emlix CVE and lifecycle management for embedded Linux systems relieves companies of the regulatory requirement for continuous monitoring of potential security risks throughout the entire product lifecycle. Our CVE management toolchain reliably and largely automatically detects all known vulnerabilities for your embedded Linux platform. The expert assessment by our kernel and security specialists – likewise mandatory – reduces the number of CVEs that actually need to be processed to a sensible minimum.
With emlix CVE management, security risks are identified early and efficiently, and the regulatory requirements of, for example, the CRA, RED and IEC 62443 are met. In doing so, you benefit from the accumulated embedded Linux and security know-how of more than 25 years of embedded Linux lifecycle experience.
Cybersecurity requirements for embedded systems are increasing
With the Radio Equipment Directive (RED) and the Cyber Resilience Act (CRA), as well as the standards derived from them, the cybersecurity requirements for connected products are rising considerably. In future, manufacturers must demonstrate that vulnerabilities are continuously monitored, assessed and remediated.
For the secure operation of embedded Linux systems, this means, among other things:
■ Continuous vulnerability management
■ Assessment of security-relevant risks by experts
■ Software updates throughout the entire product lifecycle
■ Traceable documentation of all measures
To do this, companies need not only powerful tools but also in-depth know-how in Linux security, kernel technologies and regulatory complianc
Your Benefits at a glance
■ IEC 62443-compliant processes
■ CVE management toolchain for embedded Linux, optimised over more than 15 years
■ Reduction of the security issues actually to be processed through filtering and expert assessment with greater reliability at the same time
■ Support throughout the entire product lifecycle
■ In-depth Linux, kernel and security expertise spanning more than 25 years
On request, emlix additionally takes over the complete security update management, including automated release and regression testing.
Efficient CVE Management for Embedded Linux
If we do not already know your embedded Linux system from its development, we start with a joint workshop to analyse the current software and security status. We then integrate your system into our CVE management toolchain based on the existing SBOM (Software Bill of Materials).
Multi-stage CVE Management Process
Regular monitoring takes place, for example, weekly or monthly, in several steps:
1. Automated CVE/Vulnerability Scanning
In line with the available SBOM, the relevant sources are automatically scanned for security issues for all components of your embedded Linux system (or several systems). The relevant databases (NVD/Mitre) are taken into account, as are various other potential sources of security advisories. Which these are is defined when the monitoring for your system is set up.
2. Multi-stage relevance assessment of security vulnerabilities
The often high number of CVEs found is significantly reduced by automated relevance checks. The corresponding filtering mechanism takes into account, among other things:
■ the exact component versions
■ the kernel and package configurations
3. Expert Assesment
The remaining vulnerabilities are assessed by our kernel and security specialists. This is done specifically for your product and its context and use cases. As a result, the criticality rating of an issue not infrequently changes significantly – in both directions.
4. Security Reporting & Recommendations for Action
You receive the results of the scanning and the subsequent expert assessment as a formal report or in common formats such as CycloneDX or SPDX. Further processing in tools such as Dependency-Track is generally also possible. Included are:
■ the applicable CVEs with an assessment of whether and why (or why not) they pose a security risk
■ criticality assessment
■ recommended actions
5. Joint evaluation
In an online meeting, we discuss the results together with your team and define concrete measures to minimise risk. This involves an optimisation process. Security-relevant understanding of the system grows, and CVEs that have already been assessed are not assessed again.
More informationFeel free to call us or send us an email. During our initial discussion, we’ll work with you to assess the status of your embedded Linux system and determine the necessary steps. Your contactYou can reach our experts on the emlix CVE Management Team at |
