IoT, Embedded and Hardware Security
Physical Access Risk Analysis
We assess which data and systems someone who can open the device could access from its casing and board.
What it is
Many field devices operate in locations where an attacker can physically access them. The analysis examines what someone who opens the device could obtain from the board. It evaluates the casing's protection against opening, the data accessible on the board, and whether information from one device reaches other systems. This work completes the attack surface analysis from the physical perspective.
Scope
- Evaluation of the casing's protection against opening and tampering
- Identification of data and keys accessible from the board
- Whether information obtained from the device reaches the cloud or other devices
- Examination of tamper-evident design
- Assessment of the impact of a single device compromise on the entire fleet
The need
When organizations need it
- When your device will be used in open or customer environments where it is easily accessible.
- Before valuable devices such as meters, payment terminals, or kiosks are deployed.
- When asked about the risks posed by a stolen or lost device.
Method
How we work
-
Assessment
We open the device and identify the data and interfaces accessible from the board.
-
Propagation
We track whether the obtained information reaches other systems or devices.
-
Recommendation
We list the design and configuration steps that reduce physical risks.
Outcome
What you have at the end
You clearly see which data and systems someone with the device could access. Design recommendations to reduce physical risk are listed.
Frequently asked questions
Does every device require physical security?
It depends on the risk. For a device in a controlled environment, the priority is low. For a valuable device in the open, physical access is the main risk.
Is this different from other hardware analysis?
Debug interface analysis focuses on specific interfaces. Physical access analysis evaluates what someone with the device could obtain as a whole.
IoT, Embedded and Hardware Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting