Advantech : Dedicated Solutions Needed for Info Security on Embedded Systems

Eric Liu, Taipei; Willis Ke, DIGITIMES [Thursday, 22 June 2017]

While in early years embedded systems were mainly applied in enclosed and independent operating environments, the interoperability of devices achieved through wireless and wired connections, ensuing from the advent of the IoT (Internet of Things), has triggered a new wave of IoT-related information security problems that are hard to tackle with old anti-virus software packages. Now, only by adopting dedicated solutions for embedded systems can enterprises improve information security.

Lin Chi-wen, a senior manager at Advantech's embedded IoT group, noted that in the Big Data era, all the aspects such as equipment activation, data access, and data transmission should be subject to tight security protection. Lin added that any loophole in any aspect is very likely to cause leakage of sensitive information.

Digital Signature Verification before System Activation

Wang Po-chih, another senior manager, explained how protection starts with the BIOS. He said the BIOS should first undergo a Security Boot mechanism that requires all equipment hardware and software programs to pass an encrypted digital signature verification procedure before an equipment system is activated. Only licensed hardware devices and software programs should be allowed to operate on the equipment system, thus preventing embedded devices from being 'case open' for hardware replacements that could carry harmful software and/or firmware, or for undesirable BIOS updates, according to Wang.

Electronic gaming machines (EGM) are an example of such applications. The gaming industry gives top priority to fairness and trustworthiness, using computing programs to achieve consistent gaming results that can match natural probability and norms. If the machine is open to unauthorized hardware, the computing of the games is likely to be affected, Wang continued.

Normally, screws or mechanical fasteners are rarely visible on the outside of gaming machines, so that they cannot be easily (and illegally) opened. To prevent perpetrators from forcibly opening the machines and tampering with the Security Boot, Advantech has developed machines that are available with two Boot Guard modes that allow the system activation mechanism to verify BIOS, hardware, software, and programming codes to make sure that they are legally licensed. In case any irregularity is found, the activation system will immediately stop, and the irregularity may also be recorded on a Trusted Platform Module (TPM) and processed by the operating system.

The same Boot Guard technology can be applied to improve security on military electronic devices. Such devices usually store many military secrets, and if captured, there is a risk of enemies gaining access to the secrets. With this new technology, the storage devices can be locked with encryption, and stored confidential data can also be instantly destroyed in the event of an emergency.

Whitelist Antivirus Software Prevents Illegal Access

After a system is safely activated, information security loopholes are sometimes exposed, with entryways via various forms of resources and data access control mechanisms. To counter this, Advantech's embedded systems are outfitted with McAfee's whitelist antivirus software and Acronis True Image, which is backup and recovery software. These measures block viruses and can recover data after attack, respectively, according to Chiang Hua-chih, a product manager at the firm's embedded IoT group.

Usually, traditional antivirus technologies focus on the blacklist mode, mainly designed to counter blacklisted viruses that have already been identified. But the most dangerous security threats come from newly-created viruses that have yet to be recorded. To defeat these, the whitelist mode can be applied to rule out zero-day attack by as yet unidentified viruses. This means that obtaining licensed software programs for system execution can help to prevent malware invasions.

As no one in charge of networking operations can afford big losses resulting from virus attacks, Advantech's embedded computer systems are fitted with WISE-PaaS/RMM and integrated with Acronis software packages to provide end-users with an additional data security mechanisms. Users can set automatic backup time in accordance with their needs and system resources, with all the hard disk data, including operating system, application software, files, production parameters and system recording files, fully covered in the backup copy. If the systems ever are subject to virus attack, the backup copy can help to restore the original setups.

Now at production plants, most computers are connected to internal networks. Another potential source of threat comes from the USB drives carried by employees. Whitelist antivirus software can be applied to allow access only by licensed programs and hardware, and deny access to unlicensed ones.

ATM Solutions: Blocking Digital Heisters

An ATM heist case occurred in Taiwan in July 2016, though the attacked machines had adopted enclosed network architecture and used encrypted data transmission. To facilitate management of ATMs spreading around the island, banks usually conduct remote maintenance and updates on the machines directly through computer networks, generating another latent information security loophole.

Chiang suggested that ATMs adopt both whitelist and blacklist antivirus technologies to complement each other, building a powerful firewall against identified viruses with the blacklist while barring all unidentified applications with the whitelist.

In line with wide range of banking business operations, the McAfee Change Control software should be incorporated into information security solutions to set up policy norms governing updates of authorized lists, prevent whitelists from being falsified, and monitor the consistency of system compliance of files. Meanwhile, the ePolicy Orchestrator (ePO) software for remote control and central management should be employed to enable system managers to manage ATMs, update programs and conduct setups through computer networks at the central management or monitoring centers.