick time to market, price sensitivity,and low (hardware) margins, particularly for ‘simple’ IoT devices, profitability is likely
to be achieved on the services. Hence the interest of service providers in managing adelicate balance: on one hand, as a transactional business, to maximize the numberof operations or transactions by increasing the number of devices from multiple
OEMs; on the other hand, to manage the inherent risk created by accepting accessto the service from multiple devices outside of their security perimeter.
For years, service providers and device vendors have prioritized maximizing thenumber of users and entry points. The trend now is for service providers to create
their own definition of baseline security for devices to access their services. As aresult, IoT device developers need to prove that their devices implement theminimum-security capabilities that the service providers require.

www.globalplatform.org

9 / 27

SUPPLY CHAIN
Product security requirements might differ per market, per region, per use case, butthey have common foundational security capabilities such as secure storage,
cryptography, trusted execution, etc. This foundation generally constitutes thebaseline requirements mentioned in section 3.2. The semiconductor industry
provides chips with security features while software developers provide the uppersecurity layers and IoT platforms, targeting a worldwide market. All these security
foundations are implemented to support standards that may differ per region.
To understand how IoT device manufacturers shall comply with these new
cybersecurity requirements, it is essential to understand the role and dependencies
of multiple actors in the security development supply chain.
As an example, for billions of IoT products, secure software updates will be
requested according to new EU CSA legislation article 51(j). As IoT devices
manufacturers are not security experts, they usually rely on a few hundred IoT
platforms providing a ‘secure update’ function. IoT platform developers may not be
crypto experts either, so they usually rely on a few dozen chip semiconductor
vendors, providing cryptography capabilities to secure the update.
Demonstrating the provenance of components as a mechanism for securing the
supply chain is becoming mainstream. This provenance is not limited to hardware
components. One example of the adoption of this requirement is given by the
Software Bill Of Materials (SBOM) from the National Telecommunications andInformation Administration (NTIA). 7
Semiconductor vendors develop and provide cryptographic functions, to be easily
used as ‘black box’ by non-crypto experts. Most chip vendors use the same
cryptographic block in multiple products.

IoT Devices: billions

IoT Platforms: few hundred

Chip vendors: few dozen
Figure 2 – Supply Chain

7

https://www.ntia.gov/SBOM
www.globalplatform.org

10 / 27

Thus, a single security assessment of the cryptography capability done by the chip
vendor provides assurance on state-of-the-art cryptography for millions of devices.
Each actor in the IoT development chain should only have to prove that it effectively
uses the security functions available and follows user guidance. The SESIP
methodology answers that need with composition and reuse.
When IoT developers can identify the platforms and components that already
implement the security features they need, they obtain security capabilities without
having to develop in-house security expertise. Certain evaluation models allow for
self-assessment, making use of certified platforms not just as a simple model forcompliance but also as ones with evidence. For certification of IoT devices, 3rd party
assessment laboratories will be in the position to perform time- and cost-effective
evaluations by looking into the implementation of the certified platforms andevaluating new security functionality added on top of them.

www.globalplatform.org

11 / 27

ACCOUNTABILITY AND RISK MANAGEMENT
As explained in the introduction to this chapter, in order to enhance consumer
confidence, developers of IoT devices need to implement security features in theirproducts to minimize the risks of attacks such as:•

Theft of credentials used to operate the device and/or access remote
services, and that may also be used for other products and services•

Disclosure of sensitive and private data about the owner of the product•

Unauthorized access to the network or other devices that the device
connects to•Unauthorized access to remote servers that ‘trust’ the IoT device, as well as
potential theft of data and resources hosted by these servers•

Ability to generate network traffic that can be used for denial-of-service
attacks on other systems

