The CRA forces manufacturers to protect their embedded systems properly against cybersecurity threats. Otherwise, they face heavy penalties and sales bans. We provide practical tips, how to perform a risk assessment, which security measures are enough to satisfy the essential product requirements, how to tame the thousands of vulnerabilities, and whether it's worth to make an embedded system comply with the CRA at all.
The CRA requires manufactures to document the risk assessment. Architecture decision records (ADRs) are the ideal means for that. They also facilitate good discussions about different mitigation options.
Episode 66: Better Built By Burkhard
Episode 65: Better Built By Burkhard
Episode 64: Better Built By Burkhard
Episode 63: Better Built By Burkhard
Episode 62: Better Built By Burkhard
Manufacturers must provide security updates during the support period plus 10 years. The length is calculated from average lifetime, component availability and other criteria. The support period starts when the product is placed on the market.
Episode 61: Better Built By Burkhard
Episode 60: Better Built By Burkhard
The eight requirements define how the manufacturer's process for vulnerability handling must look. They include identifying, addressing and publishing of vulnerabilities as well as timely security updates and generating an SBoM. The post gives practical examples how to do this.
Embedded systems must satisfy the 13 essential product properties like confidentiality, integrity, availability and access control. Otherwise, they violate the CRA and must not be placed on the market. The post illustrates the product properties with many practical examples.
Which devices are covered by the EU Cyber Resilience Act (EU CRA)? * An X-ray fluorescence (XRF) analyser connected with the Internet over WiFi. * A metal-sheet bending machine with an Ethernet port, which will only be used in the