Is your product market-ready?

Analyze your security maturity with ProSecCo

ProSecCo is a maturity model to evaluate the security and compliance of IoT products.

With ProSecCo, manufacturers can understand what they do well, highlight their gaps and identify possible improvements.

This version is free and contains a restricted number of answers and functionalities compared to our Premium version.

Maturity level

The maturity level depends on the 6 pilars of ProSecCo. This maturity can be compared with a target profile for Consumer IoT, Advanced IoT or Medical IoT.

Profile:

Try ProSecCo

Governance

Understanding and managing product cyber security at every stage of the product lifecycle.

Secure Development

Following security-by-design principles throughout the product development process.

Secure architecture

System architecture

The team reuses existing security principles to design the system architecture The team identifies existing cyber security requirements to protect the system architecture The team integrates additionnal cyber security requirements to protect the system architecture against identified cyber risks The team can change the system architecture to remediate cyber security risks Not done

Application security (including Cloud)

The team relies on proven solutions (libraries, dependencies, configurations) to secure their application The team regularly verifies the security of their application/Cloud throughout the development lifecycle The team follows a secure development lifecycle The team uses state of the art application security (memory-safe languages, ligthweight cryptography) Not done

Secure coding

The team follows secure coding practices The team verifies that the product source code has no known vulnerabilities The team relies on third-party expertise for application security The team verifies the applicability of new attacks or new vulnerabilities in their code Not done

Data protection

The team identifies all data flows The team identifies cyber security measures to protect data flows according to their criticity The team ensures that only authorized users can collect, process, access data The team minimizes data collection Not done

Product Design

Implementing the pre-requisites to product security.

Core product (HW/SW)

Hardware

The team selects hardware components based on their cyber security features (example: hardware accelerator) The team identifies cyber security requirements to secure the hardware against identified risks The team uses verified or certified secure hardware (for example: PSA-certified) The team can change the architecture to ensure hardware security requirements are in place Not done

Unique device identity

The team has defined identity requirements for devices The team secures the identity of devices (cannot be spoofed) The team ensures that device identity is verified / certified using a trust chain The team implements dynamic identity for devices (Trusted IoT) Not done

Cryptography

The team reuses of proven cryptographic components appropriately The team ensures that cryptographic components are implemented securely The team relies on hardware-supported cryptographic schemes (e.g. use of hardware functions) The team considers the impact of cryptography on the final product use-case (e.g. slowdown, impact on battery) Not done

Post-market security

Default configuration

The product team implements a secure-by-default baseline configuration The product team reuses the secure baseline from the product category profile The product team creates multiple profiles for secure default configurations The product team shares its secure default profiles with other teams Not done

Support period

The team defines a minimum duration of support for secure update The team publishes the support period for secure updates The team provides security support for the legal period The team provides security support for a period after the product of life Not done

Secure update

The team provides regular cyber security update to the product The team implements automatic over-the-air updates The team can provide out-of-band updates to manage cyber security risks The team has a strategy to manage the risks of non-updated products Not done

Resilience to outage

The team identifies the risks of outage at third-parties The team relies on SLAs to remediate outage The team continuously monitors the architecture for service outage The team relies on automation to ensure a continuous service in the event of service outage Not done

Product Manufacturing

Securing the manufacturing supply chain until product release.

Security Capabilities

Using the product capabilities to support cyber security requirements after release.

Security by default

Default configuration

The product unused interfaces (logical / physical) are deactivated by default The 'first boot' state requires user configuration before first use The product relies on state of the art network association procedures (example: no exposure of Wi-Fi credentials, Bluetooth confirmation with PIN...) The product verifies and applies security updates at 'first boot' state Not done

Software attack surface

The product initiates its network communications The product filters input data The product implements a verified source code (ex: good code test coverage, no unused code, ...) The product validates the authenticity of source code before use Not done

External attack surface

The product has limited external interfaces The product case is secure against opening Unused interfaces are deactivated by default External interfaces used for product administration implement access control Not done