Connected IoT devices need to be secured not only for device protection, but also toprotect the owner’s assets stored on the device and ultimately the whole ecosystem(the network, other connected devices, remote services and assets, etc.)
In the event of an IoT device being compromised, it will affect the users’ assets andtrust, creating damages to people and companies, and potentially trigger fines,
claims, recalls, financial and reputation harm. IoT developers may be accountable forthese consequences and need to manage this risk.
Security evaluations provide assurance by giving tools to IoT developers to perform
due diligence in risk assessment. Moreover, IoT developers making use of certified
platforms inherit security functionality and strength proportionate to the risk specific to
the target use cases (e.g. home, entertainment, gaming, wearables, etc.), thus
demonstrating security capabilities proportionate to the risk. SESIP aims to ensurethat security features implemented provide the targeted level of robustness against agiven attack potential; i.e. that the technology used is appropriate to the risks
identified.
Even developers who understand security cannot always be sure of the security of
their devices, unless security capability and strength of the device have been
evaluated by a third party, or using self-assessment, to claim a certain security
assurance level. Going through an evaluation process demonstrates a willingness tobe perceived as a responsible developer who performed due diligence on the
security capabilities of its products. Evaluation can also create differentiation fromcompetitors who would not act in the same way, driving the market perception that all
products do not suffer the same flaws.

www.globalplatform.org

12 / 27

Section 4:

SESIP TOOLBOXThe effort required by device vendors conducting security evaluations of their devices– for conformance or compliance reasons, for accountability, or for better risk
management – can be greatly simplified by exploiting composition.
SESIP facilitates device security self-assessment or certification by supporting
composition of certified components and reuse of certifications across different
evaluations. It addresses the need for a standardized approach that supports a broad
range of regulatory and security frameworks, while at the same time providing amethodology that is adaptable to the IoT environment and accessible to IoTdevelopers who are not security experts.
SESIP reduces complexity, cost, and time-to-market for IoT stakeholders by offeringa methodology that’s mappable to device evaluation and self-assessment, andcompliant with multiple standards and regulations. SESIP security functions can bemapped to device security requirements. This mapping is already prepared for
consumer IoT (ETSI EN 303 645). 8
The benefits presented in this section apply to all SESIP assurance levels. However,while a SESIP4 or SESIP5 evaluation must be performed as a complement to a
SOG-IS/EUCC certification, the cost and effort needed to prepare and execute theprerequisite Common Criteria evaluation are not taken into consideration in thesavings analysis.

SESIP Applicability for EN 303 645 [https://globalplatform.org/specs-library/secure-iot-platformsfor-consumer-internet-of-things-white-paper-sesip-applicability-for-en-303-645/]
8

www.globalplatform.org

13 / 27

SAVINGS IN REDUCING COMPLEXITYThe SESIP methodology reduces complexity of certification.
In the table below, we list the main benefits of SESIP and how they address thebusiness drivers identified in chapter 3 for all stakeholders.
Table 1 – Savings in Reducing Complexity
SESIP Principle

Benefit

BeneficiaryBusiness
DriverSESIP supports mapping
to various IoT standards(e.g. ETSI, ISO/IEC,
NIST), making the reuseof SESIP evaluation
results applicable to otherevaluations.

Enables an easy translation of a SESIP
evaluation into a specific evaluation
required in a given vertical domain.

IoT developers

Compliance

Service providers

Accountability

Policy makers
Device OEMs
IP providers

Enables an efficient compliancedemonstration against productregulatory requirements, and therefore
accelerates time to market.

IoT developers

Compliance

Service providers

Remoteservices

Policy makers
Device OEMs
IP providers

Optimizes the use of resources and thelearning curve.

IoT developers

Risk
management
Compliance

Systemintegrators
IP providers
Evaluators

An objective of SESIP is
to build a complete
environment that definesand controls a consistentuse of the methodology(consistent laboratory
evaluation and consistentcertification bodymanagement).

Standardizes the evaluation
methodology for security products andcapabilities across the value chain.

IoT developers

Compliance

Service providers

Supply chain

Policy makers

Riskmanagement

Device OEMs
IP providers
Evaluators
Supports a simple and coherent
governance.

IoT developers

Compliance

Service providers
Policy makers
Device OEMs
IP providers

Optimizes the certification process.

IoT developers

Compliance

Policy makers
Evaluators

www.globalplatform.org

14 / 27SESIP Principle

Benefit

BeneficiaryBusiness
DriverSESIP is a robust
methodology establishedby experienced hardware
and software developers
and laboratories.

Provides recognized security assurancewith a simple and controlled
methodology and governance.

