ONEKEY 360° Comprehensive Product Cybersecurity & Compliance
This whitepaper targets, Head of Product Cybersecurity, Product Owner, Compliance Professionals and Head of Development of manufacturers of connected devices.
EXECUTIVE SUMMARY
Smart product manufacturers face the challenges of rapidly evolving digital threats and increasing regulatory requirements, creating a complex and enormous pressure to secure their devices while complying with stringent standards. This is where ONEKEY 360° steps in, offering a solution that blends cutting-edge cybersecurity automation with expert oversight to provide a comprehensive security and compliance framework.
At the heart of ONEKEY 360° is its ability to automate critical cybersecurity tasks—vulnerability assessments, compliance checks, and Software Bill of Materials (SBOM) generation—saving companies time and resources while ensuring thoroughness. But it doesn’t stop there. The platform continuously monitors devices for new threats, delivering real-time alerts and actionable insights. Compliance is also front and center, with support for regulations like the Cyber Resilience Act (CRA), IEC 62443 and many others, making it easier for companies to meet evolving global standards.
Yet, what truly sets ONEKEY 360° apart is the integration of human expertise. From tailored security consulting to manual penetration testing, the platform goes beyond automation to address complex security challenges that require a nuanced, human touch. Whether it’s interpreting vulnerabilities or navigating multi-standard regulatory environments, the ONEKEY team is there to guide companies every step of the way.
By streamlining security, reducing costs, and delivering expert-driven solutions, ONEKEY 360° empowers organizations to proactively protect their devices, reduce regulatory risk, and focus on innovation—knowing their cybersecurity is in expert hands.
HINTERGRUND
DER NEUE EUROPÄISCHE CYBER-RESILIENZ-Act (CRA) ZIELT AUF DIE ERHÖHUNG DES SICHERHEITSNIVEAUS UND DER TRANSPARENZ AB
Am 15. September 2022 veröffentlichte die Agentur der Europäischen Union für Cybersicherheit (ENISA) den Entwurf des neuen Cyber Resilience Act (CRA), welcher nach Anpassungen und Beschluss der EU per 10. Dezember 2024 in Kraft getreten ist. Der CRA gilt in der gesamten Europäischen Union und weltweit für alle Hersteller, Importeure und Händler von Produkten mit digitalen Elementen, die ihre Produkte in der EU vermarkten. Der CRA zielt darauf ab, das Sicherheitsniveau aller Produkte mit digitalen Elementen in der Europäischen Union zu erhöhen, indem sie die Hersteller verpflichtet, einen Cybersicherheitsrahmen zu implementieren und aufrechtzuerhalten und diesen Rahmen während des gesamten Produktlebenszyklus einzuhalten. Darüber hinaus wird eine verbesserte Transparenz in Bezug auf Sicherheitseigenschaften es Verbrauchern und Unternehmen ermöglichen, sicherheitsbewusste Entscheidungen zu treffen und Produkte mit digitalen Elementen sicherer zu verwenden.
BEGRENZTE HANDLUNGSZEIT FÜR PRODUKTE MIT DIGITALEN ELEMENTEN
Diese Initiative der ENISA folgt auf die zunehmenden Schäden durch Cyberkriminalität, die 2021 zu weltweiten Kosten von mehr als 5,5 Billionen Euro führten. Viele dieser Cyberangriffe werden durch Sicherheitslücken in Produkten mit digitalen Elementen verursacht und durch die mangelnde Transparenz der Hersteller in Bezug auf relevante Sicherheitseigenschaften noch verschärft. Während die CRA ein breites Spektrum an „Produkten mit digitalen Elementen“ ins Visier nimmt, das von Betriebssystemen, Desktop- und mobilen Anwendungen bis hin zu Hardwaregeräten und Netzwerkgeräten reicht, konzentriert sich dieses Whitepaper auf vernetzte Geräte und richtet sich an Hersteller, Händler und Importeure solcher Geräte.
Der CRA wurde in 2024 von der Europäischen Kommission als Europäische Richtlinie verabschiedet und ist per 10. Dezember 2024 in Kraft getreten. Dadurch bleibt — selbst mit der Übergangsfrist bis 10. Dez 2026 — nur wenig Zeit, um die erforderlichen Berichtspflichten zu verabschieden und die verbleibenden grundlegenden Anforderungen zu erfüllen. Aufgrund mehrjähriger Konstruktions- und Entwicklungszyklen müssen alle Hersteller jetzt handeln. Nur Geräte, die durch die Verordnung (EU) 2018/1139 (Zivilluftfahrt), die Verordnung (EU) 2017/745 (Medizinprodukte) und die Verordnung reguliert werden (EU) 2017/746 (medizinische In-vitro-Diagnostika) oder gemäß der Verordnung (EU) 2019/2144 zertifizierte Geräte (Typgenehmigung von Kraftfahrzeugen und ihren Anhängern sowie für solche Fahrzeuge bestimmte Systeme, Bauteile und selbstständige technische Einheiten...) sind ausgenommen von der CRA. Angesichts der durchschnittlichen mehrjährigen Zeitspanne zwischen der Entwicklung und der Produktion der angeschlossenen Geräte bleibt nur wenig Zeit für die Annahme und Anwendung der notwendigen Sicherheitsänderungen.