Internal attack surface

Debug interfaces can be deactivated Debug interfaces are deactivated by default Internal interfaces protect the confidentiality (via encryption or physical protection) The chip integrates anti-tampering features Not done

Data security

User data management

The product protects personal data at rest and in transit (with encryption and access control) The product keeps users informed about the collection and processing of personal data The product provides an easy way for users to manage, update, delete their data The product only requires the necessary user data to work as intended (principle of data minimization) Not done

Data processing

The product ensures data integrity and confidentiality with access control The product implements protection against reading the RAM The product isolates the processing of secure data (robust isolation at runtime, ex: TEE or dedicated SE) The product ensures data isolation per application (ex:TF-M) Not done

Secure communications

The product uses secure communication protocols. For example: no critical security parameters transmitted in clear The product implementation of secure network protocols is reviewed The product can only exchange data with authentified third parties The product provides granular access to data access (ex: API keys) Not done

Data at rest

No hardcoded security parameters The product protects authentication credentials with best practice crypto (they are salted, hashed and/or encrypted) The product protects stored data with best practice cryptography (reviewed or evaluated) The product implements protection against physical tampering Not done

Product Lifecycle

Keeping the product secure at any time.

End of life

Decommissioning

The product can reset to factory state The product proposes a selective reset of user data The product can anonymize personnal data for remote diagnostic or RMA The product allows user to flash a custom firmware Not done

Prosecco Premium

More features!

With ProSecCo Premium, you improve your product maturity with:

Enhanced granularity to identify strong points and gaps
Maturity improvements and quick wins
Support of multiple products and brands
Creation of custom profiles
Maturity benchmark of real-world products
Possibility to save, edit and export results
And more...

Enhanced data visualization

ProSecCo Premium features additional details to quickly identify strong points, gaps and improvements.

Frequently Asked Questions

ProSecCo stands for Product Security & Compliance. It is a maturity model for IoT products.

ProSecCo is closed-source. You can acquire a license by contacting us.

The profiles represent the expected level of maturity for a domain. They integrate requirements from standards, regulations and sector-specific practices.

The maturity score depends on the answers! The score is calculated using a proprietary algorithm that removes most biases. This is the result of several months of research.

ProSecCo premium is available to cetome customers. The price depends on the features needed such as a custom profile, internal mappings, etc. Please contact us to get more information.

Contact us

If you want to get more information on ProSecCo Premium or acquire a license.

We will only use your personal data for this purpose.

Is your product market-ready?

Analyze your security maturity with ProSecCo

Maturity level

Try ProSecCo

Governance

Compliance

Risk management

Supply chain

Incident management

Product Team

Secure Development

Security-by-Design

Supply chain

Secure architecture

Product Design

Core product (HW/SW)

Identity & Access Management

Security Assurance

Documentation

Post-market security

Product Manufacturing

Secure manufacturing

Device provisioning

Security Capabilities

Security by default

Identity & Access Control

Secure update

Data security

Product Lifecycle

Vulnerability management

Incident management

Data protection

End of life

Prosecco Premium

More features!

Enhanced data visualization

Frequently Asked Questions

Contact us

Maturity level

Is your product market-ready?

Analyze your security maturity with ProSecCo

Maturity level

Try ProSecCo

Governance

Compliance

Risk management

Supply chain

Incident management

Product Team

Secure Development

Security-by-Design

Supply chain

Secure architecture

Product Design

Core product (HW/SW)

Identity & Access Management

Security Assurance

Documentation

Post-market security

Product Manufacturing

Secure manufacturing

Device provisioning

Security Capabilities

Security by default

Identity & Access Control

Secure update

Data security

Product Lifecycle

Vulnerability management

Incident management

Data protection

End of life

Prosecco Premium

More features!

Enhanced data visualization

Frequently Asked Questions

What is ProSecCo?

Is ProSecCo open source?

How are profiles established?

How is the maturity score evaluated?

How much does ProSecCo premium cost?

Contact us

Maturity level