Security Tools Under the CRA: VPNs, SIEM, and Antivirus (EN 304 619–622)

There's an irony in the CRA: the tools organizations use to improve their cybersecurity must themselves be CRA compliant. Four ETSI standards cover the security tools category.

Antivirus Software — EN 304 619 (Class I)

Software that searches, removes, or quarantines malicious software. This includes endpoint protection platforms like CrowdStrike Falcon, Microsoft Defender, and ESET NOD32. Key concerns:

• Signature update integrity and authentication
• Kernel-level access security (preventing tools from becoming attack vectors)
• False positive handling and safe quarantine mechanisms

VPN Software — EN 304 620 (Class I)

Both consumer VPNs (NordVPN, ExpressVPN) and enterprise VPN solutions (Cisco AnyConnect, OpenVPN commercial). Requirements focus on:

• Strong encryption protocols (WireGuard, OpenVPN, IPsec with modern ciphers)
• No logging of user traffic (privacy commitment backed by architecture)
• DNS leak prevention
• Kill switch functionality

Network Management — EN 304 621 (Class I)

SNMP managers, network monitoring tools, configuration management platforms. Must secure their own management interfaces and the data they collect about network infrastructure.

SIEM Systems — EN 304 622 (Class I)

Security Information and Event Management systems are the nerve center of security operations. CRA requirements emphasize securing the SIEM itself — because if an attacker compromises your SIEM, they can blind your entire security monitoring capability.