ÜBERBLICK ÜBER DIE CRA ANFORDERUNGEN
Während der CRA erweiterte Sicherheitsverpflichtungen für die Erfüllung der grundlegenden Sicherheitsanforderungen festlegt, wie z. B. Konformitätsbewertungen durch Dritte für kritische Produkte (sowohl für Klasse I als auch für Klasse II), bleiben die zugrunde liegenden Anforderungen für alle Produkte gleich. Die neuen Anforderungen der CRA lassen sich grob in die drei Kategorien Governance, Produktentwicklung und Berichterstattung einteilen:
ANFORDERUNGEN AN DIE PRODUKTENTWICKLUNG
1. Anforderungen, die das Produkt selbst betreffen, definieren ein Mindestmaß an Sicherheitseigenschaften, um das Produkt vor Cyberangriffen zu schützen und sein Sicherheitsniveau zu erhöhen.
ANFORDERUNGEN AN DIE UNTERNEHMENSFÜHRUNG
2. Anforderungen, die sich auf die Prozesse des Softwareentwicklungszyklus (SDLC) des Herstellers auswirken, wie Konzept und Design, Entwicklung, Produktion und Markteinführung sowie Service und Support, sollen die Sicherheit erhöhen, sichere Produkte zu entwickeln und ihr Sicherheitsniveau auf wiederholbare, transparente und nachhaltige Weise aufrechtzuerhalten, die mit angemessenen Sicherheitskontrollen messbar ist.
ANFORDERUNGEN AN DIE BERICHTERSTATTUNG
3. Melde- und Informationspflichten gegenüber den Überwachungsbehörden und Nutzern von Produkten über ausgenutzte Sicherheitslücken und Vorfälle, die das Produkt betreffen, stellen sicher, dass Maßnahmen zur Schadensbegrenzung zeitnah umgesetzt werden können. Ziel ist es, den Zeitrahmen, in dem sowohl Endnutzer als auch Anbieter kritischer Infrastrukturen durch kritische Sicherheitslücken Cyberbedrohungen ausgesetzt sind, zu minimieren, um das allgemeine Sicherheitsniveau der europäischen digitalen Infrastruktur zu erhöhen, indem bereitgestellte Korrekturen oder Zwischenmaßnahmen ergriffen werden, um die Auswirkungen der Sicherheitslücke zu verringern.
CRA-ANFORDERUNGEN DECKEN SICHERHEITSLÜCKEN IN DER LIEFERKETTE AB
Die folgende Abbildung gibt einen Überblick über die wichtigsten Anforderungen und deren Zusammenhang mit den jeweiligen Phasen des Produktsicherheitslebenszyklus. Ihr Zweck besteht darin, tiefgreifende und sichere Schutzansätze zu unterstützen und zu gewährleisten, mit dem Ziel, die Gewissheit zu schaffen, dass die Produkte die erhöhten Sicherheitserwartungen des europäischen Marktes erfüllen. Eine zentrale Anforderung des CRA ist das Risikomanagement in der Lieferkette.
ONEKEY 360: THE HUMAN EXPERTISE BEHIND A HOLISTIC CYBERSECURITY SOLUTION
Expert Support
ONEKEY 360 offers unparalleled access to top cybersecurity knowledge, providing guidance and insights that go beyond automated analysis. The knowledge and experts are available at your fingertips, providing insights and advice to help you quickly and effectively mitigate vulnerabilities. With ONEKEY 360, you benefit from our expert’s knowledge that helps you to:
- Understand the Severity of Vulnerabilities: Gain a clear understanding of the risks posed by vulnerabilities discovered in your device’s firmware.
- Receive Tailored Mitigation Strategies: Get customized recommendations on how to address identified vulnerabilities, ensuring your devices are secure.
- Enhance Your Security Posture: Receive guidance on improving the overall security and compliance posture of your devices and infrastructure.
Requirement Definition & Implementation
ONEKEY 360 is designed with ease of use in mind, starting with a thorough requirement definition phase led by our top cybersecurity experts. During this phase, we provide valuable insights and support by:
- Collaborating to Define Security Requirements: Work together with our experts to define your specific security needs.
