Open Source Summit Europe 2025

Embedded Linux security often focuses on protecting the devices against attackers using technical safeguards like secure boot and kernel hardening. While essential, this engineering-oriented perspective can result in overlooking a major threat vector: human behavior. Social engineering remains a common attack method, and even embedded devices with limited interactability can be vulnerable to this.

This presentation explores the relationships between developers, users, and attackers to identify security requirements and possible shortcomings in security planning. Core principles include:

- Prevent users (and developers) from compromising security
- Design for resilience against security failures
- Recognize that misunderstandings lead to errors
- Communicate clearly to reduce social engineering risk

While the talk isn't deeply technical, it presents embedded Linux–oriented solutions to these human-centric challenges where applicable. The presentation is accessible to people who are still beginners in the embedded world. My goal is to ensure that device developers consider the actions of both malicious actors and legitimate users in their threat models.