By the CERTIFY consortium*
Innovation in embedded systems unleashed the pervasive adoption of smart devices – from home appliances, to watches, lights, and thermostats just to name a few. Nowadays, thanks to improvements in processing power and wireless network connectivity, such devices are not only smart but even connected. While connectivity and advanced computing features expand the horizon of use, on the other hand, they have also raised the impact caused by successful malicious incidents. Security breaches to such devices have been used, among others, to steal sensitive data, hijack physical control systems, and create botnets to perform further attacks. Recognizing the widespread adoption of digital elements in many aspects of everyday life along with a ramp up in incidents, recent regulations aim at accelerating the adoption of good cybersecurity practices. In the EU the response to the above-described vision materialized with a few key regulations and directives, namely, the Network and Information Systems (NIS2), the Cyber Resilience Act (CRA) and the Cyber Security Act (CSA). All in all, these efforts aim at introducing risk management measures and reporting, cooperating in cyber information sharing and monitoring, ensuring that cybersecurity is maintained throughout the entire lifecycle by including also obligations to be met at every stage of the value chain, and establishing an EU cybersecurity certification framework.
Approaches to certification and way forward
A well-established standard defining a baseline for certification of consumer Internet of Things (IoT) devices is the ETSI EN 303 645. Its main focus is to protect consumer IoT devices against the most common cybersecurity threats/attacks, by making them prepare to withstand potential attacks. By performing a self-assessment, a manufacturer can easily identify where its device is being lagging around and can rectify.
The EU project CERTIFY proposes a methodology to support a continuous (re-) certification process by means of evidence already generated by the manufacturer to ensure that product cybersecurity is maintained during operations. In such a way manufacturer, security evaluator, certification authorities and any entities involved in cross-border cybersecurity information sharing work jointly. The proposed approach leverages secure configurations distributed by the manufacturer to end users to automatically set their device, as well as their subsequent updates to disseminate mitigations as new threats and vulnerabilities are discovered.
In the EU CERTIFY project, we validated our methodology by extending the IETF’s standard Manufacturer Usage Description (MUD) and integrating it into the CyberPass platform for cybersecurity compliance. This prototypical version of the CyberPass platform takes as input the MUD file for the product under assessment along with the answers to the certification form. At the end of the assessment, CyberPass provides a signed MUD file along with the details of the certification authority and a link to the achieved certification details. The signature of the MUD file binds the certification of a hardware and software product version with the latest device behavior and secure configuration/mitigation made available by the manufacturer throughout the product lifecycle. While we have instantiated and evaluated it with the MUD, it is worth noting that without loss of generality another piece of evidence or a combination of them can be fruitfully adopted.
Benefits
All in all, the proposed methodology allows manufacturers to simplify the re-certification process by leveraging evidence they have already generated to provide the secure setting of their products. As the extended MUD file (or other evidence) is signed by a third party (e.g., the security evaluator), this provides guarantees to the end user that all the security measures and mitigations provided by the manufacturer have considered the latest discovered vulnerabilities and that the product is continuously maintaining its certificate validity.
The blog is an extract from the paper found here.
*The Horizon EU CERTIFY (aCtive sEcurity foR connecTed devIces liFecYcles) program (EU‘s Grant Agreement 101069471, Swiss SERI‘s Grant Agreements 22.00165 and 22.00191) focuses on security management of devices within connected ecosystems, defining a Zero-Trust oriented full lifecycle approach to support security-by-design, security-by-default with a zero-touch enrolment, runtime assessment, and threat information sharing. To realize this vision CERTIFY provides a set of tools necessary to achieve a guaranteed level of security, by enabling embedded systems to detect, evaluate and respond to attacks in a collaborative and decentralized way.