Identify best pratices regarding cyber security

[emiltin]

Find 3-5 good sources that describe best practices that relate to our work with RSMP.
Document them so we can always refer to them.

[RazeAntoine]

A good start ?
OWASP TOP 10 2025 (more oriented web app but not that bad)
OWASP TOP 10 IOT (IOT focused but 2018)

This need a bit of work to extract accurate information that relate closely to RSMP.

[emiltin]

Not a best practice as such, but a great project and inspiration for how to deal with security and certificates on remote (embedded) decvices: NervesHub 2.0.0 was just released and some of the changes include:

• Easier onboarding of devices via Shared Secret
• Secure device authentication via device certificates & NervesKey
• Secure, signed and authenticated firmware delivery

https://www.nerves-hub.org

[emiltin]

For RSMP 4:
MQTT security fundamentals (from Hive MQ): https://www.hivemq.com/mqtt/mqtt-security-fundamentals/
MQTT over QUIC (from EMQX): https://emqx.medium.com/quic-protocol-the-features-use-cases-and-impact-for-iot-iov-10f27441ebe

[emiltin]

https://www.linkedin.com/pulse/top-5-best-practices-ensuring-security-embedded-2samf/
https://lembergsolutions.com/blog/strategies-ensure-embedded-system-security

OTA (over-the-air updates) is mentioned as a best-practice.