Security Regulations Compliance

Torizon can lower the effort and cost to comply with regulations and keep your focus on the unique value of your products and not on the effort to clear checkboxes in security requirement guidelines.

EU Cyber Resilience Act

The newly proposed EU Cyber Resilience Act is highly relevant for the Industrial Internet of Things (IIoT), Industrial Automation & Control Systems, and general-purpose microprocessors. It is driven by the enormous cost caused by cybercrime, estimated at EUR 5.5 trillion in 2021. The EU understands that this is caused by low cybersecurity standards in HW and SW and the inability of users to choose products with adequate security due to missing transparency. The penalties for non-compliance are up to €15 million or 2.5 percent of their global annual turnover.

Some of the Requirements for the Cyber Resilience Act:

  • Communication about vulnerabilities
  • No delay in patching the vulnerabilities
  • Secure-by-default configuration
  • Cybersecurity risk assessment
  • Software Bill of Material (SBOM) requirements

Torizon can simplify compliance with the upcoming Cyber Resilience Act.


FDA- Software Updates Are Now Expected

For a long time, vendors of medical devices have tried to avoid changes to the HW or SW product so it wouldn't need recertification and submission of 510(k). However, the requirements are changing. Now, it's required to keep the software up to date and provide a secure update functionality. Only improving the cybersecurity of the device does not require 510(k).

The FDA released a new draft guideline called Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions. Here are some points about Software Updates:

  • Anticipate the need for software patches
  • Consider the update process's reliability in the event of communication interruption or failure
  • Implement processes for rapid verification, validation, and distribution of patches and updates

FDA Tips for Clinicians - Keeping Your Patients' Connected Medical Devices Safe

FDA- Software Updates

When to Submit a New 510(k) For a Software Change to an Existing Device.



How Torizon Helps

Reliable Updates Process

Torizon offers out-of-the-box, over-the-air, or physical offline updates via a USB stick or SD Card. Several layers of validation and fallback systems ensure your devices keep working at all times.

Proven Security Framework

Torizon utilizes the Uptane Framework, designed to be resilient even to the best efforts of nation-state attackers. Many larger Automotive OEMs use Uptane. Uptane is now a Linux Foundation Joint Development Foundation project.

Frequent OS Updates

Torizon offers frequent validated updates of its Embedded Linux TorizonCore OS. Software life cycles are optimized for the needs of medical and industrial devices.

Rapid Development, Testing, and Deployment

Torizon Tools and integrations lower the time to develop, test and deploy a patch. CI/CD integration can improve your DevOps DORA Metrics, such as Change Failure Rate and Lead Time for Changes.

Integration with Secure Boot (Coming Soon)

Take advantage of high assurance boot (HAB) available in many SoCs. Torizon works well with HW-based security features, and closer integration will be available soon.

Security Advisor Tool

Try our Torizon Security advisory tool to get tips on improving your device's security. The tool is hosted on Toradex experimental Labs pages.

Software Bill of Materials (SBOM)

You want to know exactly what goes into your software. We are in the process of implementing a Software Bill of Materials. Do you have particular requirements? Please get in touch with us.

Defense in Depth

Torizon is audited for security and is built around Defense in Depth. Several protection layers are used, including two-factor authentication, mutual TLS, unique x.509 certificates on every device, offline keys, role-based permissions, etc.

IoT Security Blog Series

Learn from our expert Jon why remote updates are crucial for the security of connected IoT devices. At the same time, Jon will also explain why a remote update feature can be a serious security risk and how hard it is to get it right. In the last part, you discover common issues regarding Over-the-air Update systems.
IoT Security
March 16, 2022

Part 3
Software update security: Common mistakes

This is part 3 of our 7-part series about over-the-air software updates. In part 1, we told you about all the reasons it's important to be able to deliver software updates remotely, and in part 2 we wrote about all the reasons software update systems are dangerous. Today, we're looking at ways to protect your software update system that might seem secure at first glance, but aren't—with famous real-world failures for each example.

IoT Security
February 10, 2022

Part 2:
The dangers of remote updates

This is part 2 of our 7-part series about over-the-air software updates. In part 1, we told you about all the reasons it's important to be able to deliver software updates remotely - in today's world, you can't keep any connected device secure unless you can update it. Today's post, though, goes in the opposite direction: we're going to look at why software update systems can be incredibly dangerous, and why you should treat them with skepticism and caution.

IoT Security
January 18, 2022

Part 1:
Why do we need remote updates for connected devices?

With the explosion of internet-connected devices in recent years, there has been an industry-wide realization of the need to keep these devices updated throughout their lifetime. This is the first part of a series that will explore the concept of remote over-the-air (OTA) updates, providing designers details they will need when implementing remote OTA update solutions into their systems. We will especially focus on the important security aspects. We'll start with the basics.

On-Demand Webinar

Security
September 29, 2022

Enhanced Cybersecurity and FIPS 140-2 Compliance using NXP® i.MX 8X

The road to cybersecurity compliance for regulated applications in the utilities, medical, and defense industries can be difficult. Achieving the required certifications can significantly increase timelines for development time/cost which can significantly delay a product launch.

Get Started

My team owns

Torizon is fully integrated with Toradex hardware

TorizonCore runs on most of our newer modules! Leverage a fully integrated stack and start developing today.

Integrating Torizon is easier than you think!

TorizonCore is fully Open Source! We provide references on how to integrate it with your own hardware. Do it yourself or with our partners!

Everything you need to get started

To kick-start your evaluation, choose from these Starter Kits to profit from the tight software-hardware integration.

Get in Touch With Us

Want to know more about Torizon?

?Have a Question ?