Relax – Your IoT Device Is Now Secured by Stack Overflow
Copy, paste, and the Cyber Resilience Act
This week, the Cyber Resilience Act (CRA) comes into force in EU member states. All products containing a “digital element” sold after December 2027 will need to meet minimum cybersecurity standards.
The scope of the CRA is enormous. It applies to any device with “… a direct or indirect logical or physical data connection to a device or network.” In short, any connected device, whether in IT systems, consumer or enterprise IoT, operational technology, or beyond.
Naturally, this is a big deal for cybersecurity and cryptography. Among the requirements defined in Annex I are two that squarely point to greater use of encryption:
“ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access;”
“protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means.”
It’s all very sensible. And, if implemented correctly, it should lead to improved digital security for all. However, this is easier said than done, which makes me wonder whether poorly implemented security is better than no security. I’m not sure.
Twice in my career, I’ve had the opportunity to inspect the source code underpinning third-party enterprise security software. On each occasion, I was horrified. The code was clearly written by engineers with no training in cryptography since it broke many of the standard rules. Security through obscurity was rampant, along with the incorrect use of encryption parameters (things like all-zero IVs, misused salts, and so forth).
Extrapolating from this small sample, I assume the average engineer finds writing secure code difficult. And now the CRA is forcing almost everyone to do it, we will see some funky stuff going into production.
Stack Overflow may find itself on the front lines of software supply chain security, given how much code will be copied from its pages. I wonder if nation-states have started subverting the code examples yet.
Ultimately, we need the industry to settle on some idiot-proof security libraries for everyone to use. There’s been some progress on this over the years, with libraries like libsodium and RNCryptor trying to limit the amount of damage a developer can do. However, their adoption seems limited, and many developers still resort to the raw cryptographic libraries provided by their programming language.
Until this changes, I shall continue treating my consumer devices as though they have no security at all. And perhaps we should be doing this with enterprise tools as well. As a reminder – it’s OK to ask your vendors to see their code!
In Other News…
Congratulation to TNO, who recently released PQChoiceAssistant v2. It’s an interactive tool that helps you choose the PQC algorithm for your use case. Give it a go, it’s brilliant. Thanks to Frederik Kerling for sharing this.
Related to the above, TNO and collaborators have shipped a revised revision of their PQC Migration Handbook (PDF). I’ve not had a chance to read this in-depth, but it seems extremely comprehensive.
The NCSC has published their annual review, with the geekiest cover image I’ve ever seen. Buried at the back of the review are some thoughts on post-quantum migration. I was interested to see their hint that regulation will play an important part in creating the motivation for action.