What is Firmware Signing?
Firmware Signing is a security measure in which Firmware files are provided with a digital signature. Only Firmware that has been cryptographically signed by a trusted party may be installed or executed on a device.
In OT systems, Firmware signing prevents attackers from installing malicious or tampered Firmware on PLCs, RTUs or IIoT devices.
🧠 How does Firmware Signing work?
- Hashing – The firmware is cryptographically hashed
- Digital signing – The hash is encrypted using the manufacturer’s private key
- Verification at installation – The system validates the signature using the public key
- Validation failure = blocking – Unsigned or tampered firmware is rejected
- Logging (optional) – Attempts to install unverified firmware can be logged
🔐 Relevance in an OT context
| Component | Application of Firmware Signing |
|---|---|
| PLC | Only firmware signed by the supplier may be loaded |
| HMI / SCADA | Protection against installation of altered or infected firmware |
| IIoT devices | Prevention of supply chain attacks via software integrity |
| Remote IO systems | Firmware updates of field components are only possible after validation |
Firmware Signing is an essential defence mechanism against persistent attacks via the supply chain, physical access or insider sabotage.
✅ Firmware Signing vs. Secure Boot
| Security layer | Purpose |
|---|---|
| Firmware Signing | Prevents installation of unauthorised firmware |
| Secure Boot | Ensures the system only boots with trusted code |
The two measures work together: signing prevents unwanted installation, Secure Boot prevents unwanted execution.
🔁 CSIR classification
| Label | Reason |
|---|---|
| VSE | Firmware Signing is a system-level technical control at firmware level |
| VSP | Policies, supplier contracts and update procedures support the technology |
| Conformance | IEC 62443-3-3 SR 5.2 requires protection against firmware tampering |
⚠️ Limitations and considerations
- Not all OT equipment supports firmware signing
- Some vendors keep signing proprietary (vendor lock-in)
- Signing keys must be securely managed (key management!)
- A flaw in the signing process = potentially unusable asset after update
📌 In summary
Firmware Signing safeguards the integrity of Firmware before installation. In OT, this is crucial for protecting field devices against tampering — particularly during vendor updates, remote maintenance or physical access.