Embedded

What is Embedded?

An embedded system is a combination of processor, memory, I/O and software built into a larger device to perform one specific function or a limited set of functions there, often under real-time constraints. Instead of a general-purpose operating system such as on a PC, an embedded system runs firmware directly on the hardware (bare metal), an RTOS or a slimmed-down embedded Linux. The user usually does not see a computer but a device: a transmitter, a variable frequency drive or an operator panel.

In the OT world, embedded systems are everywhere: from sensors and actuators through to PLCs, HMIs and IEDs in substations.

🧠 What characterises an embedded system?

That last property is both a strength and a weakness. An embedded device that runs reliably for twenty years also runs for twenty years with the software and the security assumptions of the year in which it was designed.

🧱 What are the components of an embedded system?

• Processor - a microcontroller (MCU) with CPU, flash and RAM on a single chip, or a more powerful System-on-Chip (SoC) with several cores, a graphics processor and network interfaces. Common architectures are ARM Cortex-M (microcontrollers), ARM Cortex-A (application processors) and, increasingly, RISC-V.
• Memory - flash for the firmware and configuration, RAM for working data, sometimes EEPROM for calibration values.
• Software - bare-metal code, an RTOS such as FreeRTOS (MIT licence), Zephyr (Linux Foundation, Apache 2.0), VxWorks or QNX, or embedded Linux. Since kernel version 6.12 (late 2024), real-time support through PREEMPT_RT has been part of the mainline Linux kernel.
• Inputs and outputs - digital and analogue I/O, on-board serial buses such as UART, SPI and I²C, and externally CAN, fieldbuses, Ethernet or IO-Link.
• Security hardware - increasingly a secure element or TPM for key storage and a hardware root of trust for secure boot.

⚙️ Where do you find embedded systems in OT?

The related article Embedded controller goes deeper into the control units themselves. A soft PLC is the opposite approach: PLC logic on a standard industrial PC instead of dedicated hardware.

🔁 What is the difference between embedded and a general-purpose computer?

An embedded system is not a computer in the classical sense, but an intelligent component of a larger device.

🔐 Why are embedded systems a security risk?

For a long time, embedded devices were designed for isolated networks. Through OT convergence and the IIoT, they are now connected to Ethernet and sometimes to the internet, while security was never part of the design. Typical weak spots:

• Shared software components - many manufacturers use the same licensed TCP/IP stack. URGENT/11 (2019) hit the IPnet stack of VxWorks with 11 vulnerabilities, Ripple20 (2020) the Treck stack in devices from more than 70 vendors with 19 vulnerabilities, and INFRA:HALT (2021) the NicheStack stack in OT equipment from more than 200 vendors with 14 vulnerabilities. An SBOM shows which components a device contains.
• Default passwords and open services - Telnet, FTP and web servers with factory passwords; by logging in over Telnet with default credentials, the Mirai botnet took over hundreds of thousands of IoT devices in 2016.
• Unsigned firmware - without firmware signing and secure boot, an attacker can load manipulated firmware.
• Hard to patch - updates often require downtime, a maintenance window and retesting; see patch management and legacy systems.
• No room for security software - a microcontroller cannot run an endpoint agent, so detection has to happen on the network.

🏭 Which standards and laws apply to embedded devices?

For manufacturers this means an embedded product is no longer “finished” at delivery: vulnerabilities have to be found, reported and fixed for years.

🔧 How do you secure embedded systems in practice?

For an end user or system integrator in the Netherlands or elsewhere in the EU, a fixed approach works well:

1. Map them - record manufacturer, type, firmware version and network services for each device in the asset inventory. Passive asset discovery finds devices without disturbing them.
2. Link them to vulnerabilities - compare firmware versions with CVEs and advisories from manufacturers and CISA; ask suppliers for an SBOM.
3. Reduce the attack surface - disable unused services, change default passwords and put write protection or the PLC’s run key in the correct position.
4. Segment - place embedded devices in zones following the Purdue Model and network segmentation, and restrict communication to what the process needs.
5. Monitor the network - because no agent can run on the device, passive network monitoring is the main source of detection.
6. Plan updates and replacement - include firmware updates in the maintenance plan and the lifecycle (lifecycle management); make a support period and support for secure boot and signed firmware mandatory in procurement requirements.

❓ Frequently asked questions

Is a PLC an embedded system?

Yes, a PLC is an embedded system: its CPU module contains a processor, memory and a real-time operating system with only one job, which is executing the control program cyclically. IEC 62443-4-2 therefore explicitly names PLCs as an example of an embedded device.

What is the difference between firmware and embedded software?

Firmware is the software stored permanently in a device’s flash memory that drives the hardware, such as the RTOS and the communication stack of a PLC. Embedded software is the broader term for all software in an embedded system, including the application logic that a user sometimes loads.

Do embedded systems always run an RTOS?

No, embedded systems do not always run an RTOS. Simple sensors often run bare-metal code without an operating system, while HMIs and edge gateways usually run embedded Linux; an RTOS is chosen when several tasks with hard deadlines must work together.

Why are embedded devices in OT rarely patched?

Embedded devices in OT are rarely patched because an update often requires process downtime, retesting and sometimes a new safety validation. In addition, manufacturers sometimes no longer supply updates for older devices, leaving segmentation and monitoring as the only measures.

What does the Cyber Resilience Act mean for embedded devices?

The Cyber Resilience Act requires manufacturers of embedded devices placed on the EU market from 11 December 2027 to provide secure design, delivery without known exploitable vulnerabilities and security updates during the support period. Actively exploited vulnerabilities have had to be reported since 11 September 2026, including for devices already in use.

What is the difference between a microcontroller and a System-on-Chip?

A microcontroller combines a simple processor with flash and RAM on a single chip and suits small, real-time tasks with low power consumption. A System-on-Chip integrates more powerful processor cores, graphics functions and network interfaces and usually runs a full operating system such as embedded Linux.

📌 In summary

Embedded systems are the brains of industrial devices: small, task-focused computers that do their job reliably and predictably for many years. That long service life, shared software components and limited update options make them vulnerable; inventory, segmentation, network monitoring and requirements from IEC 62443 and the Cyber Resilience Act keep them manageable.