Extending Security to Resource Constrained Devices
summary
Zephyr RTOS aims to bring audited security to constrained devices, started five years ago and now supporting RISC‑V 32/64 with over 250+ boards (about 8 RISC‑V entries). Project runs a biweekly security committee, issues releases every four months and an LTS every two years, and operates a CVE/PCERT process. A recent bulk report found 26 issues that were fixed and backported; embargo policy is 30 days for fixes plus 60 days for vendors.
AI-written summary · about
chapters (10)
- 0:00Introduction to embedded security
- 0:22Zephyr RTOS overview
- 1:47Zephyr architecture and features
- 3:10Long-term support and security
- 3:52Security committee and practices
- 5:17Vulnerability handling process
- 7:24Transparency and documentation
- 7:46Response to AMNESIA:33
- 8:48Conclusion and recommendations
- 10:03Q&A session
related talks
40mZephyr Project Security Status
05mZephyr
23mKeynote: Zephyr & IoT Security
40mThe Zephyr Project Security Overview, Progress, and Status
40mZephyr: Evolving To CRA Readiness
29mLessons Learned on Following Security Best Practices in Zephyr
43mZephyr Project: Results from Applying Open Source and Security Best Practices
46mInsights from Zephyr Security Audit and Vulnerability Experiences