Agile Embedded Podcast E77: Embedded Security: From Red Team to Dev Team

We talk with Ryan Torvik, founder and CEO of Tulip Tree Technology, about cybersecurity from both the offensive and defensive perspectives. Ryan shares his experience from years of offensive cyber operations and how that mindset differs fundamentally from building systems. Ryan walks through how attackers approach embedded devices - from attack surface analysis to firmware extraction to using tools like Ghidra and Binary Ninja for static analysis. We discuss the basics every developer should know: don't roll your own crypto, focus on input parsers, think about OTA updates early, and use secure coding practices. The conversation covers when small companies should hire security experts versus building capability in-house, how languages like Rust help with memory safety, and why getting security voices into the development process early matters. Ryan also introduces Tulip Tree's emulation-based approach to security testing and points to resources like Capture the Flag challenges for learning offensive security skills. 0:00 Podcast Introduction 1:07 From Defense Contractor to Startup 1:41 Inside Offensive Cybersecurity 4:42 How to Attack Embedded Devices 7:26 Pulling Firmware Apart 11:58 Defensive Security for Developers 19:47 Securing Medical Devices 24:04 When to Hire Security Experts 26:02 Rust and Secure Coding 30:00 Getting Security in the Room 35:40 Emulation for Testing 44:00 Capture the Flag Learning 47:31 Tulip Tree and Wrap Up