New Technical Guide: A Methodology for Selecting Security Components

We are pleased to share the publication of a new technical guide (STIG) providing a complete methodology for selecting, integrating, and auditing hardware security building blocks such as SE, TPM, TEE, and HSE in embedded products.

The guide has a twofold objective: reduce technical risk related to cloning, key extraction, boot compromise, and application fraud, while demonstrating compliance with applicable security frameworks. Each chapter links technical choices to threats observed in the state of the art, such as side channels, fault injection, micro-architectural attacks, and supply-chain attacks, then maps the resulting controls to recognized standards and guides.

It applies to consumer products as well as industrial and critical environments, with the assurance level adapted accordingly, for example EAL, FIPS, or IEC 62443.

Threat Assumptions

The guide takes into account a broad range of attacker profiles:

• an opportunistic attacker with local access to the product
• an experienced attacker with laboratory-grade equipment
• a supply-chain attacker using modified firmware, cloned components, or compromised CI/CD
• a remote attacker exploiting software or protocol vulnerabilities

Guide Objectives

The guide addresses the full product life cycle, from design and industrialization to deployment, operation, and maintenance, and aims to:

• provide selection criteria for hardware security building blocks adapted to the target threat model
• define provisioning, personalization, and testing practices for industrialization
• specify identity, enrollment, and commissioning practices for deployment
• describe monitoring, key rotation, and incident response practices for operation, along with secure update and decommissioning for maintenance

This life-cycle approach is aligned with the security requirements of NIST and European frameworks, and addresses low-power, long-lifetime architectures exposed to the Harvest Now, Decrypt Later risk for long-lived data.

Download the Guide

English version: Download Technical Guide (PDF)

French version: Télécharger le guide technique (PDF)

The document is published under a Free License.