- Designing a Customized Analysis Plan: We create a tailored plan for analyzing your devices and infrastructure.
- Developing a Detailed Implementation Strategy: Our experts develop a comprehensive scope of work and implementation plan to ensure your security goals are met.
Augmented Professional Services
ONEKEY 360 goes beyond core analysis, offering a range of professional services that enhance your cybersecurity and compliance efforts. These services include:
Service Setup & Integration: Our specialists assist with setting up and integrating ONEKEY 360 with your existing tools and workflows, ensuring a seamless experience.
Staff Training: We provide training to your team, empowering them to use the platform effectively and interpret results with confidence.
Service Customization: ONEKEY 360 can be tailored to meet your specific needs, ensuring that your security strategy is aligned with your organization’s goals.
Comprehensive Vulnerability Testing: Manual penetration testing on entire architectures, cloud services, third-party components, and hardware systems identifies security vulnerabilities not covered by automated analysis.
Regulatory Compliance Consulting: In-depth compliance assessments for complex architectures and third-party components ensure adherence to standards such as IEC 62443,Cyber Resilience Act (CRA), and Radio Equipment Directive(RED).
Tailored Security Solutions: We provide customized advice and solutions to enhance the security and compliance posture of your entire infrastructure, addressing both automated and manual aspects.
Holistic Security Approach: By integrating manual testing and consulting services, ONEKEY 360 ensures a robust, comprehensive, and fully compliant security strategy for your organization.
Initial Setup & Support: ONEKEY 360 is user-friendly, with an initial setup process fully supported by our Customer Success team. This team ensures a smooth start, helping you get the most out of ONEKEY 360 from day one and addressing any questions you may have.
Cost-Effective, Expert-Driven Solution: ONEKEY 360 is a highly cost-effective solution that empowers organizations lacking the resources, skills, or expertise to achieve and maintain cutting-edge product cybersecurity and compliance. Our experts work alongside your development and product teams to implement new processes or optimize existing ones, sharing their knowledge to enhance process
Key features of ONEKEY 360
SBOM Generation
With ONEKEY 360, you can automatically generate a complete Software Bill of Materials (SBOM) directly from the binary firmware image of your device. This provides you with a detailed inventory of all software components used in your device, including their versions and licenses. By having a clear and comprehensive SBOM, you gain full visibility into your software supply chain, enabling better management of open-source components and ensuring compliance with licensing requirements.
Advanced Security Analysis
ONEKEY 360 conducts an in-depth security analysis of your device’s firmware, identifying zero-day vulnerabilities, outdated components, insecure coding practices, and cryptographic weaknesses. This thorough analysis helps you uncover and address potential security risks before they can be exploited, significantly enhancing the resilience of your devices. By proactively identifying these vulnerabilities, you can mitigate risks quickly and protect your devices against emerging threats.
Comprehensive Compliance Check
Ensuring that your devices comply with national and international security standards is critical. ONEKEY 360 performs a meticulous compliance check of your device’s firmware, assessing its adherence to standards such as IEC62443, UNR155, and theOWASP TOP 10 for IoT. This automated compliance verification not only simplifies the audit process but also provides peace of mind that your devices meet industry regulations, reducing the risk of non-compliance penalties and improving your marketability.
24/7 Continuous Monitoring
ONEKEY 360 offers continuous, round-the-clock monitoring of your device’s firmware, keeping a vigilant eye out for new vulnerabilities. If any issues are detected, you are immediately alerted, allowing you to take swift action. This real-time monitoring ensures that your devices remain secure even as new threats emerge, providing ongoing protection and reducing the likelihood of security breaches.
Digital Twin Technology
Leverage the power of digital twin technology with ONEKEY360, which creates a cybersecurity related digital replica of your device’s firmware. This allows for further security analysis without requiring access to the source code, physical device, or network connection. By using a digital twin, you can conduct extensive binary testing and analysis ensuring that your devices are secure without disrupting your operations.
Seamless Integration
ONEKEY 360 seamlessly integrates with your existing development and security tools, streamlining the security analysis process. This integration reduces the complexity of managing multiple tools and ensures that security is embedded throughout your development lifecycle. By integrating with your current workflows, ONEKEY 360 enhances your security posture without requiring significant changes to your processes.
Effortless Implementation
ONEKEY 360 is designed for ease of use, requiring no upfront investment in hardware or software. This means you can quickly and easily implement ONEKEY 360 into your existing environment, minimizing downtime and allowing you to focus on your core business activities. The simplicity of implementation ensures that even organizations with limited technical resources can benefit from robust cybersecurity protection.
