244 results
UL 2900-2-2 (industrial control systems cybersecurity), explained
UL 2900-2-2 (Outline of Investigation, Issue 1, March 2016) — its ICS-specific scope on top of UL 2900-1, and why ISA's 2019 appeal kept it from ever becoming an ANSI-approved standard.
4 min read Updated
Vulnerability disclosure policy template and security.txt guide
A free vulnerability disclosure policy template for device makers, plus how to publish security.txt (RFC 9116) with a ready example. Fits CRA and PSTI.
5 min read Updated
Z-Wave protocol security, explained
How Z-Wave's S0 and S2 security frameworks actually work, why S2 became mandatory for certification in April 2017, the 2018 Z-Shave (CVE-2018-25029) downgrade attack, and what ITU-T G.9959 standardization means for building-automation deployments.
4 min read Updated
Zigbee security: AES-128 by design, and why the join moment is still where it breaks
Zigbee encrypts its mesh with AES-128-CCM and has spent a decade hardening how devices join, but the well-known default link key and the network-key handoff at join time remain the documented weak point. What CSA's own Zigbee 4.0 changes, independent research and real CVEs actually found.
11 min read Updated
Questions about this page?