Oflate there has been a lot of interest in Microcontroller community about security with ARM TrustZone for MCUs. TrustZone is deemed to protect MCUs against software attacks. My question is what are the ways a malicious code can even enter an MCU?
I apologize that I am answering this from a little bit of a vague higher level, since I'm not as familiar with the specific attacks that are made against embedded systems.
Commercial Applications for TrustZone
In my comments on the question, I've linked some news articles about Router manufacturers needing to have a trusted environment to run WiFi radio firmware, separate from untrusted code (ie. DD-WRT) to comply with an FCC ruling that manufacturers must put security measures into place to prevent consumers from boosting their 5GHz signals to levels that cause interference outside their rated levels.
This demonstrates a type of attack where a user is intentionally loading code that is not trusted by the manufacturer. This type of crafted software update could be relatively benign (depending on your perspective), or it could be malicious code.
Having a trusted code layer, like ARM TrustZone provides, can also be used as a secure bootloader. To illustrate the purpose of such a system, it helps to understand that a program cannot verify it's own integrity. If one were to check digital signatures, an attacker could just modify the signature that the program was checking against. With a secure loader, you can be assured that the verification process has not been tampered with, and thus can be used to prevent an application that has not been signed (or has been signed with an invalid key), from loading.
The same technique could be used to validate software updates before installation, preventing malicious firmware installation.
How to make MCU secured? - Write program and lock program memory from reading externally.
How to make MCU firmware Trustful?
Probably having a root key, with now access form outside. It can be a part of your code. Implement authentication when interacting with other devices, use derivation keys. Implement versioning, to deny working with outdated devices. Implement secured update. Also MCU can work with external memory, so this memory can be vulnerably for mounting attacks. All this is not TrustZone (c) ARM CPU, but how we can make MCU based more secured.