In this talk we will set out how secure and high-integraty aspects of systems will or should be reflected in the development of firmware for a wide-range of devices.

Trusted computing, remote attestation and the unbiquitous TPM (not forgetting Pluton and friends) are all well known technologies. Indeed a trusted computing base requires firmware with specific capabilies that promote certain aspects of immutability, identity and integrity measurements - if these properties are provides then we have the start of a chain of trust and a measurement and identity mechanism that allows that device to be "attestable". The further property of being "trustable" needs more explanation but refers to the core root of trust measurement and how this is established, amongst other requirements.

Once we have a collection of attestable (and trustable) devices then remote attestation offers us the possibility of trust relationships between those devices leading to higher-level trust capabilities and integration with supply-chain and forensics.

To further demonstrate this we have developed case studies from the medical and railway verticals based upon edge cloud and 5G communications. As part of this talk we will use these safety-critical domains as the drivers for a wider and more integrated trusted computing base and ultimately the requiremnts towards firmware and hardware that sits at the core of this.