1. Secure the development environment: The platform and tools used to build the device must be secure, which means having a secure software factory and infrastructure.
2. Secure the device: Security features built into the hardware and operating systems are utilized and enacted. Additional security features, such as kernel hardening and secure boot, may be required.
3. Secure the applications: The applications that run on embedded devices can be vulnerable and present a targeted attack surface.
4. Secure the data: The intelligent embedded systems deploying today generate an enormous amount of data. This data, whether at rest or in motion, must be secured.
5. Engage in ongoing security monitoring: Every deployed embedded device is a potential attack surface. This threat increases exponentially as more and more devices connect to other devices and networks. Continuous monitoring for common vulnerabilities and exposures (CVEs), as well as software updates to fix them, are required to keep devices current and up to date with the latest security patches.

Industry and Government Certifications

Many embedded systems require meeting strict guidelines and certifications for safety before they can deploy. Certification requirements can be defined by an industry as well as by a government agency. They can also vary greatly by geographical region.

Many industry-specific certifications can help device manufacturers achieve higher levels of standards. Companies building embedded systems for industrial applications, for example, utilize the expertise of TÜV SÜD, the Technical Inspection Association, to test, inspect, and certify products. Following the TÜV certification process helps ensure that devices comply with safety regulations and quality criteria based on international standards. Companies routinely verify their products to ensure that they are fit for use in the safety environment in which they will deploy.

An example of a government agency that regulates and monitors medical devices is the U.S. Food and Drug Administration, also known as the FDA. The FDA regulates and monitors medical devices to ensure that they comply with applicable standards for operation and safety.

Access to OS source code is an important element for building embedded systems software. Developers need source code to fully understand how the operating system functions. The source code allows developers to configure, build, and compile the operating system based on their project requirements.

Not all embedded designs require access to the source code. Many developers use pre-built binaries of the operating system. Binaries have already been compiled and cannot be modified.

A new trend in embedded software development is containerization. Containers package OS libraries and runtime dependencies into a lightweight executable. Container-based software can run consistently on most operating systems. Both VxWorks and Wind River Linux support the open container initiative (OCI).

Embedded system software can be required to be standards compliant and adhere to a company’s license compliance policies before it can be commercially deployed. Often an embedded system will be described as being based on industry standards. This means the software adheres to the rules of a well-defined public standard. Software can also be required to be compliant with companies’ software licensing policies. License compliance means the software used for an embedded device includes accurate documentation and proof of licensing agreements, and those license agreements do not contain conditions that violate the policies or practices of the companies using the software. Many embedded developers utilize open source or freely available software for their designs. That software can be anything from a big and complex operating system to a small script. License compliance ensures that copyrighted components are documents and are properly addressed.

Recently, commercial software providers for embedded systems have started to provide a software bill of materials (SBOM). The SBOM lists all the software components, both proprietary and open source. Providing a list of all the components with specific versions allows a software developer to easily locate a problem area when defects are found. The SBOM serves as a supply chain management function for software.

Embedded systems are built to stand the test of time. It is not uncommon for embedded devices have deployment lifecycles of 5–20 years in the field. Throughout the lifecycle, software can require long-term support and maintenance to ensure that continuous improvements are made to the system. Software updates provide new features, firmware updates, fixes to critical bugs, and security updates. Today, many updates to software can be made over the air (OTA) versus via a human physically updating every device.

Developers are dependent on the different programming languages supported by the operating system. Embedded developers traditionally have used C and C++ programming languages. The Linux operating system and some commercial RTOS solutions support a wide variety of programming languages including C, C++17, Ada, Rust, and Python. Embedded systems have also expanded support for different compilers, libraries, and open source tools. Adopting a modern development approach allows greater efficiency and portability. It also provides frameworks to accommodate new requirements for artificial intelligence (AI) and machine learning (ML) (VxWorks supports all of these, as seen in the sidebar).