IoT developers

Compliance

Service providers

Remoteservices

SESIP supports acomposition and reuseapproach.

Policy makers
Device OEMs

Accountability

IP providers
Reduces the time and effort thatdevelopers need to invest on security
evaluations compared to having to learncomplex terms and methodologies.

IoT developers

Helps developers certify their products
to the current-best-practice security.
Allows them to efficiently create
evidence needed for certification.

IoT developers

Allows developers to source qualified
and proven components to integrate intheir products.

IoT developers

Supply chain

Service providers

ComplianceDevice OEMs
IP providers

Remoteservices

IoT developers

ComplianceDevice OEMs

Accountability& Riskmanagement

Allows developers to certify secure
products, based on previously certified
secure components.

Device OEMs
IP providers

Device OEMs
IP providers

IP providers
Evaluators

Allows developers to focus on their corejob and to reduce the pain of security
assessment.

www.globalplatform.org

IoT developers
IP providers

Accountability& Riskmanagement
Accountability& Riskmanagement

Accountability& Riskmanagement

15 / 27

SAVINGS IN PREPARING FOR EVALUATIONSESIP allows IoT product developers to specify the security properties of the productbeing evaluated (Security Target or ST) in an easy and efficient way. This also allows
the laboratories to be fast and effective in reading and analyzing the ST.
By simplifying the structure and formalism of Security Functional Requirements(SFRs) and maintaining a strict catalog of those SFRs, SESIP turns the developmentof STs into a selection of those SFRs that are needed to meet the security objectivesof the product.
The efficiency gain indicated in the rightmost column of the following table represents
an estimate of the typical savings (expressed as a reduction of cost spent, effort
expended, and time consumed) compared to a more complex evaluation
methodology such as Common Criteria.
Table 2 – Savings in Preparing for Evaluation
SESIP Principles

Benefits

Beneficiaries

TypicalEfficiency
Gain

The SESIP SFRs are tailored forsimplicity and accessibility, and they
are written in plain English rather
than in a formal language.

Optimizes communication withall stakeholders in the market.

IoT developers’marketingHigh

Evaluators
Optimizes time and effort
needed to learn themethodology.

IoT developers
Service providers
Device OEMs
IP providers

Each SESIP SFR targets a fullsecurity purpose by itself, rather thanbeing split into low level genericmechanisms.

Medium toHighdependingon thedepth oflearning

Optimizes time and effort
needed to write Security
Targets.

IoT developers

Optimizes time and effort
needed to analyze andintegrate components.

IoT developers

Allows the Security Target
writer an intuitive understandingof the security requirements,
which saves time in analysis.

IoT developers,
Device OEMs,
IP providers

Low toMediumNote: Accessibility does not
imply oversimplification; thesemantics of SESIP SFRs is
precisely defined, so there is noambiguity about the meaning of
the SFR, even expressed inplain language.

Service providers

Low

Evaluators

Low

www.globalplatform.org

High

IP providers
Low

Device OEMs

16 / 27SESIP Principles

Benefits

Beneficiaries

TypicalEfficiency
Gain

SESIP maintains a catalog of SFRs
as an essential part of themethodology, which allows forconsistency and reuse. This catalog
defines a set of security features thatare essential, and for which there isa shared understanding in thecommunity, likely to be accessible to
IoT developers.

Simplifies reusability while
maintaining SESIP’s formalism,
which saves time in Security
Target writing.

IoT developers

Low toMediumdependingoncomplexity

The catalog of SFRs will evolve overtime, following the evolution of IoT
security challenges and the growing
usage of SESIP methodology.
IoT developers may also want todifferentiate their offering by
including specific or innovative
security features to enrich thecatalog.

Promotes reuse andaccelerates the development ofSecurity Targets throughenrichment of the catalog of
SFRs.

Service providers
Policy makers
Device OEMs
IP providers

www.globalplatform.org

IoT developers
Service providers
Device OEMs
IP providers

Incremental
gains overevaluation
iterations

17 / 27

SAVINGS IN EXECUTING THE EVALUATIONAs a result of the composition approach, evaluating a compound product that
assembles already evaluated components will generate savings in cost (thanks to theeffort reduction) and in time (generated by an acceleration of the evaluation itself).
For example, when performing an EN 303 645 evaluation, following the companion
document TS 103 701 ‘Conformance Assessment of Baseline Requirements’, use of
a SESIP composition approach addresses two key elements:••

At the beginning of the evaluation, developers assess the security capabilityof their products to complete the ‘Implementation Conformance Statement’(ICS).
o

Making use of IoT certified platforms, developers gain insights into thefunctionality of the security capabilities available in their product, andreflect on their own usage and the level of assurance provided by that
security capability.

oWithout SESIP composition, developers must assess the security
functionality of their products based on information available from the
suppliers of the different software and hardware components, plus the
security capability they themselves developed, as well as their integration,in order to complete the inventory of security functionalities in place.

Test plans are developed using input from the ‘Implementation eXtra
Information for Testing’ (IXIT) as an initial inventory of the security
functionality evidence.
oMaking use of IoT certified platforms simplifies the test plan, reducing thetime and effort by focusing on proper usage of the security capability
provided by the platform, rather than preparing to test the robustness ofsuch capability.

oWithout SESIP composition, evaluation parties have to create test plansto address the security functionality provided and its robustness.
Moreover, with EN 303 645, developers provide their own selfassessment results without third-party check. SESIP1 supports a selfdeclaration exercise with a third-party check and certification, providing
harmonization criteria for all developers. 9

The efficiency gain indicated in the rightmost column of the following table represents
an estimate of the typical savings (expressed as a reduction of cost spent, effort
expended, and time consumed) compared to a more complex evaluation
methodology such as Common Criteria.

SESIP Applicability for EN 303 645 [https://globalplatform.org/specs-library/secure-iot-platformsfor-consumer-internet-of-things-white-paper-sesip-applicability-for-en-303-645/]
9

www.globalplatform.org

18 / 27

Table 3 – Savings in Executing the Evaluation
SESIP
Activities

Benefits

Beneficiaries

TypicalEfficiency
Gain

Documentation
analysis•

Reuse of component evaluation results

IoT developers

Linking/pointing to previous evaluation results

Service providers

Medium toHigh•

Policy makers
Device OEMs
IP providers

Hardwarereview

Code review

Test strategy
definition

Vulnerability
assessment•

Reuse of evaluation results of components
already evaluated when integrated into acompound•Reduce meetings, calls, and Q&A•

Reuse of evaluation results of components
already evaluated when integrated into acompound•Reduce meetings, calls, and Q&A•

Leverage previously defined strategies•

Reduce time needed to define test strategy•

Reduce interaction with developer•

Leverage previously assessed components

IoT developers

MediumDevice OEMs
IP providers
IoT developers
Device OEMs

Medium toHigh

IP providers
Evaluators

Medium toHigh

IoT developers

MediumIP providers
Evaluators

Test plandevelopment•

Leverage previously defined test plans

Evaluators

Medium toHigh

Test campaign•

Reduce number of tests executed

IoT developers

Low•

Additional testing limited to features added bycomposition

Device OEMs•

Reduce fix/retest loops with developer

Evaluators•

Reuse sections from previously evaluatedcomponents

Evaluators

Report writing

IP providers

MediumThanks to the composition and reuse promoted by the SESIP methodology,
evaluators will be more effective in performing their evaluation activities. The
expectation is that this reduction in effort will be reflected in savings for the IoT
developer, where savings include time, money, and even resources involved in theevaluation. In addition, the developer will obtain a certificate more quickly, ultimately
benefiting the go-to-market of the certified product.

www.globalplatform.org

19 / 27

Although it may appear that saving in evaluation effort may result in a loss for thelaboratories, it can actually be expected that with certification becoming faster andcheaper, the number of products to evaluate will increase, generating more work forthe labs. This is exactly the virtuous circle needed to bring to market products which
are safer and more secure.

www.globalplatform.org

20 / 27

Section 5:

COMPOSITE EVALUATIONS: THE BOTTOM LINEThe economic benefits from composite evaluations of IoT devices come from multiple
grounds since there are direct and indirect cost implications. By definition, security
evaluations have an implicit cost and IoT developers are looking to offset the costwith a clear benefit, to achieve a positive Return On Investment (ROI). In that sense,
costs are calculated as the initial cost, or cost of the evaluation itself, plus the runningcost, or subsequent cost of supporting the developer’s customers in their own
certifications.
Consider the scenario:•

A device needs to demonstrate the use of a TLS stack (TLS) during a security
evaluation.

