Hi everyone, Ulises here for Microchip Technology! Welcome to "Ask Our Experts."
A series of videos where we answer some Frequently Asked Questions (FAQs) on a diverse set of topics.
Today's topic is on Secure Elements. To help answer our question
we welcome Todd Slack. Todd is a Technical Staff Engineer in our Secure Products group and is well
versed on this topic. So let's get started. Todd since 2019 we've seen a rise in Security
Standards and Regulations across the globe can you illustrate that landscape for our viewers?
Well, there's no shortage of activities around the globe as it relates to security
and specifications. We'll start off in the UK [United Kingdom] who has been influential for a
number of different IoT (Internet of Things) specs for example. They have introduced this notion of
Security by Design and the IoT Security Foundation released Thirteen(13) Principles in IoT Security
with Three(3) Core Principles. The first one being no default passwords, the second one is that you
have to have a vulnerability disclosure process or PSIRT is covered within Microchip Technology so
you can visit our PSIRT site. Which is Product Security Incident Response Team.
What that means is that if an outside source discovers a vulnerability you can submit
that to the PSIRT site. And then we have a team that will go through a review process
to verify what was submitted, determine whether or not it actually requires response,
and then we would move down the list if we feel that it does require
some response. Then we would also go through a process determining what level
of security vulnerability does this represent and then ultimately we could put together a report
that we would put out to our customer base and we can make that publicly available and or document
things directly with each individual customer who might be impacted by the vulnerability.
If you move from the UK to greater Europe you have EN303645
and that is basically a mirrored initiative to the documentation that the IoT Security
Foundation put together. You can actually see some identical language in each of those.
In the US we have NIST they're not quite as far along, but they have come up with this
initiative the IR 8259 which is starting to mandate that they go off and create some
similar specifications surrounding privacy and a lot of familiar activities.
As you move around the globe you see some activity in India, Korea. Australia has the
IoT Code of Practice and you'll see a number of similar sorts of requirements again you have no
default passwords, vulnerability assessments, you must be able to keep your software updated,
securely store credentials, and it goes on and on down the list.
Now beyond the standards, which are mostly Best Practices at this point, we do have some
legislation kicking in to make it required by law. So the UK is intending to make the first
Three Principles the Core Principles legislated in 2022 sometime. So coming up pretty soon.
In the US we have California and Oregon leading the charge on privacy requirements
which will also get driven into legislation and then the EU is sure to follow.
In short, there is no shortage of activity yet at least there's a lot of commonality for what we're
seeing across the globe so that you can have solutions like Secure Elements with our ECC608
and Trust Anchor. Where we have gone through the process of putting together an app note and a blog
that can show our customers exactly how those particular devices can support these initiatives.
Thanks, Todd good to see you again! For our viewers make sure to check out our Secure Elements
webpage linked in the description below. And don't forget to Subscribe to our YouTube Channel to be
the first to know when we have more insights from our experts. We'll see you next time!