Binary Code Analysis for IEC 62443-4-1 SVV-3

The IEC 62443-4-1 standard mandates vulnerability testing for its third Security Verification and Validation (SVV-3) requirement. A sub-requirement targets binary executable files, including firmware with four types of problem to identify: known vulnerabilities, vulnerable third-party libraries, security rule violations and compiler settings.

Unfortunately, IEC 62443-4-1 does not offer supplemental guidance on how to do this beyond explicitly recommending experts be involved.

Hugo and the team Hitachi Energy Research faced this issue and created a methodology using fully open-source tools in two parts to help both developers and cybersecurity professionals to perform binary code analysis on their products. 

The first, aimed at developers and operators, catches low-hanging fruits, and provides enough context to help without the need for cybersecurity knowledge.

The second, aimed at cybersecurity professionals, builds on the first version while enabling power-user features and customization to cover more use-cases and allow them to create their own analysis.

Additionally, Hugo presents the challenges that binary code analysis is still facing and potential research directions including support for custom file formats and proprietary components.