In line with another suggestion, the most secure system is one that you have built yourself, selecting every component and their configuration options. For “em

In line with another suggestion, the most secure system is one that you have built yourself, selecting every component and their configuration options. For “embedded” systems (and her I am including bare-metal single-function production servers), I would choose Yocto. It was designed from the ground up to build custom Linux distributions. Every component can be modified trivially, and many different systems can be built using them same components. There are many security features that integrate seamlessly through 3rd party “layers”: secure boot with full chain of trust, secure file systems, SELinux, and so on. It’s easy to extend the system with new “recipes” and “overlays”. I am currently working on a IoT project that likely will include several edge servers, which will replace extant cloud services. Each system will run a custom kernel (using hand-crafted configurations) and read-only root filesystem (containing only those packages required for running that service). Aside from better utilizing our compute resources, this move will save tons of bandwidth for our customers. Best of all, we will no longer need to trust our cloud provider to protect our systems and data. Those vendors have show their willingness to push small players in front of a bus, so I consider it outright foolish for most businesses to rely on them as their primary service provider.