Karamba XGuard

Karamba XGuard is an integrated solution that aims to provide seamless embedded security for automotive and IoT devices. According to the vendor, XGuard offers deterministic prevention of malware and fileless attacks, as well as proactive alerts about suspicious devices. This security solution is targeted at small to large enterprises, including automotive OEMs and suppliers, IoT device manufacturers, cybersecurity professionals, IT professionals, and software developers across various industries.

Key Features

Seamless Integration: XGuard agents are seamlessly integrated into the firmware build toolchain without requiring any changes to the source code or development processes, as claimed by the vendor. This integration ensures that verification and validation processes remain unchanged, and the product functionality is not impacted.

XGuard Agent: Negligible Performance Overhead: The XGuard embedded agent is specifically designed for embedded systems, with low CPU and memory consumption, as stated by the vendor. The agent takes up to 5% CPU overhead, 5% memory size, and about 10% of the flash size. Additionally, local analysis and payload optimization are said to reduce device traffic to the backend by 90%.

XGuard Backend: Unsupervised Machine Learning: The vendor claims that XGuard's backend utilizes adaptive unsupervised machine learning to detect anomalies and threats. With a set of predefined monitored behaviors, it can observe a significant number of events across the entire fleet. The vendor states that Security Operations Center (SOC) teams can investigate highlighted anomalies and determine incidents and root cause.

Broad Threat Coverage: According to the vendor, XGuard software provides protection against a wide range of cyberattacks for automotive and IoT devices. It deterministically detects and prevents malware from executing as foreign code. The vendor also claims that it detects and prevents fileless attacks, such as buffer overflow, using Karamba's patented Control Flow Integrity (CFI). Furthermore, the backend analytics engine is said to identify hacking attempts, password guessing, privacy violations, and rogue devices.

ISO21434 and UNECE R155 Compliance: The vendor asserts that XGuard helps automotive OEMs and suppliers achieve compliance with ISO21434 and UNECE R155 cybersecurity standards. By seamlessly integrating into the software, it addresses requirements for software integrity, OTA updates, authentication, and logging. The vendor claims that this compliance is achieved without any extra toll on R&D or changes to the ECU architecture.

Seamless Deployment: According to the vendor, XGuard requires zero developer intervention or updates during the software development lifecycle. It can fit into off-the-shelf and proprietary build environments, making it compatible with a wide range of platforms out-of-the-box.

Negligible Performance Impact: The vendor states that XGuard is optimized for embedded systems, providing runtime protection with less than 5% CPU overhead and 0 CAN network overhead.

Deep Security & Visibility: The vendor claims that XGuard Monitor can analyze and monitor a vast array of IoT-specific threats, providing granular indicators for quick detection. It is said to help improve code quality by recording and reporting deep root cause analysis details to identify vulnerabilities.

Deterministic: According to the vendor, XGuard's "known good" approach ensures that only legitimate files can execute to runtime memory, effectively blocking unauthorized droppers.