Security Guide

Status: DRAFT

Network

The EMS Gateway requires outbound connectivity to EMS backend services. No unnecessary inbound Internet access should be required.

Wi-Fi

Use a protected customer Wi-Fi network. TODO: define minimum supported Wi-Fi security configuration.

Device identity

Each gateway must use unique backend/NATS/VPN credentials. The Raspberry Pi serial number is an inventory identifier and not a password or authentication secret.

Physical security

Install the gateway where unauthorized physical access is limited.

Updates

TODO: describe automatic security update behavior.

Security issues

TODO: add security contact and public disclosure URL.