"CRA & Dev" series¶
Short articles, readable in a few minutes, with one development technique each time, to help developers secure their software and move toward the requirements of the Cyber Resilience Act (Regulation (EU) 2024/2847).
Who it's for: developers, with no cryptography background required. Each episode starts from a concrete need, gives an applicable technique with code (Rust, Python, .NET, C), and ends with the threat model, meaning what the technique protects and what it does not.
Episodes¶
| # | Title | CRA requirement | Annex I ref. | Platform |
|---|---|---|---|---|
| 01 | You can't fix what you don't know you're running: SBOM and VEX | Vulnerability handling, SBOM | Part II, point 1 | CI, cross-platform |
| 02 | An unsigned .exe is a parcel with no sender: sign your binaries | Integrity and secure updates | Part I, point 2, (c) and (f) | Windows |
| 03 | Never store a secret in plaintext again: Windows DPAPI | Confidentiality, encryption at rest | Part I, point 2, (e) | Windows |
| 04 | Trust, but verify: sign your data | Data integrity | Part I, point 2, (f) | Cross-platform |
| 05 | Generating an SBOM is not enough: monitor it with Dependency-Track | Vulnerability handling, continuous monitoring | Part II, point 1 | CI, cross-platform |
| 06 | A thousand fragments, one signature: updating firmware over LoRaWAN | Security updates, secure distribution | Part I, point 2, (c); Part II, point 7 | Embedded, LoRaWAN |
| 07 | Assessing the cybersecurity risks of a product | Cybersecurity risk assessment | Part I, point 1; Article 13 | All platforms |
The list will grow with each episode.
The references point to Annex I of Regulation (EU) 2024/2847. Its Part I lists the product cybersecurity requirements (points a to m); its Part II covers vulnerability handling.
In-depth article, a long and sourced version for going deeper: DPAPI in detail.