For years, CISA has dealt with a steady stream of cyber incidents targeting edge devices in the nation’s federal networks and critical infrastructure. What is usually to blame?
Nation-state adversaries have taken advantage of these weaknesses, using them to gain unauthorized access, remain undetected, and steal sensitive data. These overlooked devices are not just technical problems. They put the nation’s security, privacy, and resilience at risk.
As the lead federal cybersecurity agency, CISA recently took a major step to address this ongoing risk by issuing Binding Operating Directive (BOD) 26-02. This directive requires federal civilian agencies to find and replace end-of-support (EOS) edge devices, keep software up to date, and fix known vulnerabilities. Although this is aimed at federal agencies, we strongly encourage all organizations to take similar steps.
Still, we all need to do more. Managing the life cycles of hardware and software can quickly become overwhelming and consume significant resources, especially if there is no way to check the EOS status of these products.
This is where OpenEOX comes in. OpenEOX is a machine-readable international standard that changes how product lifecycle information is shared across software, hardware, and AI services. With its standardization and automation, OpenEOX makes asset management more transparent, efficient, and unified. If the community adopts OpenEOX, both producers and consumers of hardware and software can work together to tackle one of the biggest cyber threats: outdated hardware and software.
What Is OpenEOX?
Open EOX is an OASIS international standard that helps standardize how product lifecycle information, such as EOS, is shared across the software and hardware industries. It uses a lightweight machine-readable format (JSON) that works well with common tools and standards such as Software Bills of Materials (SBOMs), the Common Security Advisory Framework (CSAF), and other vulnerability management tools. The main goal of OpenEOX is to make product lifecycle management more transparent, efficient, and consistent, thereby reducing the risk of using outdated or unsupported technology. Cybersecurity organizations around the world support and are committed to adopting OpenEOX.
Benefits of OpenEOX
- For producers, openEOX is a major improvement for business. By using a standardized and automated way to share EOS milestones, producers can make customer communication easier, build trust and transparency, and reduce manual work and confusion. These business improvements add up to better global supply security.
- For consumers, OpenEOX helps organizations stay ahead of cyber threats quickly because it is machine-readable and works with other tools. Organizations can easily and proactively identify and fix risks in products that are nearing or past their EOS.
Call to Action
To get the most out of OpenEOX, everyone in the vulnerability management community needs to work together. Each person and organization has an important part to play. Here are some recommended actions:
For Producers:
- Adopt and publicly publish OpenEOX data: hardware and software producers should publish OpenEOX documents for their products. This information should be made publicly available without barriers to entry (i.e., no customer portals, paywalls, etc.)
- Integrate OpenEOX with existing tools. Developers of vulnerability scanners, asset management platforms, and other related tools and standards should incorporate OpenEOX to automate product lifecycle tracking and the exchange of EOS information.
For Consumers:
- Enhance existing workflows with OpenEOX. Organizations should update their processes to incorporate OpenEOX data into their existing workflows. This can make vulnerability management easier by enabling proactive replacement of EOS devices, timely patching of critical vulnerabilities, and updating outdated software and hardware.
- Encourage partners to adopt OpenEOX: Organizations should encourage their partners and providers to publish and leverage OpenEOX data. Another adopter means another door closed for threat actors.
Now Is The Time To Act
We must stop using unsupported technologies that create serious security risks. This issue can’t be ignored any longer. OpenEOX offers an automated way to manage product life cycles in a standardized, transparent manner. As cyber defenders, we need to adopt new practices to protect our networks and keep up with the fast pace of threat actors. By using OpenEOX, we can eliminate vulnerabilities and help protect the digital ecosystem at scale.
Source: The End is Just the Beginning of Better Security: Enhanced Vulnerability Management with OpenEoX
