#008 - Are Embedded Manufacturers Ready for New IoT Security Compliance Demands with Francois Baldassari

The Embedded Frontier

In this episode, Jacob Beningo interviews François Baldassari, Memfault CEO, about IoT security compliance demands. They discuss embedded manufacturers' readiness for new security regulations, the challenges they face, and potential solutions.
They also explore the differences between the EU's Cyber Resilience Act and the US's Cyber Trust Mark. François emphasizes the importance of OTA updates, using open-source software, and building security teams within hardware companies. He also highlights the need for collecting the right data and observability to improve security posture.
Takeaways

• Embedded manufacturers are not fully ready for new IoT security compliance demands.
• Regulatory frameworks like the EU's Cyber Resilience Act and the US's Cyber Trust Mark are coming into effect and will require certification of cybersecurity guidelines.
• Challenges include the uncertainty of the regulations, the additional costs and effort required, and the lack of established infrastructure and best practices.
• Recommendations for compliance include implementing OTA updates, using open-source software, adopting SBOM scanning, and ensuring observability of devices.
• AI is not currently a solution for compliance, but it may play a role in the future as more data is collected and analyzed.
• Joining the conversation around open-source products and following security best practices can help improve device security.

Chapter

1. Introduction and Background (00:00:00)

2. IoT Security Compliance Demands (00:04:42)

3. Challenges and Readiness of Embedded Manufacturers (00:08:04)

4. Recommendations for Compliance (00:11:24)

5. The Role of OTA Updates and Open-Source Software (00:19:35)

6. Building Security Teams and Ensuring Observability (00:23:28)

7. Differences Between EU and US Regulations (00:28:46)

8. The Potential Role of AI in Future Compliance (00:35:20)