Manually verifying compliance with requirements such as the Cyber Resilience Act is not scalable. Our code analysis tool, Codyze, translates product-centric regulatory requirements into verifiable rules and automatically assesses whether the product’s source code fulfills them – across languages and microservices. Codyze makes all analysis results transparent to developers, security teams, and auditors.
This post summarizes a joint hardware security evaluation of OpenTitan® engineering and production silicon by Fraunhofer AISEC in cooperation with design teams from Google, lowRISC® and Nuvoton.
The goal was to validate OpenTitan’s security under strong attack models before deployment in servers and Chromebooks. The evaluation analysed OpenTitan’s core security properties and led to several hardening measures and tooling improvements that benefit future tape-outs and deployments.
How can we trust the hardware that forms the backbone of our connected world? In this interview, Dr. Matthias Hiller, head of the Hardware Security department at Fraunhofer AISEC, explains how trust anchors, secure chiplets, and advanced protection mechanisms help safeguard IT systems against tampering, and why hardware security is becoming a strategic factor for Europe in the age of quantum-based threats.
How can we trust chips and operating systems that power IoT, industry and the cloud? In this interview, Fraunhofer AISEC cybersecurity researcher Dr. Michael Weiß explains how GyroidOS, secure system-on-chip and open standards like RISC-V create verifiable, tamper-resistant platforms for tomorrow’s critical infrastructure.
In the face of growing complexity and regulatory requirements, the security of cloud services is becoming increasingly challenging. However, conventional certification procedures require considerable financial and time investment to meet these requirements. That is why the EU research project EMERALD is pursuing a new approach: It is developing a framework for continuous, automated security certification based on semantically structured evidence. This article will discuss the concepts, methods, and validation approaches of the EMERALD platform.
Digital certificates like X.509 are essential for secure internet communication by enabling authentication and data integrity. However, differences in how they are parsed by various TLS libraries can introduce security risks. A recent study by Fraunhofer AISEC analyzed six widely used X.509 parsers with real-world certificates. The findings reveal inconsistencies that could impact security-critical applications. In this article, we summarize the key results and explain why companies need to scrutinize their cryptographic libraries.
The Common Security Advisory Framework (CSAF) is a machine-readable format for security notices and plays a crucial role in implementing the security requirements of the Cyber Resilience Act (CRA): Security vulnerabilities can be detected and rectified faster by automatically creating and sharing security information. Fraunhofer AISEC has now published the software library »kotlin-csaf«, which implements the CSAF standard in the Kotlin programming language.
As data breaches and privacy violations continue to make headlines, it is evident that mere reactive measures are not enough to protect personal data. Therefore, behind every privacy-aware organization lies an established software engineering process that systematically includes privacy engineering activities. Such activities include the selection of privacy-enhancing technologies, the analysis of potential privacy threats, as well as the continuous re-evaluation of privacy risks at runtime.
In this blog post, we give an overview of some of these activities which help your organization to build and operate privacy-friendly software by design. In doing so, we focus on risk-based privacy engineering as the driver for »Privacy by Design«.
The cybersecurity blog goes live: Fraunhofer AISEC’s new blog is presenting exciting topics from the IT security research world in a new format: Expect fascinating content from the areas of trusted AI, trusted electronics, quantum computing and much more. The…