You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/docs/getting_started/cravex.md
+88-37Lines changed: 88 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,58 +2,90 @@
2
2
3
3
The EU’s Cyber Resilience Act (CRA) aims to enhance the cybersecurity of
4
4
products with digital elements, ensuring that hardware and software sold in
5
-
the EU are designed with strong security measures. It stipulates that manufacturers remain responsible for cybersecurity throughout a product lifecycle.
5
+
the EU are designed with strong security measures. It stipulates that
6
+
manufacturers remain responsible for cybersecurity throughout a product lifecycle.
6
7
7
-
The AboutCode [CRAVEX](https://nlnet.nl/project/CRAVEX/#) (Cyber Resilience Application for Vulnerability Exploitability Exchange) project was designed
8
-
to make it easier for any organization to efficiently comply with the emerging CRA and other regulatory requirements and improve its overall security posture. A primary goal for **CRAVEX** is to provide an open source
9
-
solution for small- and medium-size enterprises (SMEs).
8
+
The [CRAVEX](https://nlnet.nl/project/CRAVEX/#) (Cyber Resilience Application
9
+
for Vulnerability Exploitability Exchange) project was designed to make it
10
+
easier for any organization to efficiently comply with the emerging CRA and
11
+
other regulatory requirements and improve its overall security posture. A
12
+
primary goal for **CRAVEX** is to provide an open source solution for small-
13
+
and medium-size enterprises (SMEs).
10
14
11
15
## Key CRA Provisions
12
16
At a summary level, the key CRA provisions include:
13
17
14
-
-**Cybersecurity**: Manufacturers must ensure that products with digital elements meet essential cybersecurity requirements, including risk
18
+
-**Cybersecurity**: Manufacturers must ensure that products with digital
19
+
elements meet essential cybersecurity requirements, including risk
15
20
assessments, security-by-design practices, and vulnerability management.
16
-
-**Vulnerability Reporting**: Manufacturers are required to report any actively exploited vulnerabilities to the European Union Agency for Cybersecurity (ENISA) within 24 hours.
17
-
-**Security Updates**: Manufacturers must provide timely and effective security updates to address vulnerabilities.
18
-
-**Documentation**: Manufacturers must provide documentation and certification to demonstrate compliance with CRA requirements.
21
+
-**Vulnerability Reporting**: Manufacturers are required to report any
22
+
actively exploited vulnerabilities to the European Union Agency for
23
+
Cybersecurity (ENISA) within 24 hours.
24
+
-**Security Updates**: Manufacturers must provide timely and effective
25
+
security updates to address vulnerabilities.
26
+
-**Documentation**: Manufacturers must provide documentation and
27
+
certification to demonstrate compliance with CRA requirements.
19
28
-**Enforcement**: The CRA includes penalties for non-compliance.
20
29
21
30
The most challenging CRA requirements for most organizations are those for
22
-
timely reporting and remediation of actively exploited vulnerabilities in a product. At a minimum this will require organizations to:
31
+
timely reporting and remediation of actively exploited vulnerabilities in a
32
+
product. At a minimum this will require organizations to:
23
33
24
-
- Create and maintain an accurate and current SBOM for each digital product (by version)
25
-
- Rapidly create and publish a VEX (Vulnerability Exploitability eXchange) document for any actively exploited vulnerability that affects a product
34
+
- Create and maintain an accurate and current SBOM for each digital product
35
+
(by version)
36
+
- Rapidly create and publish a VEX (Vulnerability Exploitability eXchange)
37
+
document for any actively exploited vulnerability that affects a product
26
38
27
-
The AboutCode focus for CRA compliance functions and features is the [**DejaCode**](https://dejacode.readthedocs.io/en/latest/reference-3-cravex.html) application.
39
+
The AboutCode focus for CRA compliance functions and features is the
Most modern product SBOMs are composed of some combination of:
31
45
32
46
- First-party code: Software created and owned by your organization.
33
47
- Open source code: Software acquired from an open source project and subject
34
48
to an open source license.
35
-
- Third-party proprietary code: Software acquired from a supplier that is subject to a proprietary license. In most cases today this code will include embedded open source software or have dependencies on open source software.
49
+
- Third-party proprietary code: Software acquired from a supplier that is
50
+
subject to a proprietary license. In most cases today this code will include
51
+
embedded open source software or have dependencies on open source software.
