Let’s all get over the CRA!
summary
European Cyber Resilience Act splits software into three tiers: Level 1 requires costly Common Criteria audits, Level 2 likely needs lighter third‑party checks or pen tests, and about 90% of products face only self‑assessment. Vulnerability disclosures must go to ENA, which currently lacks broad incident handling capacity. Expect a final signature, then a two‑year standards gap with practical outlines surfacing around early 2025. Automation and self‑assessment tools are singled out as the main way to cut audit costs.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:22What is the CRA
- 3:09Why the CRA matters
- 6:23CRA obligations and challenges
- 9:15Impact on software categories
- 10:41Negative effects and concerns
- 12:04Future perspective and automation
- 13:06Q&A on uncertainties
related talks
01h 03mTen Key Steps for Enhanced Web App Security
37m(Ab)User Experience.
39mOrganizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
58mPractical Secure Development and Operations with JavaScript in 2020
42mHOW VULNERABLE IS YOUR APP? AND HOW TO FIX IT.
15m“Security” in the JavaScript ecosystem
46mSecurity Design Anti-Patterns – Creating Awareness to Limit Security Debt