The Storm Is Coming: The Cyber Resilience Act And Your Use Of Open Source

The Cyber Resilience Act (CRA) is set to reshape how open-source software is utilized in Europe, imposing new compliance requirements on developers and organizations. Marta Rybczynskańska, Founder of Ygreky, will delve into this critical topic at Code Europe in Kraków (June 30-July 1), offering insights on navigating these regulatory changes.

As open source becomes integral to software development, understanding the CRA’s implications is crucial. The act mandates stricter security standards, vulnerability disclosures, and compliance checks for software products, including those built with open-source components.

You Should Know:

1. Key Requirements of the Cyber Resilience Act:

Security by Design: Software must adhere to strict security principles from development to deployment.
Vulnerability Reporting: Developers must establish processes for identifying and reporting vulnerabilities.
Compliance Documentation: Organizations must maintain detailed records of open-source components used.

2. Practical Steps for Compliance:

SBOM (Software Bill of Materials): Generate an SBOM to track open-source dependencies.
```
syft scan <your-repo> -o spdx > sbom.spdx 
```
Static Application Security Testing (SAST): Use tools like `semgrep` or `SonarQube` to detect vulnerabilities early.
```
semgrep --config=p/security-audit . 
```
Patch Management: Automate updates for open-source libraries using `dependabot` or renovate.

3. Linux & Windows Commands for Security Audits:

Linux:

Check for vulnerable packages (Debian/Ubuntu) 
apt list --upgradable 
Audit system with Lynis 
sudo lynis audit system

Windows:

List installed software (PowerShell) 
Get-WmiObject -Class Win32_Product | Select Name, Version 
Check for system vulnerabilities 
Install-Module -Name PSWindowsUpdate 
Get-WindowsUpdate -Install

4. Secure Development Practices:

Use `gpg` to sign Git commits for integrity:
```
git config --global commit.gpgsign true 
```
Enable SELinux/AppArmor for mandatory access control:
```
sudo setenforce 1  Enforce SELinux 
```

What Undercode Say:

The Cyber Resilience Act underscores the need for proactive security in open-source adoption. Developers must integrate compliance into CI/CD pipelines, leverage automation for vulnerability scanning, and maintain transparency in software supply chains. Tools like Trivy, Clair, and `OpenSCAP` can streamline audits, while frameworks like NIST SP 800-218 (SSDF) align with CRA requirements.