•

The developer of this TLS stack, Developer A, uses a crypto library (CL) fromanother developer, Developer B.

•

Developer B uses an AES engine from crypto hardware (CH) developed by
Developer C

When Developer A is looking to certify his TLS stack, it is cheaper to certify the
combination of the whole TLS+CL+CH as a single product. When this evaluation is
one-off, there is no business case to justify the individual evaluation of three different
components from three different developers.
The IoT market is different in that regard. A single component, hardware and/or
software, can end up in hundreds of different applications and used by a large
number of IoT developers that will make use of that evaluation evidence acrossmultiple compliance and risk management scenarios, not to mention the differentiator
element.

Figure 3 – Scalability of Business Benefits of SESIP
www.globalplatform.org

21 / 27

From the above example, we can assume there are n number of TLS developers,
Developer An, and m number of crypto library vendors, Developer Bm.
•

Developer C certifies the crypto hardware (CH) once.

•

Developer C creates distribution/certification packages for CH, including
composition manuals and other materials that help each purchaser to certify
its own product, while reducing the effort from Developer C during each of
those evaluations. Developer C spreads the cost of certification across the
anticipated number of sales to Developer Bm.

•

The certification as a key market differentiator appeals to Developer Bm as
the alternative to uncertified crypto hardware from developers other thanDeveloper C.

•

Developer Bm calculates the risk of having the right support from any crypto
hardware developer versus mitigating the risk by using the certified crypto
hardware from Developer C.

•

Developer Bm purchases the crypto hardware from Developer C anddevelops a crypto library (CL) that incorporates the crypto hardware.

•

Developer Bm certifies the CL compound.
oDeveloper Bm and Developer C can use different laboratories.

•

Developer Bm creates distribution/certification packages for CL, including
composition manuals and other materials that help each purchaser to certify
its own product, while reducing the effort from Developer Bm during each of
those evaluations. Developer Bm spreads the cost of certification across the
anticipated number of sales to Developer An.

•

Developer Bm sells their CL to Developers An.

•

When Developer An certifies their TLS, besides the time and cost-effective
evaluation under composition, they obtain the additional benefit of not having
two or more different developers involved in a single evaluation, minimizing
their risk on issues with IP, division of costs, uncertainty about who has an
issue when a vulnerability is found, etc.

With more and more components being certified, the evaluation of compound
products that combine several components will be even faster and easier, reducing
both the time spent for evaluation, and the cost of this evaluation since the necessary
effort will be lessened:•

A vendor reusing the same evaluated component(s) in multiple compounds
will realize multiple savings through all compounds evaluated.

•

The developer of a final product that needs to be evaluated will be
encouraged to look for proper implementations of already evaluatedcomponents, reducing the time and cost of the evaluation of the final product.

•

The evaluation of a compound assembling one or several components
previously evaluated will diminish the necessary test coverage of thecompound.

www.globalplatform.org

22 / 27

A virtuous circle is created since reduction of the cost and time of component
evaluations will stimulate more developers to evaluate their components, and more
integrators to assemble components into products that will themselves become
evaluated products, increasing the number of certified components, further reducing
the cost and time of composite evaluations.
The concept of reusing previously evaluated components introduces some ROI
analysis into the certification process, something which is rarely done today wherecertification is seen as a pure cost. Indeed, a fraction of the cost of evaluation of one
component can be charged back (or factored in) on all compounds using thiscomponent. Therefore, the evaluation of one component can significantly encourage
its reuse in compounds and devices.

www.globalplatform.org

23 / 27

Section 6:

BENEFITS OF SESIP EVALUATIONSAs mentioned earlier, SESIP and its composition model will benefit multiple actors
throughout the value chain. This chapter provides examples of direct and indirect
benefits to various stakeholders.
BENEFITS TO CHIPMAKERS•

Increase the overall security value of a chipseto••A security evaluation helps to assess the security capabilities andperformance of hardware and software components present in a chipset,
reducing post market risk while improving in-house security knowledge
and capabilities.

