Secure FOTA updates: Ensuring critical IoT infrastructure resilience

Why secure FOTA updates are a requirement, not an option, for critical infrastructure

The proliferation of connected IoT devices in critical infrastructure, projected to exceed 29 billion by 2030, makes secure Firmware Over-The-Air (FOTA) updates not just a desirable feature, but a fundamental requirement. The IoT landscape significantly evolved in 2026, with over 21,500 Common Vulnerabilities and Exposures (CVEs) disclosed in the first half of that year alone. This underscores that firmware vulnerabilities are no longer acceptable technical debt but pose existential business risks. Cybercrime costs are predicted to surpass $20 trillion by 2026, representing a 150% increase from 2022.

Untimely or insecure updates can lead to catastrophic consequences: from device failure (known as “bricking”) to widespread cyber incidents threatening operational continuity and safety. For instance, in 2024, nearly 3 million information security events were processed in Ukraine, with 1042 classified as cyber incidents, the vast majority involving malware distribution for remote access or financial theft. In 2023, the number of recorded and processed cyber incidents increased by 62.5% compared to 2022. This highlights the constantly growing threat and the need for robust protection mechanisms, particularly through secure firmware updates.

Firmware operates at the intersection of hardware and software, making it uniquely challenging to secure. The limited resources of embedded systems, non-iterative deployment cycles, and the constant internet connectivity of devices complicate vulnerability remediation post-product release. Therefore, FOTA updates are a crucial tool for remotely patching vulnerabilities, deploying security updates, and enhancing functionality, minimizing the logistical complexities and costs associated with manual updates.

Key architectural principles for a secure FOTA strategy

A robust FOTA strategy is built upon several fundamental architectural principles that ensure the integrity and authenticity of updates:

• Secure Boot: This mechanism ensures that a device only executes trusted software by verifying the digital signatures of each firmware component during startup. The initial bootloader (Boot ROM) or primary bootloader, stored in read-only memory, initializes the device and verifies the integrity and authenticity of the next stage bootloader using cryptographic algorithms. This prevents the execution of malicious or unauthorized code.
• Cryptographic Protection and Authentication: All firmware updates must be cryptographically signed by the manufacturer or a trusted source. The device verifies this signature using an embedded public key stored in a Hardware Root of Trust or secure element. The communication channel for update delivery must also be secured using protocols like TLS (Transport Layer Security) or DTLS (Datagram Transport Layer Security) to prevent interception and tampering.
• Firmware Integrity Validation: After download but before installation, the firmware must undergo integrity checks using hash sums or other cryptographic verifications. This ensures that the update file has not been corrupted or altered during transmission.
• Rollback Protection: Rollback protection mechanisms prevent the installation of older, potentially vulnerable firmware versions. The device must reject any update with a version number lower than the current one.

Scaling and orchestrating FOTA deployments in large-scale IoT systems

Managing updates for thousands or millions of IoT devices requires a meticulous scaling and orchestration strategy. An improperly executed update can turn an entire fleet of devices into expensive “paperweights.”

• Staged Rollouts: Instead of updating all devices simultaneously, staged rollouts are recommended. This involves releasing the update to a small pilot group of devices, monitoring their behavior, and, if successful, gradually expanding the deployment to larger groups. This allows for early detection of potential issues and minimizes the risk of widespread failures.
• A/B Testing of Firmware: While A/B testing is more commonly applied in marketing, its principles can be adapted for firmware testing. This involves deploying different firmware versions to different subsets of devices to compare their performance and stability in real-world conditions.
• Bandwidth Optimization: For large deployments, it is crucial to minimize the amount of data transmitted. Differential updates (delta updates), which transmit only the changes between the current and new firmware versions, significantly reduce network load and update time.
• Centralized Orchestration and Monitoring: Effective FOTA process management requires a centralized platform that allows for scheduling, controlling, and tracking the status of updates for the entire device fleet. Such platforms provide real-time monitoring, reporting, and auditing, helping to promptly respond to any anomalies or failures.

Rollback and recovery: Minimizing update failure risks

Even with the most careful planning, the risk of firmware update failure exists. Therefore, it is critically important to have robust rollback and recovery mechanisms to prevent device “bricking” and ensure operational continuity.

• Dual Bank Memory Architecture: This is one of the most effective strategies for secure updating and rollback. The device's flash memory is divided into two independent banks. While one bank contains the current, operational firmware version, the new image is downloaded and verified in the other bank. If the update is successful, the device switches to the new bank. If the update fails (e.g., due to power loss or data corruption), the device can instantly roll back to the previous, stable version located in the other bank. This ensures “fail-safe by design.”
• Bootloader Recovery Mechanisms: In addition to dual banks, it is important to have a secure bootloader that can initiate a rollback or load an emergency firmware image, even if the main application is corrupted.
• Testing Rollback Mechanisms: Rollback and recovery mechanisms must be thoroughly tested as part of the overall FOTA plan. This includes simulating various failure scenarios (e.g., power loss during an update) to verify their effectiveness.

Checklist for evaluating FOTA solutions: Choosing a reliable partner

Choosing the right FOTA solution is key to the success of large-scale IoT deployments. This checklist will help managers and engineers evaluate potential solutions:

At AZIOT, we understand that secure updates are the cornerstone of long-term IoT deployment resilience. Our architectural solutions for industrial IoT integrate advanced FOTA practices, providing clients with not only functionality but also the highest level of security and reliability in device lifecycle management.

For more information on enterprise solutions from Intecracy Group, visit Intecracy solutions and inbase.com.ua solutions.

Implementing a robust FOTA strategy is an investment in the cyber resilience and operational continuity of critical infrastructure. Carefully choosing a solution that adheres to architectural principles of security, scalability, and fault tolerance is crucial for success in a world where IoT devices are becoming increasingly integrated and critical.