Download the full article
Free PDF. Tell us where to send it and the download opens immediately.
By submitting, you agree to receive the article and follow-up notes from Crimson7. See our privacy policy.
The full argument, with the record behind it
The blog post is the shorter edition. The full article sets out each part in depth, with links to the public sources behind it.
Ordinary functions, physical loss
How remote-control functions working as designed spoiled food across Europe, and why an access route and a control path are different problems.
The CRA makes difficult work mandatory
What the regulation asks of manufacturers and of operators, and why waiting for legal certainty never covered known unsafe states.
The knowledge predated the incidents
From NIST SP 800-82 and Project Basecamp to Mirai and OT:ICEFALL: the weaknesses were public years before they were exploited.
Testing that reaches the physical function
Following the control path across product, remote services and process, on representative devices and simulators instead of the live fleet.
The historical record
Stuxnet, Ukraine 2015, CRASHOVERRIDE, TRISIS, EKANS, PIPEDREAM, Unitronics, FrostyGoop and Volt Typhoon, and what each changed for defenders.
Evidence and the first decision
What counts as evidence that a control works, and three steps any organization can take without a vendor.
It closes with disclosures and evidence limits. General guidance, not legal advice.
For anyone who builds, runs or secures connected equipment
Vendors of connected products
The vendor sets the architecture, the defaults, the update mechanism and the support window. The CRA turns those decisions into obligations.
Operators and integrators
Know what you have deployed, what of it is reachable from the internet, who holds service-provider access, and how it recovers.
Security and risk leads
Security scope has to follow the physical function, not the invoice. The paper sets out what evidence shows a control actually works.
Can an unauthorized user drive your product into an unsafe state?
A first engagement can stay small: one architecture reviewed, or one representative product tested, with the safety controls and evidence agreed up front.