embedded systems
Latest posts
A Pragmatic Approach to CRA Risk Assessment
In less than 30 minutes, I can explain a pragmatic approach how to model the threats of an embedded system, assess the cybersecurity risks and document the risks in security decision records (SDRs). Here is the video from my talk at the Torizon CRA Summit in Munich.
How Can Manufacturers Address and Remediate 1000+ CVEs?
Fixing 1000+ CVEs one by one is too costly. Filtering them is arbitrary and might miss important ones. Making the exploitation of hundreds of CVEs unlikely by multiple security measures in one go is nothing else but defence in depth!
Understanding the CVSS Metrics for Exploitability
Instead of fixing hundreds of CVEs, manufacturers can provide enough security measures to make the exploitation unlikely. The decrease of the CVSS metrics is a useful indicator how effective the security measures are. This post is about understanding the CVSS metrics.
Running Example for CRA: Heat Pumps in Private Homes
From now on, I'll use heat pumps in private homes as the running example for my CRA articles.
Real and Imagined Consequences of Substantial Modifications
WRONG: substantial modification => new placing on the market. Logical somersaults needed to avoid infinite support periods and full conformity assessment for all legacy products. --- RIGHT: substantial modification => update conformity assessment. No trickery needed.
EU CRA: Essential Requirements Related to Product Properties
Embedded systems must satisfy the 13 essential product properties like confidentiality, integrity, availability and access control. Otherwise, they violate the CRA and must not be placed on the market. The post illustrates the product properties with many practical examples.
Setting Up Yocto Projects with kas
Kas makes Yocto builds simple. Based on a YAML configuration file, kas starts a container, clones the layer repositories, initialises the conf files and starts building. Each Yocto version builds only on specific host Linux versions. The kas container frees Yocto builds from this restriction.