Expert Support at Your Fingertips
ONEKEY 360 provides access to a team of cybersecurity experts who are ready to assist you in understanding the results of your security analysis. These experts offer personalized guidance and recommend effective mitigation strategies, ensuring that you can address vulnerabilities swiftly and confidently. With ONEKEY360, you are never alone in your cybersecurity journey—our experts are here to support you every step of the way, adding significant value to your security efforts.
ONEKEY 360: THE ULTIMATE CYBERSECURITY SOLUTION FOR YOUR IOT AND OT DEVICES
1. Hybrid Approach: Automation + Expert Knowledge
With ONEKEY 360, you get the best of both worlds—a powerful combination of automated security analysis and top-tier cybersecurity expertise. This hybrid approach ensures that
you achieve faster, more efficient, and comprehensive results compared to solutions that rely solely on manual consulting or automation. The integration of human expertise with cutting-edge technology allows us to address complex security challenges with precision, providing you with a superior, end-to-end security solution.
2. Enhanced Security
Protect your IoT and OT devices more effectively with ONEKEY360. Our advanced automated tools, coupled with expert insights, allow you to identify and fix vulnerabilities faster—before they
can be exploited by attackers. By leveraging automation, we can complete detailed analyses in minutes rather than days or weeks, significantly reducing the risk of breaches and ensuring your devices remain secure at all times.
3. Cost Efficiency
ONEKEY 360 offers a cost-effective solution that saves you both time and money. Our automated security analysis process delivers rapid results without compromising quality, allowing you to allocate resources more efficiently. By combining automation with expert oversight, we minimize the need for expensive, dedicated in-house resources, enabling you to maintain a high level of security without breaking the bank.
4. Simplified Compliance
Navigating the complexities of regulatory compliance has never been easier with ONEKEY 360. Our platform not only automates compliance checks, ensuring your devices meet all relevant security standards with minimal effort, but also provides expert guidance to help you understand and adhere to complex regulatory requirements. This seamless approach simplifies the compliance process, allowing you to focus on innovation while we handle the intricacies of regulatory adherence.
5. Augmented Expertise
ONEKEY 360 bridges the gap in your in-house cybersecurity expertise. Our team of dedicated professionals stays ahead of the latest threats and mitigation strategies, bringing the most current knowledge to your security practices. Whether you lack specialized skills or simply need to bolster your existing team,ONEKEY 360 ensures that your devices are protected with the highest level of expertise available.
6. Peace of Mind
With ONEKEY 360, you can rest easy knowing that your devices are secure. Our holistic approach, which combines cutting-edge technology with expert support, ensures that all your security needs are fully covered. This comprehensive protection provides you with the confidence and peace of mind that your organization’s digital assets are safeguarded against threats, allowing you to focus on what you do best—growing your business.
AUTOMATION & SUPPORT TO ACHIEVE & MAINTAIN CRA SECURITY REQUIREMENTS & COMPLIANCE
ONEKEY’S SECURITY EXPERTS’ ADVICE & AUTOMATION
In addition to reducing manual efforts by adding automated controls to processes required by the CRA, ONEKEY aids manufacturers, importers, and distributors of products with digital elements in adopting processes required by the CRA with gap analyses and implementation support.
ONEKEY‘s automated firmware security analysis platform can automatically detect and report violations of essential cybersecurity requirements as defined in Section 1 of Annex I of the CRA. Expanding on ONEKEY’s automated capabilities, ONEKEY’s technical experts and security researchers are also available to identify gaps to a product’s adherence to the CRA and to conduct penetration tests and vulnerability assessments on affected connected devices.
KEY TAKE AWAYS
Manufacturers need to act now to ensure product compliance:
- With attacks on connected devices on the rise, ENISA has defined essential requirements to increase the level of security of connected devices and established a framework to foster cooperation and information sharing on new vulnerabilities and emerging threats.
- CRA provides the toolset to produce such cyber-resilient connected devices, especially from a supply-chain risk’s perspective.
- To meet elevated security and compliance requirements and to tackle supply-chain risks, implementation of automated security and compliance controls, i.e., holistic binary software analysis, are required. Automated initial software analysis and continuous monitoring will substantially reduce efforts for implementation and maintaining CRA compliance.
- The ONEKEY platform automates essential cybersecurity and compliance processes, as required by the CRA. Vulnerability management, assessment, prioritization and monitoring are practically automated, and the required reporting obligation is also met through extensive reporting.
Interested in further discussion with our security experts on how to achieve and maintain your CRA product security compliance? Please contact our security experts at: experts@onekey.com
Bereit zur automatisierung ihrer Cybersicherheit & Compliance?
Machen Sie Cybersicherheit und Compliance mit ONEKEY effizient und effektiv.