Skip to main content

Developing and Testing Software Security Patches and Updates

You've identified a vulnerability in your game, app, or software component. The Cyber Resilience Act (CRA) requires you to "address and remediate vulnerabilities without delay, including by providing security updates" (Annex I, Part II, point (2)). This means not just finding the problem, but actually fixing it and making sure the fix works.

Crafting the Fix​

Developing a security patch involves:

  • Understanding the Root Cause: Don't just paper over the cracks. Understand why the vulnerability exists to develop an effective and comprehensive fix.
  • Secure Coding: Apply secure coding principles when writing the patch. Ensure the fix itself doesn't introduce new vulnerabilities.
  • Targeted vs. Broad Changes: Sometimes a small, targeted code change is enough. Other times, a more significant architectural adjustment in your app or game engine might be needed for a robust solution.

Testing is Non-Negotiable​

Releasing an untested patch is like fixing one hole in a boat by drilling another. Annex I, Part II, point (3), requires you to "apply effective and regular tests and reviews of the security of the product". This absolutely applies to security updates:

  • Does it Fix the Vulnerability? Verify that the patch actually closes the reported security hole.
  • Regression Testing: Crucially, ensure the patch doesn't break existing functionality in your app or game. Users won't thank you if a security update makes your software unusable.
  • Performance Testing: Does the patch negatively impact performance, especially important for games or real-time applications?
  • Security Testing of the Patch: Could the patch itself be exploited in a new way?

Consider a dedicated testing environment before rolling out any security update to your user base. For critical patches, this might involve more extensive QA.

Key Takeway​

Developing security patches requires careful coding to address the root cause of the vulnerability. Rigorous testing is then essential to confirm the fix is effective and doesn't introduce new problems for your software users.