Firmware security
We assess device firmware, its components and update mechanisms, examining outdated libraries, embedded secrets and the risk of unauthorised changes.
01 / ASSESSMENT
Firmware is a device’s embedded software. Examine components, outdated libraries, stored secrets, update mechanisms and diagnostic interfaces. Supplement static analysis with isolated lab testing where needed; define device and production boundaries separately.
PRACTICAL SCENARIOS / TTP
TTPs are an adversary’s tactics, techniques and procedures. We analyse these approaches and select scenarios for your environment and the scope agreed in writing, connecting each assessment result to practical defensive guidance.
Inventory firmware filesystems, libraries, configuration and certificates. Assess outdated components, shared passwords and embedded keys. Judge each finding in the context of the device’s purpose and realistic access conditions.
Assess update origin, signature validation and rollback to vulnerable versions. Review how Secure Boot relates to the update mechanism. Explain the risk of unauthorised changes to device software.
Assess UART/JTAG service interfaces, local services and management APIs on an agreed device sample. Where feasible, validate static findings through emulation or isolated lab work. Document physical-access requirements, limitations and manufacturer remediation.
02 / OUTCOMES
Work proceeds under the system owner’s written authorisation, a contract and a confidentiality agreement. Assets, methods, timing, stop conditions and data handling are defined before work begins.
Send your requirements through CyberTrust. We will clarify asset count, assessment depth and expected outcomes with you, then set out timing and pricing in the proposal.