Enhancing IoT Deployment Security Under the Cyber Resilience Act

The rise of connected devices has brought significant progress in various sectors, but it also increases vulnerability to cybersecurity risks. As global regulatory authorities tackle this critical issue, the European Union leads the way with the EU Cyber Resilience Act (CRA), which focuses on enhancing the security of embedded devices. Although the CRA is still pending approval from the European Commission, the suggested guidelines indicate a major shift in cybersecurity standards for equipment manufacturers in Europe.

To meet these evolving requirements, we are pleased to announce a new feature in JFrog Connect, a key component of the JFrog Platform for trusted software supply chain management from developer to device. Keep reading here to learn more about these timely developments.

What is the Cyber Resilience Act?

The Cyber Resilience Act (CRA) requires companies to adopt secure development practices, provide regular updates and patches, and proactively manage vulnerabilities. These measures are intended to create a safer digital landscape, protect user data, and ensure the reliability and integrity of digital products and services in the EU market. Compliance with the CRA is crucial for companies operating in or targeting the EU market, ensuring they remain secure, competitive, and trusted.

CRA Timeline

Why the Cyber Resilience Act is needed

The regulation tackles two primary issues. First, many products suffer from poor cybersecurity or receive insufficient security updates. Second, both consumers and businesses struggle to identify which products are secure and to configure them in a manner that safeguards their cybersecurity.

To address these problems, the CRA has three main objectives:

Reduce vulnerabilities in digital products
Enhance protection for users and hold manufacturers accountable
Create a unified cybersecurity framework across the EU

Who is affected by the CRA?

The law affects manufacturers, distributors, and importers of products with digital elements in the EU, including hardware and software that can connect to networks, either directly or indirectly.

To enforce compliance, the regulation will impose fines between €5 to €15 million or 1-2.5% of global annual turnover, depending on various factors such as the nature, severity, and duration of the violation, cooperation with authorities, and previous non-compliance incidents.

CRA requirements

Most of the requirements of the Cyber Resilience Act can be divided into two categories: vulnerability handling and security by design.

Vulnerability Handling
Companies must implement robust measures for handling vulnerabilities throughout the product lifecycle:

Early Detection & Blocking of Exploitable Vulnerabilities
Automated Vulnerability Management
Software Bill of Materials (SBOM)
License Compliance
Operational Risk Management
Comprehensive Security Governance
Enhanced Reporting & Documentation
Proactive Security Measures

Security by Design
Products must be designed, developed, and maintained with cybersecurity as a core consideration (incl. regular updates & patches):

Secure Development Lifecycle
Risk Assessment & Management
Minimize Attack Surfaces
Secure Default Configurations
Robust Authentication & Data Protection
Continuous Vulnerability Monitoring & Timely Updates
Notification and Documentation
Audit Trails and Security Advisories

Additional requirements include: the disclosure of vulnerabilities and security incidents in a timely manner, secure and reliable update flow/warranty on vulnerabilities, and centralized reporting of incidents or vulnerabilities (ENISA).

Enhancing IoT deployment security with JFrog

To meet the evolving needs of our industry, we’re excited to introduce a powerful new capability within JFrog Connect. This update enhances functionality by offering deeper insights into vulnerabilities affecting deployments, particularly for IoT or edge devices.

Now integrated directly with JFrog Xray, Connect enables continuous monitoring of CVE severity throughout the deployment lifecycle, aligning with the EU’s Cyber Resilience Act requirements for embedded devices.

JFrog Connect Seamless Over-the-Air Updates

The JFrog Security Suite

The JFrog Platform is a unified Software Supply Chain Management solution to ensure secure and controlled software development from source code to runtime. It provides a single source of truth for software development, bridging the gap between developers, operations, and security teams to protect the entire software supply chain – all from one unified platform. JFrog’s Security solutions support the CRA and are delivered as cloud, multi-cloud, self-hosted, air-gapped.

JFrog Software Supply Chain Platform

JFrog Curation & Catalog

Enforce automated security policies to block unsafe OSS components from entering the software supply chain, ensuring only trusted components are used.

JFrog Essential & Advanced Security

Easily identify, prioritize, and remediate vulnerabilities, deliver secure automated updates, and ensure timely reporting via SBOMs
Implement secure coding practices with advanced application security testing and robust vulnerability management, including contextual analysis, SAST, and security exposure scanning

JFrog Release Lifecycle Management

Create immutable release bundles early in the SDLC to establish secure development practices and streamline timely updates and security patches
Gain full visibility into the release process with comprehensive documentation, including risk assessments and audit trails

What’s on the roadmap

In the future, JFrog Connect will also integrate with Runtime, granting users visibility into the processes running on a given device, so they can understand the real impact of any vulnerabilities present. For instance, if the vulnerability is found on binaries that are not running, then the impact will be considered low. However, if they are running as a process, the impact will be considered high. This detailed context will help boost developer efficiency, reserving their time and focus for what matters most.

The JFrog Platform integrated security solutions provide comprehensive risk assessments and maintain detailed audit trails and documentation, helping businesses comply with CRA regulations and ensure accountability.

By leveraging the JFrog Platform and its Security Suite, you can seamlessly integrate security into your development workflows, ensuring compliance with the Cyber Resilience Act while enhancing the overall security of your software supply chain.

Request a demo to learn more about how the JFrog Platform can help you meet the requirements.