Reduce operational costsoCore security capabilities can be certified and reused across chipset
families and tiers.

oReduced need to support developers who want to perform security
evaluations using the chips, as they can reuse evaluation results andmake use of the guidelines

Clear market differentiatoro

Clear definition of security capabilities against competitors based on
evaluation results

BENEFITS TO SOFTWARE DEVELOPERS•

Increase software value by leveraging certified hardware protection
mechanisms•

Offer software components with security capabilities clearly evaluated•

Deliver certified software components with evaluation results that can bedirectly re-used through the composition model by a customer or bythemselves in another software component.
BENEFITS TO SYSTEM INTEGRATORS•

Encourage integration of certified components with evaluation results that canbe re-used, instead of (re)developing capabilities in-houseo

Cost related to research, design, development, and testing of security
functionality is diverted to the use of products with proven corecapabilities.

•

Reduce evaluation cost and time by re-using evaluation results from
integrated components.

•

Improve time to market by reducing development and evaluation duration.

•

Reduce the risks of expensive recalls and lawsuits.

www.globalplatform.org

24 / 27

o

Relying on certified components for critical security related functions of
the product reduces risk.

BENEFITS TO OEMS AND SERVICE PROVIDERS••

Meet complianceoMeet device security functionality requirements thanks to demonstrable
security capabilities provided by incorporated components/platforms.

oIn the case of self-assessment, identify components implementing thenecessary security functionality and produce evidence based oncomponent certification.

oIn the case of 3rd party evaluation, upon recognition by the relevant
scheme of the evaluation results, the evaluation laboratory leverages thecomponent results for evaluating the device rather than re-evaluating thecomponents.

Reduce cost and timeo•Composition encourages the use of security features from evaluatedcomponents rather than developing that capability in-house, allowing
more devices to access services safely.

Reduce cyber disaster impact and recoveryoUsing certified components reduces the risks of security failures on thedevice as well as on the services that the device uses.

BENEFITS TO CONSUMERS•

Reduce the threats and the risks of fraud, leakages, flaws, etc.
o•Help the consumer to identify devices with the desired level of protection.
o•Consumer devices that integrate components providing certified security
capabilities are less prone to security problems and more resistantagainst attacks.
When certification of IoT devices becomes mainstream, implementing
labeling programs on devices will be an easy and friendly way to provide
security information to the consumer.

Trusted services and privacyoConsumers are willing to adopt digital services and digital technology, andtrust is a key component of this adoption. A consistent and trusted
methodology for evaluation, plus a recognized system of security labeling,
will enable consumers to expect that security on the devices they select isgiven, transparent, out of the box, and reliable.

www.globalplatform.org

25 / 27

Section 7:

CONCLUSIONThe Security Evaluation Standard for IoT Platforms (SESIP) is a methodology
designed for IoT that leverages the concepts of composition and reuse, allowing
developers to focus on their core job and to reduce the pain of security assessment.
This paper briefly discusses composition and reuse in the development andevaluation of IoT products, and outlines specific benefits of these approaches to avariety of stakeholders.
Benefits range from reduced cost, effort, and duration of evaluations – affecting all in
the IoT supply chain – to enhanced customer confidence in the security being offeredto them.
The composition approach multiplies these benefits as more and more components
are used in compounds that themselves become components in higher levelcompounds, and so on.
GlobalPlatform welcomes collaboration from the entire ecosystem. Interested parties
can download the methodology from https://globalplatform.org/sesip/ and contact
GlobalPlatform at secretariat@globalplatform.org to help the organization encourage
the expansion of security certification to a wider set of products, withoutcompromising the quality of evaluations.

www.globalplatform.org

26 / 27

Section 8:

TABLE OF FIGURES

Section 9:

TABLE OF TABLES

Copyright © 2022 GlobalPlatform, Inc. All Rights Reserved. Implementation of any
technology or specification referenced in this publication may be subject to third party
rights and/or the subject of the Intellectual Property Disclaimers found athttps://globalplatform.org/specifications/ip-disclaimers/.

www.globalplatform.org

27 / 27