Imagine it’s late Thursday afternoon. Your team needs to reverse engineer the embedded firmware on one of your new devices to search for security holes. They’re looking for vulnerabilities because device protection recently bubbled up as an important priority (and you’re expected to navigate these uncharted waters without much time or money). As time slips by and a major design reviews approaches, your team is struggling to stay afloat and secure the device. It’s critical that your engineers and developers learn to think like cyberattackers, who seek to exploit vulnerable firmware. Looking ahead, there’s still lot of information to swim through and it may be a long few weeks without a safe harbor in sight.

These types of scenarios are becoming more frequent for manufacturers, engineering firms, consultants, and others who can’t ignore the impending Internet of Things (IoT) exploitation tsunami. Many of them design, build, or consult on embedded firmware that’s in millions of devices, and as the IoT wave continues to gain momentum, it may carry them into tricky waters regarding cybersecurity.

Consider how security cameras were leveraged in the Dyn cyber-attack or the home automation attack that occurred using smart light bulbs. In the case of the St. Jude’s pacemaker attacks, IoT exploitations battered a large, publicly traded company that denied the holes until clear evidence from outside groups, including the FDA, fully exposed them. The time is now for companies to get to higher ground by proactively protecting their devices. As part of their approach, businesses need their staff to think like cyber attackers and understand how to exploit their own devices. Security training on exploiting embedded firmware will play a key role in their success.

When considering training, some might self-teach and gather training content over time. This compilation process could take months or years and their content may contain erroneous data found online. Additionally, a high amount of self-discipline is required for success in self-study. Live, hands-on training is structured, condensed, and progressive, meaning the material moves from easier to more challenging. It allows for mind-sharing amongst all participants (including the instructor). Stories are told, ideas are exchanged, and lessons are learned. Students can try and fail and try again in a classroom environment without affecting their company’s reputation or stock price.

Effective embedded firmware security training includes lecture and labs where students hack off-the-shelf manufactured devices that are on the market today. It’s not all theory – it’s real-world learning that constructively exposes what the bad guys can do to a company’s devices. Students gain confidence and come away with tips, tricks, and methods not available anywhere else. Additionally, attendees are not required to be programmers or developers. Participants often hold various positions in a range of industries. They learn to protect their embedded devices and join others who have a stake in security.

As the number and powerful effects of IoT exploitations surge, companies must shore up their security on embedded devices to mitigate risk. Live security training for embedded firmware provides an essential channel through which companies can get to higher ground.

Terry Dunlap is the founder and CEO of Tactical Network Solutions (TNS) in Columbia, Maryland, where he oversees former NSA experts skilled in IoT, embedded firmware reverse engineering, and security. TNS has developed a cybersecurity platform that checks compiled, embedded firmware prior to manufacturing. The company also provides white hat training and consulting on IoT firmware exploitation, hardware hacking and exploiting Real Time Operating Systems. Previously, Terry worked as a Global Network Vulnerability Analyst for the NSA.