A naukri.com initiative
Embedded
2d
15
A Sensible Solution to Exploding CVEs For IoT Devices
- The number of CVEs (Common Vulnerabilities and Exposures) is nearing 250,000 at a rate exceeding over 30,000 per year.
- For certain networking equipment each device contained an average of 1,267 software components and an average of 1,120 CVEs, of which, 473 were ranked as having Critical or High vulnerability.
- The primary problem is due to using open-source components, which have extensive vulnerabilities and bring in other components with even more vulnerabilities.
- Fixing so many vulnerabilities per device is a daunting task for IoT development teams; they are already stretched thin by mushrooming requirements and ever-tighter schedules.
- Credential compromise and phishing are still the dominant attack vectors, vulnerability exploitation is rapidly growing and accounting for 1/3 of all incidents according to one report.
- The best solution for under-staffed OEMs is to corral CVEs like cattle in the Old West.
- The SecureSMX RTOS accomplishes this by placing vulnerable and trusted legacy code into hardware-enforced, isolated partitions to prevent malware intrusion in one partition from accessing data or code in others.
- Partitioning also offers zero-day protection, insider threat protection, partition-only rebooting, and partition-only updates.
- SecureSMX creates an isolated partition framework for systems to plug in components and legacy code for testing, achieving hardware-enforced DevSecOps, agile programming, and CI/CD techniques.
- The solution is not fighting a never-ending war with CVEs but rather the containment of CVEs.
Read Full Article
Like
For uninterrupted reading, download the app