Best Practices

Follow secure coding principles. While not specific to embedded applications, a good place to start is the general software security coding practices maintained by the Open Web Application Security Project.

Develop and maintain a secure architecture. Build security in. Make it a default, not an option. Identify, reduce and harden attack surfaces. Favor simplicity in design to reduce the attack surface area. Take care when handling open files to reduce attack surfaces.

Network services

Best practices for securing network services include the following specific measures:

System services

Secure system services. Enable the /dev/random service, and use it to provide a source of secure random data.

Private and public channels

If a channel doesn't need to be accessed by other processes, make it private to reduce the attack surface. Securing a channel keeps it private and reduces its vulnerability to attack.

File systems and mount points

Best practices for securing file systems and mount points include the following:

Users and authentication

If SSH is enabled, consider using public key authentication instead of username- and password-based authentication. Where possible, use rootless systems. (See Rootless Execution.)

Interprocess messaging

Best practices for interprocess messaging include the following:

Trusted execution

Best practices for trusted execution include the following:

Root privilege

Minimize the need to use and keep root privilege. Minimize all root processes. Ensure that only the most essential tasks are running as root. Where possible, have all processes running as non-root. (See Rootless Execution.)