Codewerk provides services that cover the security life cycle, including secure development, testing, and monitoring. All services help you tackle the Cyber Resilience Act (CRA).
Secure Development
- Gap Analysis: evaluation of current security measures in the development process and customer application to identify gaps compared to the industry standards IEC 62443-4-1(process) and IEC 62443-4-2(component). This is the basis for creating a development concept and architecture. Gap analysis helps assess the time and cost needed for concept and implementation
- Concept & Architecture: creation of security concepts and architectures for embedded systems that take threat models and security mechanisms into account. This provides the basis for implementation
- IEC 62443-4-2 Development: implementation of the security requirements for industrial components in accordance with IEC 62443-4-2. This includes integrating security functions such as authentication and cryptography into the application
- Code Review: systematic review of the source code for security gaps, vulnerabilities, CWE, and violations of secure coding guidelines. The aim is to minimize security risks from the earliest possible stage of the development process
Secure Testing
- Penetration Testing: simulation of targeted attacks on hardware and firmware to identify vulnerabilities and potential exploit possibilities. This includes black-box, white-box, and gray-box testing
- Fuzzing: this is an automated test procedure in which random or unexpected inputs are generated to provoke errors or security vulnerabilities. This is particularly relevant for interfaces and proprietary communication protocols and can be done based on Black-box, white-box, or gray-box. Also, source-code based fuzzing is possible
- Automated Infrastructure as a Service: use of automated test and build pipelines for continuous security checks. This enables early and recurring validation of security requirements
Secure Monitoring
- Continuous Vulnerability Monitoring: ongoing monitoring of the software components to guard against new vulnerabilities by continuous checking of known-vulnerability databases and security feeds, to be able to react promptly to threats
- Continuous Integration: incorporating automated security scans and tests into the CI/CD pipeline to seamlessly integrate security checks into the development and release process
- Advisory Generation: creation and publication of security advisories and updates for discovered vulnerabilities to proactively inform customers and partners about security risks and corresponding countermeasures
| Supported Devices | STM32H7, STM32MP1, STM32MP2 |
| Site |
| ST Products |
|---|
Served Countries:
Worldwide
