281 results
SBOM · Standards & regulation
SLSA explained: supply-chain levels for software artifacts
What SLSA v1.2's Build and Source tracks require at each level, who maintains the framework, and how it relates to firmware SBOM and secure build evidence.
11 min read Updated
OT/ICS security · Protocol security
Sparkplug B protocol security: what MQTT's SCADA layer protects, and what it doesn't
Sparkplug B's own specification calls its security chapter 'guidance only' and 'non-normative' — authentication, encryption and access control are left entirely to the MQTT broker. What that means for Birth/Death certificates, sequence numbers, a real Ignition vulnerability, and the AI analytics increasingly built on top of Sparkplug data.
8 min read Updated
SBOM · Standards & regulation
SPDX 3.0, explained: what changed for SBOMs
What SPDX 3.0 (released April 2024) actually changed from SPDX 2.x — the nine-profile model, the RDF-based data graph, the new Security and AI profiles with built-in VEX relationships, and where it stands next to CycloneDX and ISO/IEC 5962.
9 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
SSVC: Stakeholder-Specific Vulnerability Categorization, explained
CISA and Carnegie Mellon SEI's SSVC decision-tree model for vulnerability prioritization — the decision points, CISA's Track/Track*/Attend/Act outcomes, and how it differs from CVSS scoring.
10 min read Updated
Firmware vulnerabilities & fixes · Protocol security
Thread protocol security: what the mesh actually protects, and where commissioning breaks
Thread Group's own marketing calls Thread's security 'bank-grade,' built on a network-wide key, DTLS-protected commissioning and, since 2024, certificate-based TCAT. But a peer-reviewed test of OpenThread-based networks found the commissioning step itself could be jammed, password-guessed or hijacked to recover that same network key. What device makers and Matter integrators actually need to verify.
6 min read Updated
Medical & regulated devices · Standards & regulation
TISAX (automotive supply chain information security assessment), explained
What TISAX actually is: ENX's VDA ISA-based assessment, the AL1-AL3 assessment levels, the 0-5 maturity scale, label validity, and the 2026 ISA2027 catalogue transition suppliers need to track.
6 min read Updated
OT/ICS security · Protocol security
TriStation protocol security: the protocol TRITON/TRISIS exploited
TriStation is the proprietary protocol Schneider Electric's Triconex safety controllers speak with no built-in authentication. What CISA's HatMan report and the 2017 TRITON/TRISIS attack actually found, and the keyswitch and network controls that remain the only defense.
9 min read Updated
OT/ICS security · Standards & regulation
TSA Pipeline Security Directives: what covered operators must do
What TSA's two pipeline cybersecurity directive series actually require: 24/7 coordinators and incident reporting under SD-01, and the Cybersecurity Implementation/Incident Response/Assessment Plans under SD-02C/SD-02D, with current effective dates.
5 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
U-Boot bootloader security for embedded firmware, explained
How U-Boot's FIT verified boot actually works, how to harden its console and environment variables, and real CVEs (CVE-2018-3968, CVE-2020-10648, CVE-2025-24857) that bypassed it.
7 min read Updated
OT/ICS security · Protocol security
UDS (ISO 14229) security: the protocol that can reflash an ECU, and what guards it
UDS — ISO 14229, run over ISO 15765-2 CAN transport — is the service set a dealer tool uses to read trouble codes and reflash ECU firmware. Its SecurityAccess (0x27) seed-key gate has a documented history of weak OEM implementations. What the Jeep Cherokee research actually found about it, what a 2024 academic paper demonstrated on a real truck, and what NHTSA recommends.
11 min read Updated
Firmware vulnerabilities & fixes · Standards & regulation
UL 2900-1 (software cybersecurity for network-connectable products), explained
UL 2900-1 (ANSI/CAN/UL 2900-1, Edition 2, December 2023) — its three requirement areas, what it explicitly excludes, the UL Cybersecurity Assurance Program (UL CAP) built on it, and its August 2017 FDA recognition for medical device premarket submissions.
5 min read Updated
Medical & regulated devices · Standards & regulation
UL 2900-2-1 (software cybersecurity for healthcare and wellness systems), explained
UL 2900-2-1 (ANSI/CAN/UL 2900-2-1, Edition 1, September 2017, revised September 2023) — the healthcare-specific companion to UL 2900-1, its scope over medical devices and wellness products, and its June 2018 FDA recognition for premarket submissions.
10 min read Updated
OT/ICS security · Standards & regulation
UL 2900-2-2 (industrial control systems cybersecurity), explained
UL 2900-2-2 (Outline of Investigation, Issue 1, March 2016) — its ICS-specific scope on top of UL 2900-1, and why ISA's 2019 appeal kept it from ever becoming an ANSI-approved standard.
5 min read Updated
PSIRT & disclosure · Playbook
Vulnerability disclosure policy template and security.txt guide
A free vulnerability disclosure policy template for device makers, plus how to publish security.txt (RFC 9116) with a ready example. Fits CRA and PSTI.
5 min read Updated
OT/ICS security · Protocol security
Wi-SUN protocol security: the CVE record behind smart grid mesh networks
Wi-SUN mesh networking runs the field area networks behind smart electricity, gas and water meters worldwide. Three disclosed CVEs against Silicon Labs' Wi-SUN stack — two missing MAC-layer authorization checks and one predictable-key handshake flaw — show what happens when a utility-scale mesh protocol's security model has gaps.
5 min read Updated
OT/ICS security · Protocol security
Z-Wave protocol security, explained
How Z-Wave's S0 and S2 security frameworks actually work, why S2 became mandatory for certification in April 2017, the 2018 Z-Shave (CVE-2018-25029) downgrade attack, and what ITU-T G.9959 standardization means for building-automation deployments.
11 min read Updated
Firmware vulnerabilities & fixes · Protocol security
Zigbee security: AES-128 by design, and why the join moment is still where it breaks
Zigbee encrypts its mesh with AES-128-CCM and has spent a decade hardening how devices join, but the well-known default link key and the network-key handoff at join time remain the documented weak point. What CSA's own Zigbee 4.0 changes, independent research and real CVEs actually found.
11 min read Updated
Questions about this page?