Auditing industrial and embedded systems

At Enedis and Ornisec, I have worked on cybersecurity for industrial and embedded equipment used in electricity distribution. My tasks have included risk analysis, security specifications, qualification, audits and equipment inventory.

This page describes my general approach. It does not document a specific client audit or disclose internal findings.

Audit questions

1. What does the equipment do, and what would a failure affect?
2. Which interfaces, privileged operations and update paths need review?
3. How do the identified risks relate to the architecture and configuration?
4. How is the equipment provisioned, maintained, recovered and retired?
5. What evidence supports each finding and proposed remediation?

Authentication and keys

Reviews involving PKI, HSMs or PKCS#11 include checking where keys are generated and stored, who can use them and how credentials are replaced. These questions span the equipment, firmware and backend services.

My CV lists the roles and associated responsibilities.