Panel

Live Q&A & Panel Discussion - Security & Safety Track

Watch Now

52:23

EOC 2025

Watch this session

This EOC 2025 session is in the archives. It is included in the EOC 2026 + Archives pass, with all 504 sessions since 2020.

Passes bought now also include the upcoming EOC 2027 + archives until December 31, 2027.

Get your pass · $395

30-day money-back guarantee

Not ready yet? Create a free account and watch 128 free sessions.

Panel

Live Q&A & Panel Discussion - Security & Safety Track

52:23 EOC 2025

Live Q&A & Panel Discussion - Security & Safety Track

52:23

Watch this session This EOC 2025 session is in the archives. It is included in the EOC 2026 + Archives pass, with all 504 sessions since 2020. Passes bought now also include the upcoming EOC 2027 + archives until December 31, 2027.

Get your pass · $395

Live Q&A and Panel Discussion with speakers presenting in the Security & Safety track.

1 / 5

Please log in or create an account to test your knowledge and see the answers.

Why did the panel repeatedly emphasize addressing security and safety early in the development cycle?

A Because regulatory requirements (e.g., FDA) and risk management make early consideration necessary for market access and to avoid costly rework.

B Because waiting until the end lets you design the product faster and then add security as a bolt-on without affecting schedules.

C Because security is only important for internet-connected devices and can be ignored for isolated hardware.

D Because only the legal team needs to sign off on security, so engineering can defer it until compliance paperwork is due.

E Because implementing security late is better — you can design features first and then choose the cheapest security to fit them.

When building an embedded Linux–based product, what approach did the panel recommend for implementing security?

A Use established kernel and community mechanisms (e.g., Linux Security Modules, standard chain of trust) and follow community standards instead of inventing your own.

B Write a custom security stack from scratch because standard Linux features are too generic and slow.

C Rely on obscurity (change ports and custom protocols) as your primary protection strategy.

D Trust the monolithic Linux kernel alone to be fully secure without splitting sensitive functionality into smaller trusted components.

E Avoid using vendor-provided root-of-trust mechanisms and implement your own proprietary boot verification.

Who should be responsible for cybersecurity activities in a company that produces physical electronic products, according to the panel?

A Security should be a cultural, multidisciplinary responsibility across the organization with a dedicated team or a specialist defining requirements — everyone participates.

B Only the embedded developers should be responsible since they write the firmware.

C Only the legal or compliance team should handle security because it is mainly regulatory paperwork.

D Outsourcing all security responsibility to an external vendor absolves the company from internal involvement.

E The CEO alone should be responsible since security is a strategic business decision.

A device uses USB, Bluetooth, and NFC with a proprietary protocol and is never connected to the internet. What did the panel recommend as the appropriate security stance?

A Perform threat modeling and assume attackers could use physical access or wireless interfaces; analyze the stack and protect sensitive data — lack of internet doesn't mean safe.

B No security is needed because the device is never on the Internet and uses a proprietary protocol.

C Rely entirely on the proprietary protocol as security — proprietary means attackers can't understand it.

D Only worry about security if the device will later be connected to Wi‑Fi or the Internet.

E Disable Bluetooth and NFC and that alone makes the device fully secure without further analysis.

Which testing approach did the panel recommend to evaluate how secure an embedded system actually is?

A Use a mix of practical checklists (lock JTAG, close unnecessary ports, configure firewall, secure boot), automated scans (static analysis, CVE scanning), and reconnaissance tools (nmap, Wireshark) — then triage findings.

B Only perform a single manual penetration test after product release; that alone is sufficient to validate security.

C Rely exclusively on decompiling binaries with a disassembler as the only testing method.

D Skip automated scanning and only do informal review meetings because tools produce too many false positives.

E Test security only by connecting the device to the Internet and seeing if attackers immediately break it.

Formatting help

italics	surround text with asterisks
bold	surround text with two asterisks
hyperlink	[hyperlink](https://example.com) or just a bare URL
inline code	surround text with single `backticks`
code block (multi-line)	wrap on its own lines with three backticks: ``` your code here ```
~~strikethrough~~	surround text with ~~two tilde characters~~
quote	prefix with >

Upvotes Newest Oldest

No comments or questions yet. Be the first to start the conversation!

Partners & Sponsors

CodeSecure

atym

embedd.it

IAR

Become a Sponsor