Recent content in Who is Piet? on Piet De Vaere | Product Cybersecurity Consultant
In the past, if a product was substantially modified, it was treated as a new product with new legal obligations. But today’s products are updated all the time. Under the CRA, even common software updates could count as substantial modifications and may restart long support obligations. This article explains why the old approach no longer fits well with modern software-driven products and why the…
Europe is putting cybersecurity at risk: not by neglect, but by misunderstanding. The EU’s current approach to CVD treats vulnerability reporters like trespassers instead of allies, and confuses Coordinated Vulnerability Disclosure with bug bounty programmes. The result? Fewer reports and more silent vulnerabilities. If we want NIS2 and the CRA to be sucessful, we must fix this. Fast.
In just over a year, the first batch of CRA requirements will take effect: manufacturers will have to report actively exploited vulnerabilities contained in their products and severe incidents having an impact on the security of their products to ENISA, their member state, and the product’s users. But what exactly is the difference between exploited vulnerabilities and severe incidents?
After discovering a flaw in the login system of a major Belgian bank, I tried to report it through Belgium’s official vulnerability disclosure channels. Instead of support, I faced suspicion, bureaucracy, and resistance, from both the bank and the Centre for Cybersecurity Belgium. This post explores how Belgium’s CVD system is fundamentally broken, and what needs to change.
In November 2024, the EU’s Cyber Resilience Act (CRA) was published. After a 36 month transition period, it will be in full effect on 11 December 2027. The CRA aims to enhance the security of all digital products sold within the EU. With its broad scope, it will affect numerous organizations. But what does this actually entail? What criteria must products fulfill to comply with the CRA? What…
Building trust on the web is a challenging task that often leads to failures. In this course, we will explore what a public key infrastructure (PKI) is and why it is essential for the web. By examining various methods that have been proposed and tried, many of which did not succeed, participants will gain insight into the complexities of managing a PKI. By the end of the course, participants will…
In the fall semester, I teach in the master-level Network Security course at ETH Zürich. The course covers a broad range of topics, and aims to give students a strong conceptual understanding of the intricacies of securing modern networks.
Academic paper @ ASIACCS 2024 — IoT devices interact with the physical world through sensing and actuation. Therefore, their presence introduces real privacy and safety risks. SA⁴P enables fine-grained control over which devices are allowed access to the physical world, and at what times. It also motivates developers to sense or actuate not more than needed.
Blog post @ Zühlke Insights — With the introduction of the CRA, the EU is the first government in the world to impose blanket cybersecurity requirements on all products. This post explains what products need to be CRA-compliant, what that entails, and how the CRA differs from NIS2.
Academic paper @ USENIX Security 2023 — Ideally, smart speakers should only be able to listen when they are spoken to ( “Hey Siri!” ), but if so, how could they hear us call out to them? Kimya is a low-level framework that ensures that stand-by smart speakers cannot leak audio data and must forget what they heard immediately.
Academic paper @ ASIACCS 2022 — Hopper protects industrial networks by placing each device in its own virtual mini network. This minimizes an attacker’s ability to infect or hop between devices. We show how to achieve this without modifying the underlying network routes or structure. We include implementations on both general-purpose and embedded hardware.
Academic paper @ CRITIS 2021 — We analyze how and why today’s industrial network architectures and defenses are reaching their limits. We then introduce Tableau, thereby demonstrating the feasibility of alternative, modern, approaches.