36
52
37
-
_NB: The CRA regulations apply to any code that you distribute. They do not normally apply to tools and other software for internal use-only._
53
+
_NB: The CRA regulations apply to any code that you distribute. They do not
54
+
normally apply to tools and other software for internal use-only._
38
55
39
-
In recent history, the focus for SBOMs has been open source software, but an accurate SBOM must include all first-party and third-party code in a product.
56
+
In recent history, the focus for SBOMs has been open source software, but an
57
+
accurate SBOM must include all first-party and third-party code in a product.
40
58
This means that you need to request accurate and current SBOMs from your
41
-
proprietary software suppliers and have tools that enable you to import and manage third-party SBOMs into your SBOM management system.
59
+
proprietary software suppliers and have tools that enable you to import and
60
+
manage third-party SBOMs into your SBOM management system.
42
61
43
-
[DejaCode](https://dejacode.readthedocs.io/en/latest/) provides robust features to import, edit and export SBOMs in CycloneDX (versions 1.6, 1.5 or 1.4) or SPDX format (version 2.3). For CycloneDX you also have an option to export a combined SBOM + VEX document.
features to import, edit and export SBOMs in CycloneDX (versions 1.6, 1.5 or
64
+
1.4) or SPDX format (version 2.3). For CycloneDX you also have an option to
65
+
export a combined SBOM + VEX document.
44
66
- SBOM data are stored in **DejaCode** Products.
45
-
- You can also import scan data from [**ScanCode.io**](https://scancodeio.readthedocs.io/en/latest/) to create packages in **DejaCode**, enrich the package metadata, and assign them to a Product.
46
-
- The primary software identifier in **DejaCode** is [PURL (Package-URL)](https://package-url.github.io/www.packageurl.org/docs/purl/purl-spec-introduction).
47
-
- You can experiment with the Product/SBOM features with a free [DejaCode trial account](https://public.dejacode.com/account/register/)
67
+
- You can also import scan data from [ScanCode.io](https://scancodeio.readthedocs.io/en/latest/)
68
+
to create packages in **DejaCode**, enrich the package metadata, and assign
69
+
them to a Product.
70
+
- The primary software identifier in **DejaCode** is [PURL (Package-URL)](https://packageurl.org/docs/purl/introduction).
71
+
- You can experiment with the Product/SBOM features with a free [DejaCode
As you change software in your products you need to update the corresponding Product in **DejaCode** for each Product or SBOM version.
74
+
As you change software in your products you need to update the corresponding
75
+
Product in **DejaCode** for each Product or SBOM version.
50
76
51
77
## Vulnerability identification
52
-
After you have created an SBOM for each Product in [DejaCode](https://dejacode.readthedocs.io/en/latest/) you can quickly identify current applicable vulnerabilities for a Product using the dynamic **DejaCode** integration with [**VulnerableCode**](https://vulnerablecode.readthedocs.io/en/latest/). **DejaCode** displays vulnerabilities for Products, Components and Packages. In each case there is an option to display only items with a known vulnerability. DejaCode also provides reports with this information.
78
+
After you have created an SBOM for each Product in **DejaCode** you can
79
+
quickly identify current applicable vulnerabilities for a Product using the
80
+
dynamic **DejaCode** integration with [**VulnerableCode**](https://vulnerablecode.readthedocs.io/en/latest/). **DejaCode** displays vulnerabilities for Products, Components and Packages.
81
+
In each case there is an option to display only items with a known
82
+
vulnerability. DejaCode also provides reports with this information.
53
83
54
84
## Vulnerability analysis and triage
55
85
One of the most complex tasks for managing vulnerabilities is to determine
56
-
which vulnerabilities require your attention and in which order. For each vulnerability **DejaCode** provides three key metrics to support your analysis and triage:
86
+
which vulnerabilities require your attention and in which order. For each
87
+
vulnerability **DejaCode** provides three key metrics to support your analysis
88
+
and triage:
57
89
-_Exploitability_: Exploitability indicates the likelihood that a
58
90
vulnerability in a software package could be used by malicious actors to
59
91
compromise systems, applications, or networks. This metric is determined
@@ -67,14 +99,17 @@ maximum of 10.
67
99
**DejaCode** also shows you known Package version(s) that fix a vulnerability.
68
100
69
101
## VEX reporting
70
-
The standard format for reporting your analysis of exploitable vulnerabilities is VEX (Vulnerability Exploitability eXchange). There are currently three evolving VEX specifications:
102
+
The standard format for reporting your analysis of exploitable vulnerabilities
103
+
is VEX (Vulnerability Exploitability eXchange). There are currently three
104
+
evolving VEX specifications:
71
105
-[CSAF](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html) from
72
106
OASIS Open
73
107
-[CycloneDX VEX](https://cyclonedx.org/capabilities/vex/) from the CycloneDX
74
108
project
75
109
-[OpenVEX](https://openssf.org/projects/openvex/) from OpenSSF
76
110
77
-
It is not clear which of these specifications will become primary, but they all cover similar data.
