The somewhat-obscure journal, "CrossTalk, The Journal of Defense Software Engineering," devoted its September/October 2009 issue to resilient software, and engineers or designers involved with embedded systems should read at least the first article, "Considering Software Protection for Embedded Systems." This article covers ways that people can reverse engineer and maliciously attack FPGAs, although the techniques also apply to microcontrollers with internal flash memory. And it suggest ways to protect your intellectual property.

Here's a short excerpt from the article:

You will find the table of contents for the September/October issue at: www.stsc.hill.af.mil/crosstalk/2009/09/index.aspx and you can click on an article to get it in PDF form. Author Yong C. Kim, Ph.D. works as an assistant professor in the Department of Electrical and Computer Engineering at the Air Force Institute of Technology (AFIT). Kim's co-author, J. Todd McDonald, Ph.D., serves as a Lieutenant Colonel in the USAF and as an assistant professor in the same department.

The US Air Force Software Technology Support Center (STSC) at Hill Air Force Base, north of Salt Lake City, UT publishes "CrossTalk." By the way, Hill AFB has job openings in the STSC for EEs and software experts. Look for the Now Hiring! label at www.stsc.hill.af.mil/.

In April 2008, I wrote the article, "Security Goes Beyond Cryptography" for ECN magazine and included extra security concerns in the online version. Find the complete article at: www.ecnmag.com/article-security-cryptography.aspx. That article covers other aspects of secure systems and it provides several readily accessible references.

The US Department of Homeland Security's National Cyber Security Division sponsors the Software Assurance Web site (buildsecurityin.us-cert.gov/swa) that provides useful security information and resources. The United States Computer Emergency Readiness Team Web site help keep developers up to date on new security threats and many vulnerability resources. For more information, visit: www.us-cert.gov/. You can get technical security alerts and security bulletins.

If you have a good resource for information about secure systems, share it here with a comment for your colleagues.
--Jon Titus