Implementing and Validating Linux Cyber Security Requirements: SEAPATH, a Case Study
Talkat LF Energy Embedded Summit @ EOSS 2023 · on Friday, 2023-06-30· at 16:50· Conference Hall (Level 4)·
summary
SEAPATH implements ANSSI BP-028 for electrical substations, producing runnable tests and a compliance matrix that maps each requirement to shell checks and build-time analyses. Key specifics: 44 security levels in the standard, concrete rules like sudo binary permissions and enabling the Yama ptrace restriction, per-image CVE metadata via CVE-check.bb, and binary analysis for compiler hardening flags using a check_hard_compile/kconfig_hardon class. Comparison highlights Debian vs Yocto tradeoffs (prebuilt packages vs rebuild-and-test) and a mix of build-time checks plus runtime compliance reporting.
AI-written summary · about
chapters (18)
- 0:00SEAPATH cyber security project
- 1:04Why Linux security guide needed
- 2:06ANSSI NCB28 security guide
- 3:32NCB28 structure and principles
- 4:57Testing and validating security
- 6:46Implementing easy vs complex
- 8:11Defense in depth and hardening
- 9:57Core Linux security principles
- 10:41Debian vs Yocto differences
- 12:28Minimizing packages in Debian/Yocto
- 14:44Kernel config in Debian/Yocto
- 16:10Hardening Linux kernel with ANSSI
- 16:53Long-term security monitoring
- 17:58Handling CVEs and updates
- 19:00Verifying secure compilation flags
- 20:47Kernel config testing at build
- 21:33NCB28 for embedded Linux
- 22:14Q&A on SEAPATH
related talks
36mSEAPATH: A LF Energy Project for Critical Infrastructure with an Emphasis on Software Supply Chain Security- 36mSEAPATH: A LF Energy Project for Critical Infrastructure with an...
37mSBOM & Vulnerabilities in SEAPATH
27mPre-Packaging CRA and NIS2 Compliance: The SEAPATH Approach
32mSEAPATH: What's New - Recent Improvements and Future Developments
59mGetting Started with Embedded Linux Security
34mYocto Project/OpenEmbedded Meets Security
45mLooking at Linux as a SEooC