I am working on a commercial device (custom hardware with firmware and embedded software) that includes a Linux OS and will run in an unsecured network environment connected via Ethernet. It will be vulnerable to various attacks. We have performed a security risk assessment and scored risks.
I'm interested in controls for limiting access to the device which cover these two main scenarios.
1) My company sends service technicians to upload software, retrieve logs, and troubleshoot problems. The servicing is performed infrequently (e.g. once a year) using software that my company controls. The software is not updated very frequently e.g. once a year. The software runs an individual laptop. The security is limited somewhat whereby if the laptop is stolen and credentials are obtained then the access is compromised.
2) There is a need for a very small number of third-party applications (e.g. less than 10) to interface in read-only manner to retrieve data from the device to enable business integration.
The approach I'm considering is with client certificates where the device is the server and the software apps in (1) and (2) are the clients. This takes me down the path of whether to go with an internal CA or a private root and intermediate CA. This raises some questions such as:
- How many unique certificates to issue
- Expiry times of the certificates
- Using Certificate Revocation Lists (CRL)
The question I have is whether there is an alternative approach to using client certificates which solves (1) and (2)?