Virtualization Technology News and Information
Article
RSS
MITRE Releases EMB3D - A Cybersecurity Threat Model for Embedded Devices

The EMB3D Threat Model is now publicly available at https://emb3d.mitre.org. The model provides a cultivated knowledge base of cyber threats to embedded devices, offering a common understanding of these threats with the security mechanisms required to mitigate them. The model is the result of a collaborative effort by MITRE, Niyo Little Thunder Pearson, Red Balloon Security, and Narf Industries

EMB3D model strengthened by peer reviews from infrastructure industries

After the model garnered significant interest for peer review across diverse industries, numerous organizations piloted the threat model. The EMB3D team appreciates the interest and feedback from vendors and integrators across many industries, including energy, water, manufacturing, aerospace, health, and automotive, as well as researchers and threat tool vendors. This ongoing collaborative effort has been instrumental in refining and enhancing the model's content and usability. The team looks forward to continued collaboration to strengthen the ability of the model to enable "secure by design."

"Our framework's strength lies in the collaborative efforts and rigorous review process across industries," said Yosry Barsoum, vice president and director, Center for Securing the Homeland at MITRE. "The diverse perspectives and invaluable insights shared have fortified our approach, ensuring a robust and effective solution to address the evolving challenges in embedded device security."

Leveraging established models to strengthen embedded device security

EMB3D aligns with and expands on several existing models, including Common Weakness Enumeration, MITRE ATT&CK, and Common Vulnerabilities and Exposures, but with a specific embedded-device focus. The threats defined within EMB3D are based on observation of use by threat actors, proof-of-concept and theoretical/conceptual security research publications, and device vulnerability and weakness reports. These threats are mapped to device properties to help users develop and tailor accurate threat models for specific embedded devices. EMB3D suggests technical mechanisms that vendors should build into devices to mitigate each given threat. EMB3D is a comprehensive framework for the entire security ecosystem-device vendors, asset owners, security researchers, and testing organizations.

An evolving framework for a dynamic threat landscape

EMB3D is intended to be a living framework, where new threats and mitigations are added and updated as new threat actors emerge and security researchers discover new categories of vulnerabilities, threats, and security defenses. EMB3D is a public, community resource where all information is openly available and the security community can submit additions and revisions.

Published Tuesday, May 14, 2024 11:55 AM by David Marshall
Filed under:
Comments
There are no comments for this post.
To post a comment, you must be a registered user. Registration is free and easy! Sign up now!
Calendar
<May 2024>
SuMoTuWeThFrSa
2829301234
567891011
12131415161718
19202122232425
2627282930311
2345678