Yves Astein

CRA-Compliant Update and Device Management: Build or Buy?

PHYTEC supplies embedded modules with a Linux operating system that customers build their end devices on – from ticket machines to medical equipment. The CRA requires vulnerabilities to be fixed throughout the lifecycle: at least five years, often much longer for construction machinery. An update client like RAUC isn’t enough. Manufacturers also need staged rollouts, rollbacks and rules for when a device must not be updated. Yves Astein uses CVE monitoring to show what building in-house involves: simple scanners also flag vulnerabilities in components the device doesn’t even include. PHYTEC put two to three person-years into a suitable toolset alone, plus test infrastructure and Linux specialists for ongoing maintenance. Marvin König adds the asset side: roles, permissions and ownership transfer when a device changes hands several times. How PHYTEC ultimately decided, what role ML!PA plays and why vendor dependency is the deciding question for many industrial customers – that’s what the two discuss in the episode. Key takeaways The real effort lies less in the update itself than in managing everything around it. A CVE list is only useful once it’s checked against the device’s actual configuration. When choosing a platform, ask whether you can run the system yourself later and who holds the rights to it. Test in the field early – many edge cases only show up in operation.