An updater must establish trust before installing code and remain recoverable after failure. ENISA’s November 4 technical advisory gives manufacturers, particularly smaller teams, a practical starting point.
Four checks from its guidance can structure a review:
- Protect release authority. Sign update metadata, cryptographically bind it to downloaded files and restrict signing-key access. Prepare for key rotation and revocation.
- Reject stale instructions. Authenticate metadata before trusting its hashes. Validate expiry or sequence information so replayed metadata cannot conceal newer updates.
- Check applicability and versions. Confirm the product, configuration and permitted version. Protect anti-rollback state so an old, validly signed update cannot silently downgrade the device.
- Test failure and recovery. Prevent partial installations, retain a controlled path to a known-good state and record failures. Preserve consistent configuration and data during recovery.
Apply these controls proportionately to the product’s architecture and risks. The advisory does not itself establish Cyber Resilience Act conformity or prove that a patch fixes its underlying vulnerability.
