Product Security Expert, Bosch Security Systems

Dr. Carolina Adaros is an electronics engineer, MSc in analytics and risk management, and PhD in cybersecurity. Previous to becoming a Cybersecurity professional, she accumulated experience in industrial automation, software quality management, process improvement, and technological solutions. This experience was successfully transferred to her current role in the field of Product Security.

In 2017 she started her PhD, in Birmingham, UK, with focus on cyber-risk management on Industrial Control Systems and Industrial IoT (IIoT). In 2019, while still undertaking PhD studies, she joined the Bosch Group in Germany as part of the Bosch PSIRT (Product Security Incident Response Team) and since 2022 she works in Bosch Building Technologies as product security expert.

Her current role includes being the proxy of the Product Security Officer, maintain the product security processes and policies, do internal consultancy and trainings, and coordinate the vulnerability management and incident response processes at Bosch Building Technologies.

Presentation: Product Security – challenges, successes, and learnings

Bosch Building Technologies and Security Systems (Bosch BT, for short) is a division of the Bosch Group whose portfolio includes access control and intrusion detection, video surveillance, fire detection, audio, and communications systems and also integration and operation of such systems. To handle cybersecurity assurance within its product lines, Bosch BT adheres to the Bosch Security Engineering Process, which indicates that products should be developed with a level of security that is equal or greater to the state-of-the-art. The Security Engineering Process (SEP) is integrated in our product engineering and covers the entire product lifecycle until decommission.

Since its introduction on 2015, the Bosch SEP has evolved and matured, becoming eventually the “central mandatory process for cyber security (CS) engineering for Bosch products”. Bosch Building Technologies has also tailored this process to the needs of the different product lines and services. However, while we are well-aligned with security industry best practices, we still have pending challenges to make sure that processes are followed adequately, in every instance, for each product and by all the involved stakeholders.

It is also worth to mention that our journey on improving cybersecurity in products is part of the overall challenge of being traditionally a hardware company, which had to adapt to a software-oriented world. One of our main challenges is to get all relevant stakeholders to develop a good understanding of security risks. We also face several difficulties on dealing with legacy products, which are still in the field, many of which have long-time reached their end-of-life period and are not currently supported, but are still used by customers. This means that, if not connected in a secure environment, they can constitute a security risk, since they use older technologies and were not designed taking into consideration the current cyber-threat landscape. Supply chain security is also a big topic since our systems can be only as secure as their components are. For this reason, we have controls in place that enable us to select suppliers that can fulfil our security requirements. In this topic, we also have successes, thanks to our ongoing engagement with the purchasing department and the integration of our security processes within the purchasing processes.

Another success that we can name is having an internal Pentesting team. Not only have they reported findings that outsourced pentesters previously missed, but they also help providing recommendations to the development teams on the implementation of fixes and identifying needs for further support on security related activities. Last to mention but not less important is our product security community that helps us promoting security best practices and identifies opportunities of improvement. We have regular meetings, a yearly workshop that involves a strongly motivated group of people that continuously share knowledge, identify potential solutions to different pain points and engages in security-related initiatives.

We are aware that the market demands for more agility, technological innovation and integration, and the intelligent use of data to improve the quality of our lives. That is the purpose of our business. However, it is an essential part of the Bosch Quality Promise that we provide product security and protect our customers’ privacy throughout the entire product life cycle. Hence, as security professionals, our purpose is to procure that business goals and security risks are properly balanced.