Build Your Device Security Lab: From Threats to Test Capabilities

As embedded systems become more capable and interconnected, they are also processing and protecting increasingly valuable information. Cryptographic keys, payment credentials, intellectual property, authentication data, and other sensitive assets may all depend on security mechanisms implemented directly in hardware. This makes the silicon inside modern devices an increasingly important target for attackers — and means that security testing can no longer focus exclusively on software. The webinar Build Your Device Security Lab: From Threats to Test Capabilities examines why physical attacks matter and how organizations can develop the internal capabilities needed to evaluate them.

Presented by Bartek Gedrojc, Ph.D., who has more than 15 years of experience in device security testing, the session begins by exploring the idea of silicon as a new security battlefield. Embedded systems are used across industries such as automotive, semiconductors, payments, aerospace, IoT, government, and consumer electronics. Although the applications differ, many of these products rely on similar hardware security mechanisms, including cryptographic implementations, secure boot processes, protected memory, and hardware-backed authentication. When these mechanisms are targeted through physical attacks, weaknesses that may not be visible through conventional software testing can be exposed.

Two of the most important disciplines in physical device security testing are Side-Channel Analysis and Fault Injection. Side-Channel Analysis evaluates information that a device unintentionally reveals while performing sensitive operations. Measurements of power consumption, electromagnetic emissions, or timing behavior may provide insight into internal calculations and, in some cases, expose sensitive information such as cryptographic keys. The purpose of testing is to determine whether this leakage exists, understand its source, and verify that appropriate countermeasures are effective.

Fault Injection approaches the device from a different direction. Instead of observing its physical behavior, the tester deliberately introduces a controlled disturbance while the device is operating. Techniques may include voltage or clock glitching, electromagnetic pulses, or laser-based injection. These disturbances can cause unexpected behavior, such as corrupted calculations, skipped instructions, or failed security checks. By reproducing these conditions in a controlled laboratory environment, teams can assess whether critical operations remain secure when the hardware is intentionally manipulated.

The webinar explains that a Device Security Test Lab provides organizations with a dedicated environment for investigating these risks. Rather than relying only on an evaluation at the end of development, teams can test products earlier, repeat experiments, evaluate design decisions, and verify security countermeasures throughout the product lifecycle. An internal capability can support several objectives, including certification preparation, internal validation, product-risk assessment, vulnerability research, and the development of more resilient products.

However, there is no single laboratory configuration that is suitable for every organization. The right setup depends on the types of devices being evaluated, the threats being considered, the expected frequency of testing, available expertise, and budget. A team preparing one product for a particular certification may need a focused set of capabilities. A central security team supporting several product groups may require a broader and more flexible environment. Defining the purpose of the lab before selecting equipment helps ensure that the investment is aligned with actual testing requirements.

A clear testing strategy should begin by identifying the assets that need protection and the realistic attack scenarios that could threaten them. These priorities can then be translated into specific laboratory capabilities. A team primarily concerned with cryptographic leakage may initially focus on power or electromagnetic Side-Channel Analysis. A team evaluating secure boot, authentication, or access-control mechanisms may prioritize Fault Injection. Organizations with wider security responsibilities may combine several techniques and expand their capabilities gradually. Modern modular test environments can support this progression, allowing teams to begin with power-based testing before adding electromagnetic, optical, or other advanced capabilities.

Selecting equipment is only one part of building an effective lab. Organizations must also consider test workflows, software, automation, suitable test targets, documentation, and personnel. Results need to be repeatable and interpretable so that findings can be communicated to developers, product owners, risk teams, and certification stakeholders. Training is therefore an important part of capability development, particularly as teams move from introductory testing toward more advanced analysis and real-world attack scenarios.

The final part of the session considers how a laboratory can scale over time. Growth does not simply mean purchasing more equipment. It can also involve improving automation, standardizing procedures, training additional users, supporting more device types, and integrating security testing more closely with product-development processes. A focused initial setup can therefore become the foundation for a broader organizational capability as products, threats, regulations, and internal security goals evolve.

Overall, the webinar provides both strategic context and practical guidance. Viewers will gain a clearer understanding of why Side-Channel Analysis and Fault Injection are relevant across industries, what problems a Device Security Test Lab can help solve, and how to define a setup based on budget, usage, and expertise. Its central message is that physical device security testing should not be treated only as a final checkpoint. When developed as a scalable internal capability, it can provide greater visibility into hardware-level risk and support more informed security decisions across the entire product lifecycle.

Learn more here: https://www.keysight.com/zz/en/cmp/build-your-device-security-test-lab.html