111
+
It is not clear which of these specifications will become primary, but they
112
+
all cover similar data.
78
113
79
114
**DejaCode** provides a Product feature to record essential VEX data such as:
80
115
- Status: The current state of an occurrence of a vulnerability, after
@@ -88,21 +123,37 @@ You can easily export VEX information from **DejaCode** in CSAF, CycloneDX or
88
123
OpenVEX format.
89
124
90
125
## Integration with software development tools
91
-
A key requirement for efficient compliance with CRA or similar regulations is integration with your software development tools.
126
+
A key requirement for efficient compliance with CRA or similar regulations is
127
+
integration with your software development tools.
92
128
93
-
-**DejaCode** provides built-in integration with issue trackers: Forgejo, GitHub, GitLab, JIRA, SourceHut. This is a two-way integration where your issue tracker is primary and the issue data is shown in **DejaCode** Requests.
129
+
-**DejaCode** provides built-in integration with issue trackers: Forgejo,
130
+
GitHub, GitLab, JIRA, SourceHut. This is a two-way integration where your
131
+
issue tracker is primary and the issue data is shown in **DejaCode** Requests.
- CI/CD tools: GitHub Actions, GitLab, and Jenkins. This integration enables you to include **ScanCode.io** scans in your CI/CD pipelines or based on an event such as a commit.
97
-
- SCA tools: Anchore, cyclonedx-gomod, OSS Review Toolkit (ORT), OSV scanner, OWASP depscan, Microsoft sbom-tool, and Trivy. The primary functionality is to generate a CycloneDX SBOM from the SCA tool and load the SBOM into **ScanCode.io**.
134
+
- CI/CD tools: GitHub Actions, GitLab, and Jenkins. This integration
135
+
enables you to include **ScanCode.io** scans in your CI/CD pipelines or
scanner, OWASP depscan, Microsoft sbom-tool, and Trivy. The primary
139
+
functionality is to generate a CycloneDX SBOM from the SCA tool and load
140
+
the SBOM into **ScanCode.io**.
98
141
99
-
_NB: All integrations also offer a "generic" template that you can adapt for integration with other similar tools._
142
+
_NB: All integrations also offer a "generic" template that you can adapt for
143
+
integration with other similar tools._
100
144
101
145
## Coming soon
102
-
We are working on a new [CRAVEX 2 Code Reachability](https://nlnet.nl/project/CRAVEX2-codereachability/) project to make vulnerability triage faster and more efficient. The two major enhancements are:
103
-
104
-
- A rule-based system to automatically filter or rerank vulnerabilities in the context of a managed application, system or device. This will integrate the emerging SSVC scoring for decision tree-driven automation.
105
-
106
-
- Vulnerable code "reachability" to determine if the code impacted by a CVE is present, used and exploitable in a product. This will integrate and extend the features of other FOSS projects such as [BANG](https://github.com/armijnhemel/binaryanalysis-ng).
107
-
108
-
The **CRAVEX** projects are funded through the [NGI0 Entrust Fund](https://nlnet.nl/NGI0/), a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101069594.
146
+
We are working on a new [CRAVEX 2 Code Reachability](https://nlnet.nl/project/CRAVEX2-codereachability/)
147
+
project to make vulnerability triage faster and more efficient. The two major
148
+
enhancements are:
149
+
- A rule-based system to automatically filter or rerank vulnerabilities in the
150
+
context of a managed application, system or device. This will integrate the
151
+
emerging SSVC scoring for decision tree-driven automation.
152
+
- Vulnerable code "reachability" to determine if the code impacted by a CVE is
153
+
present, used and exploitable in a product. This will integrate and extend
154
+
the features of other FOSS projects such as [BANG](https://github.com/armijnhemel/binaryanalysis-ng).
155
+
156
+
The **CRAVEX** projects are funded through the [NGI0 Entrust Fund](https://nlnet.nl/NGI0/),
157
+
a fund established by NLnet with financial support from the European
158
+
Commission's Next Generation Internet programme, under the aegis of DG
159
+
Communications Networks, Content and Technology under grant agreement No 101069594.
0 commit comments