The real impact of the Cyber Resilience Act

By Eduard de Knegt is CTO of Recogtec When people discuss the European Cyber Resilience Act (CRA), the conversation almost always ends up focusing on software updates. After all, manufacturers will be expected to monitor vulnerabilities, address security issues and provide security updates throughout the supported lifetime of their products. I believe we are looking at the wrong part of the problem. Software updates are not the real challenge. They are simply the visible outcome of a much larger cybersecurity process. For many years, software updates within the physical security industry were mainly driven by functionality. A customer wanted a new feature, a software defect had to be corrected or a new software version became available. Once a system had been installed, it was often left unchanged for years. In many cases that was perfectly acceptable. The Cyber Resilience Act fundamentally changes this way of thinking. Cybersecurity no longer ends when a product is delivered. From that moment on manufacturers must continuously monitor new vulnerabilities, check whether their products are affected and take action where necessary. That process includes vulnerability monitoring, penetration testing, risk assessments, secure software development, validation, documentation and the controlled delivery of security updates. The update that reaches the customer is only the final result of that actions. But how do you safely deliver security updates to organisations that do not have their operational security systems connected to the internet? Within many critical infrastructure environments, limiting external connectivity is a architectural decision. It is not driven by the CRA or by NIS2. It is driven by operational security. These organisations want complete control over everything that enters their operational environment. Every software version is reviewed. Every change follows a controlled process. Every update is assessed before it is allowed into production. very update is reviewed before it is allowed into production. Keeping operational systems running is often just as important as cybersecurity. This software updates become part of the overall security architecture. Many biometric systems have become increasingly integrated with the customer's IT infrastructure. Authentication services, databases, middleware and access control platforms often operate as integrated components within the customer's IT environment. This also introduces dependencies. The more systems are connected, the greater the potential impact of a software update can be. System architecture will become increasingly important in the years ahead. Not only for cybersecurity, but also for long-term maintainability. A clear separation between biometric user enrollment, biometric identification or verification, access control authorisation, communication with external systems and software management limits the potential impact of software changes and makes products easier to maintain during their operational lifetime. In my opinion, this is where the real impact of the Cyber Resilience Act will become visible. The legislation is not simply changing the way software is updated. It is changing the way secure products should be designed. For the biometric industry, this means that system architecture will become just as important as functionality. Because the question is no longer if manufacturers can develop secure software but if they can maintain, distribute and support that software safely during the lifecycle of the product without compromising the security architecture of the organisations. About the author Eduard de Knegt is CTO of Recogtech , a company specialising in biometric access control systems and secure system architecture.

By Eduard de Knegt is CTO of RecogtecWhen people discuss the European Cyber Resilience Act (CRA), the conversation almost always ends up focusing on software updates. After all, manufacturers will be expected to monitor vulnerabilities, address security issues and provide security updates throughout the supported lifetime of their products. I believe we are looking at the wrong part of the problem.

Software updates are not the real challenge. They are simply the visible outcome of a much larger cybersecurity process. For many years, software updates within the physical security industry were mainly driven by functionality.

A customer wanted a new feature, a software defect had to be corrected or a new software version became available. Once a system had been installed, it was often left unchanged for years. In many cases that was perfectly acceptable.

The Cyber Resilience Act fundamentally changes this way of thinking. Cybersecurity no longer ends when a product is delivered. From that moment on manufacturers must continuously monitor new vulnerabilities, check whether their products are affected and take action where necessary.

That process includes vulnerability monitoring, penetration testing, risk assessments, secure software development, validation, documentation and the controlled delivery of security updates. The update that reaches the customer is only the final result of that actions. But how do you safely deliver security updates to organisations that do not have their operational security systems connected to the internet?Within many critical infrastructure environments, limiting external connectivity is a architectural decision.

It is not driven by the CRA or by NIS2. It is driven by operational security. These organisations want complete control over everything that enters their operational environment.

Every software version is reviewed. Every change follows a controlled process. Every update is assessed before it is allowed into production.

very update is reviewed before it is allowed into production. Keeping operational systems running is often just as important as cybersecurity. This software updates become part of the overall security architecture.

Many biometric systems have become increasingly integrated with the customer's IT infrastructure. Authentication services, databases, middleware and access control platforms often operate as integrated components within the customer's IT environment. This also introduces dependencies.

The more systems are connected, the greater the potential impact of a software update can be. System architecture will become increasingly important in the years ahead. Not only for cybersecurity, but also for long-term maintainability.

A clear separation between biometric user enrollment, biometric identification or verification, access control authorisation, communication with external systems and software management limits the potential impact of software changes and makes products easier to maintain during their operational lifetime. In my opinion, this is where the real impact of the Cyber Resilience Act will become visible. The legislation is not simply changing the way software is updated.

It is changing the way secure products should be designed. For the biometric industry, this means that system architecture will become just as important as functionality. Because the question is no longer if manufacturers can develop secure software but if they can maintain, distribute and support that software safely during the lifecycle of the product without compromising the security architecture of the organisations.

About the authorEduard de Knegt is CTO of Recogtech, a company specialising in biometric access control systems and secure system architecture.