>> Secured-Core is a certification program for servers and PC,
and it just got extended to
the IoT world with the Edge Secured-Core program.
Charles is here to tell us everything you need to know about
this new certification program to keep
your IoT and edge devices more Secure.
That's today on the IoT show.
[MUSIC]
>> Hi, everyone. Thanks for watching the IoT show.
I'm Olivia, your host,
and today I'm joined by Charles,
actually rejoins the IoT show to
discuss the vice certification. Charles, how are you?
>> I'm doing well. How are you?
>> I'm fantastic.
Good day here in Seattle.
You're in the area as well, right?
>> I am in the general Seattle area.
>> We'll talk about certification as a new program in
town that you want to give us some details about.
But before we jump into that specific one,
give us some details about yourself.
Who are you? What are you doing at Microsoft?
>> My name is Charles. I've been here at Microsoft for 15 years,
and what I currently work on is
our overall certification program for IoT and Light Edge devices.
>> Okay. We have different of these certification programs,
and we'll talk about this new one that you came to share about.
But before we go in there,
it's always interesting to remind people why from
both the hardware manufacturer perspective
as well as the customers perspective,
why having a certification program,
how important it is that?
>> I think certification programs are really important.
They provide a means for hardware manufacturers to help
promote their devices and show that
their devices have specific capabilities.
But then, more importantly, for the customer,
they make it a lot easier for those customers to find
those devices that have
those capabilities and features that they're looking for.
>> Because we have different types of devices out there,
like all the way from sensors to very bigger services,
type of Edge devices,
we have different types of certifications.
There's something called Secured-Core.
What is Secured-Core? What is that program?
>> Sure. Secured-Core is a certification program.
It launched a few years back and it was really focused on PCs.
The idea is that it would raise
the security posture for what was a Secured PC in the ecosystem.
Then over the last couple of years,
they've extended that PC program into the server space,
and then more recently, HCI.
>> Got it. That was mostly for what it would call traditional IT,
right? Not IoT specific.
>> That's right.
>> But now we have this thing called the Edge.
We're bringing more and more intelligence to the Edge,
having workloads that are trained in the CLOUD run
down there on these devices that are on the field,
in factory floor, in a retail shop, or things like that.
There's that new thing Edge Secured-Core.
Tell me a bit about this new program.
>> Yeah, so Edge Secured-Core,
it extends a couple of different certification programs
that Microsoft offers.
One of those is the Azure Certified Device Program,
which focuses on IoT and Edge devices.
But the other one is it extends a Secured Core label.
What we're doing here is we're extending
the Secured Core label into the IoT space,
which includes the light and heavy Edge devices.
>> Got it. What does that mean for customers as
in the ones implementing IoT solutions out there?
>> For customers, there's
thousands of device manufacturers in the ecosystem.
What it means for the customer is that we help make it easier for
customers to identify devices for their IoT solutions,
and this way know that these devices
will maintain its security posture
and help keep their infrastructure safe and secure.
>> But basically, if you go with that label,
you as a customer its safe that a certain number of
things are guaranteed by
the hardware manufacturer and Microsoft at the same time, right?
>> That's right. They know that
those devices have the ability to meet a certain configuration,
and that they can maintain those configurations.
>> Okay. Let's talk about the configuration.
Let's talk about what are the key principles that make
these devices comply or abide by this new certification.
>> The Secured-Core principles that we've snap
this program around really focus on
hardware based device identity being
capable of enforcing system integrity,
providing protection for data when it's at
rest and while it's in transit firmware,
hardening, vulnerability detection, and renewable security.
Digging into each one of those a little bit.
When we think of like hardware based device identity,
what we're really thinking about is,
things like TPM 2.0, but then,
digging in a little further,
we think of, how do we enforce system integrity?
What we've done there is,
developed requirements around DMA,
memory protection, firmware protection,
things like secured boot and you
boot and even areas like network services.
Where we're making sure that services that have the ability
to talk on the network are not running under elevated privileges.
Then beyond that, when we
think of firmware hardening and vulnerability detection,
we're actively doing firmware scanning of the device to make
sure that the firmware has been configured in a secured posture.
Then vulnerability section really
comes into play through things like Azure Defender,
where we have the ability
to detect vulnerabilities and respond to those vulnerabilities.
Lastly, when we think of renewable security,
what we're thinking about is the device to be
remotely manageable and then be
able to respond to
vulnerabilities and to be able to deploy updates.
That way, the device lands secured,
but then it also stays secured over its lifecycle.
>> I like that. You mentioned Azure Defender,
and there is that extension
to Azure Defender called Azure Defender for IoT,
which is very much focused on IoT.
I guess this is the one thing that
the devices need to be connected to or working with, right?
>> That's right. This is Azure defender for IoT. Yeah.
>> We're talking about IoT, so we're talking about devices.
Here we're seeing that there are some of
these principles that are related
to the hardware are the ones to the software.
At the end of the day, what is certified?
Is it the software?
Is it the hardware?
Is it a combination of both?
>> It's really a combination of all of them.
It's really a combination of hardware requirements,
and software requirements,
and OS requirements,
all wrapped up together.
>> Got it. Because there's this notion of renewable security,
that means there's a commitment from those
the hardware manufacturer and I guess
Microsoft to push updates and maintain these packages,
this configuration, at level in terms of security.
>> That's right. We have policy requirements
that the OEM attest to where,
they make sure that they can continue
to produce and respond to vulnerabilities,
so that this way that the device stays secure.
>> Nice. We're going to point people to resources,
but just in a nutshell,
what is the process looking like for
a hotter manufacturer who wants to certify their devices?
>> For a hardware manufacturer that wants to certify the devices,
it really starts with digging into the requirements.
Making sure that they have hardware
that supports the requirements,
making sure that they can produce
an OS image that also supports the requirements.
Then from there, it's fairly easy.
They start with our Azure Certified Device submission portal,
and they connect the device.
They walk through the submission process and it typically takes
three to five days and we can have
the device certified and published on the catalog.
>> Nice, and easy, I would say.
>> Yeah.
>> But for customers, how does it look like?
How can they navigate through a catalog or
how do they find certified devices?
>> For all of our certified devices,
we have published on our Device Catalogue
at devicecatalog.azure.com.
For customers, we try to make it very
easy and that they can simply go to our catalog,
select the filter for Edge Secured-Core,
and will present them with a list of
devices from various manufacturers who have certified
>> Nice. This is same catalog where you can
find devices certified for plug and play,
or just for connecting to Azure IoT.
Nice like that, just the new filter.
Great, Charles, so you have a couple of resources,
where can people learn more about the program?
>> Sure. If you want to learn more about
the value that the Edge Secured-Core and Azure
certified device bring,
you can start with aka.ms/certhome.
If you're an OEM or device builder and you
want to learn more about how to certify your device,
and bring it into our vast ecosystem,
you can go to aka.ms/certlearnmore.
>> Awesome. Pretty straightforward,
certlearnhome and certlearnmore.
Charles nice introduction to the program,
everyone thanks for watching the IoT show today,
I hope to see you soon again,
and we'll have a great one.
Bye.
[MUSIC]