The Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
summary
The Cyber Resilience Act forces Yocto-based products to provide a usable SBOM, five years of vulnerability support, secure update and 72‑hour incident reporting, with fines comparable to GDPR; Yocto workflows can export SPDX, use CVE-check and automated filtering to shrink a raw ~5,000 CVE list to about 200 actionable items. Risk assessments must produce attack trees, list assumptions (e.g. TLS client cert device authentication) and map to platform protections like TPM/TEE-backed key storage and signed boot.
AI-written summary · about
chapters (9)
- 0:00Cyber Resilience Act intro
- 1:32Origins of the CRA
- 7:13Regulatory framework
- 10:48Five CRA requirements
- 14:19Security risk assessment
- 25:22Vulnerability management
- 36:00Secure Yocto platforming
- 41:43Timeline and compliance
- 44:10Q&A on CVE databases
related talks
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
33mImplementing the EU Cyber Resilience Act (CRA)
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
34mYocto Project/OpenEmbedded Meets Security
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native