search

OWASP / IoT-Security-Verification-Standard-ISVS

OWASP IoT Security Verification Standard (ISVS)
Other
133 stars 49 forks source link

Create 1.2.10 Secure update provisions #70

Closed cetome closed 3 years ago

cetome commented 3 years ago

Verify that all components can be updated

Additionally: verify that all components are supported by their supplier for a duration at least equivalent to the product warranty period.

scriptingxss commented 3 years ago

This is a great suggestion and one that I'm battling myself :)

This could go as 1.2.9 or in chapter 3's software updates section. Usually you'll need to work with the hardware sourcing team that manages semiconductor relationships and agreements. Since this relates to supply chain processes and agreements separate from "traditional" software, chapter 1 seems more fitting IMO.

How does the following sound?

Verify that all components including semiconductor drivers, SDKs, and modules (5G, LTE, Bluetooth, Wi-Fi, ZigBee) can be updated to provide security patches in alignment with the product's support or end-of-life policy.

cc: @cbassem

scriptingxss commented 3 years ago

Added