5 ms·
> The CRA describes ’essential cybersecurity requirements’ which are well intended, and mostly ok, but leave a lot of room for interpretation. These requirement
by kneebonian 4y ago
> The CRA describes ’essential cybersecurity requirements’ which are well intended, and mostly ok, but leave a lot of room for interpretation. These requirements tell us to implement adequate denial of service & exploit mitigation techniques, for example, and no one can be certain what that means
Service exploit mitigation techniques? Really why didn't I just think about not writing bugs, and vulnerable code.
- DyslexicAtheist 4y agoa shame that he is unfamiliar with RED. It's meaning is literally just system hardening as it is also defined in RED (CRA is just an expansion of RED to the rest of the ecosystem), which is in this contexts outgoing firewalls rules on devices, system hardening, anomaly detection, ... It is not a definitiv list of things because this would change based on what makes sense on a system. Instead you need to demonstrate that you've considered a threat model when applying the mitigation. And the mitigation is sufficient for the intended purpose. One example could be limit what the system can and can't do. And don't allow it to communicate with the whole world when your only required endpoints are api.samsung.com, an ntp server, DNS and MQTT. A shame that he had to write this hit-piece when he could have asked what notified bodies are testing _today_ to meetx requirements for RED.