Industrial Cybersecurity, Made Transparent

Antaira focuses on the security of the industrial networking products we develop and support—from secure development and validation to deployment information and vulnerability response. It does not replace a customer’s broader network, system, or organizational cybersecurity program.

Antaira has achieved IEC 62443-4-1 certification for its secure product development lifecycle. IEC 62443-4-2 SL1 certification remains in progress.

IEC 62443-4-1 focuses on the secure product-development lifecycle, while IEC 62443-4-2 focuses on technical security requirements for industrial automation and control system components.

In simple terms, IEC 62443-4-1 is about how a product is developed securely—not just which security features it has.

It defines eight secure development lifecycle practice areas: Security Management (SM), Specification of Security Requirements (SR), Secure by Design (SD), Secure Implementation (SI), Security Verification and Validation Testing (SVV), Management of Security-Related Issues (DM), Security Update Management (SUM), and Security Guidelines (SG).

Why it matters for industrial networking: industrial networking products can remain in operational environments for many years. Security therefore depends not only on the product at the time of purchase, but also on how the manufacturer develops, maintains, updates, and responds to vulnerabilities throughout the product lifecycle.

Source: IEC 62443-4-1

IEC 62443-4-2 looks at the security capabilities of the industrial component itself.

Its technical security requirements are organized around seven foundational requirements: Identification and Authentication Control (IAC), Use Control (UC), System Integrity (SI), Data Confidentiality (DC), Restricted Data Flow (RDF), Timely Response to Events (TRE), and Resource Availability (RA). For networking products, it also defines Network Device Requirements (NDRs).

Why it matters for industrial networking: reviewers need to understand not only whether a manufacturer follows a secure development process, but also what technical security capabilities are built into the component. IEC 62443-4-2 provides a recognized framework for making that assessment.

Source: IEC 62443-4-2

IEC 62443-4-1 → How the product is securely developed and maintained.

IEC 62443-4-2 → What technical security capabilities the component provides.

One looks at the development process; the other looks at the component itself.

SEMI E187 is a cybersecurity standard created specifically for semiconductor fab equipment.

It establishes a common cybersecurity baseline across four key areas: operating-system support, network security, endpoint protection, and security monitoring.

Why it matters in semiconductor manufacturing: fab equipment and connected subsystems may come from many different suppliers. SEMI E187 gives equipment suppliers, system integrators, and fab operators a shared set of cybersecurity expectations that can be used during equipment evaluation, procurement, integration, operation, and maintenance.

Source: SEMI

Yes. Antaira has received SEMI E187 cybersecurity certification for its applicable industrial networking solutions, providing semiconductor customers with third-party-validated cybersecurity evidence for the networking layer.

Source: Antaira SEMI E187 Announcement

Cybersecurity requirements vary by customer, industry, product, and project. A tender or supplier questionnaire may request:

• Certification status and scope
• Product model and firmware applicability
• Supported security protocols and protocol versions
• Ability to disable insecure or legacy management services
• Security configuration or product-hardening guidance
• SBOM scope, format, and access process
• Vulnerability-disclosure and PSIRT information
• Security advisory and firmware-update process
• Product lifecycle and security-support information
• Available security testing or conformance evidence

The exact deliverables available from Antaira depend on the applicable product, firmware version, project scope, and access requirements. Customers should contact Antaira for product-specific documentation.

Think of an SBOM as an ingredient list for the software inside a product.

Modern products can include software libraries, packages, and third-party components. An SBOM records what those components are, giving manufacturers and customers better visibility into the software supply chain.

Why does that matter? If a vulnerability is later discovered in a widely used software component, an SBOM can help answer a much more useful question: “Is that component—and potentially the affected version—inside my product?”

That makes an SBOM useful for software transparency, vulnerability assessment, impact analysis, patch planning, supplier communication, and long-term product traceability.

Source: CISA SBOM Resources

A CVE is a public identifier for a specific disclosed cybersecurity vulnerability.

When a new CVE is published, an SBOM can help identify whether the named software component and potentially affected version may be present in a product. Antaira can then assess the actual product impact, including affected models and firmware versions, and determine whether a firmware update, mitigation guidance, or security advisory is required.

An SBOM match does not automatically prove that a product is exploitable. Product-specific technical assessment is still required.

Antaira provides product-specific SBOMs upon request. Please contact Antaira to confirm the SBOM scope, format, applicable firmware versions, and access process for your product.

In simple terms, Secure by Default means a product should start from a safer security baseline instead of relying on the customer to discover and change every risky setting before deployment.

Depending on the product, this can relate to areas such as credential handling, enabled services, communication protocols, access permissions, and other default security settings. The exact defaults and supported security controls can vary by product and firmware.

Source: CISA Secure by Design guidance

Customer security reviews may ask which TLS versions and cipher suites are supported, whether secure management protocols such as SSH and SNMPv3 are available, how certificates are managed, and whether insecure or legacy protocols can be disabled.

Legacy protocols and services may include SSL, TLS 1.0, TLS 1.1, HTTP, Telnet, and SNMPv1/v2c. Exact capabilities vary by product model and firmware version. Customers should contact Antaira for product-specific protocol and configuration details.

Source: RFC 8996

Customers should confirm that the firmware comes from an official source, applies to the correct product model and hardware revision, and includes the appropriate release notes.

Depending on the product, authenticity or integrity verification may involve a digital signature, code-signing mechanism, cryptographic hash, or checksum. Upgrade, rollback, and recovery options also vary by product and firmware version.

Customers should follow the applicable Antaira firmware documentation and update instructions.

The CRA introduces mandatory cybersecurity requirements for hardware and software products with digital elements made available on the EU market.

These requirements cover product planning, design, development, maintenance, and vulnerability handling throughout the product lifecycle.

The CRA applies in phases. Reporting obligations apply from September 11, 2026, while the main obligations apply from December 11, 2027.

Source: Regulation (EU) 2024/2847

Antaira has processes in place to support the reporting obligations applying from September 11, 2026.

Readiness activities continue for the broader product requirements applying from December 11, 2027.

A Product Security Incident Response Team (PSIRT) receives and assesses reports of potential product-security vulnerabilities, determines potential product impact, and coordinates remediation, mitigation, and communication.

Yes. Antaira provides a dedicated channel for reporting potential product-security vulnerabilities. Reporting guidance asks for information such as product model, firmware or software version, reproduction steps, proof of concept, and other technical details that can support assessment and response.

Source: Antaira PSIRT

Potential product vulnerabilities can be reported through Antaira’s official cybersecurity channel. The PSIRT page provides reporting instructions, the reporting email address, and Antaira’s PGP key for sensitive information.

Visit PSIRT →

Antaira reviews the submitted information, assesses potential risk and product impact, investigates affected products and firmware, and coordinates appropriate remediation or mitigation.

If customer action is required, the response may include updated firmware, mitigation guidance, or other security information.

When public disclosure is appropriate, relevant cybersecurity advisories are made available through Antaira’s website so customers can understand the issue, affected scope, and recommended action.

Source: Antaira Cybersecurity / Advisories