Securing a product is comparable to securing a building. It must be planned comprehensively, from the outset, and specifically for the intended use. Anyone who does not consider Cybersecurity from the start in development risks fines, product recalls, or even market bans with regard to legal regulations such as the Cyber Resilience Act in the EU. TQ supports you with comprehensive Cybersecurity consulting from the first requirement through to approval.
Our Cybersecurity Services
The cybersecurity team at TQ consists of experienced developers with deep expertise in software (BSP/operating systems, microcontrollers, cloud and web applications) and hardware. This background enables us to identify and address vulnerabilities from a development perspective, so we can make your system secure in a holistic way.
Threat Analyses and Risk Assessments
We analyze possible attack scenarios and assess risks based on established methods such as CyberSecTARA. This provides you with a sound basis for decision-making for your security strategy.
Implementation of cybersecurity measures
Our specialists support you in implementing specific security mechanisms, for example:
Security Concepts and Security Architectures
Based on the analysis, we develop custom security concepts for your products. In doing so, we take into account technical requirements, industry-specific risks, and regulatory requirements.
Penetration Testing
We conduct professional penetration tests using black-box, white-box, or grey-box methods. In doing so, we simulate real attack scenarios and identify vulnerabilities before they can be exploited by attackers.
Dynamic Application Security Testing (DAST)
With dynamic security testing, we verify applications under realistic operating conditions and assess their resilience to cyberattacks.
Secure Code Reviews and SAST
Our security experts analyze your source code for potential security vulnerabilities. In addition, we use static application security testing (SAST) to identify and resolve risks at an early stage.
Software Bill of Materials (SBOM)
We create structured software bills of materials (SBOMs) to provide transparency into the components used and efficiently meet regulatory requirements.
The regulatory requirements for connected products are continuously growing. With our cybersecurity consulting, we help you efficiently implement the relevant regulations and avoid compliance risks.
We support you in complying with:
Our experts translate complex requirements into concrete technical measures and support you through to successful implementation.
How our cybersecurity consulting works
Our integrated cybersecurity approach is based on the V-model and is structured into the following three phases.
1. Analysis & Concept:
We identify potential threats early and derive targeted measures.
With CyberSecTARA and well-founded risk assessments, we create the basis for a secure and future-proof security concept.
2. Development & Implementation:
We implement defined cybersecurity measures in a targeted manner and integrate them seamlessly into your development.
Through continuous security testing, we ensure that all requirements are reliably met.
3. Verification & Approval:
We verify the effectiveness of all implemented measures and prepare your product for approval. Complete and traceable documentation is essential to demonstrate compliance with requirements such as CRA or RED.
Our approach to Cyber Security consulting follows three central principles that are also increasingly required by regulation – for example in the Cyber Resilience Act –.
→ Security by Design
Security requirements are incorporated into the product architecture from the very first concept idea, rather than being added later. This reduces vulnerabilities and significantly lowers the cost of subsequent revisions.
→ Security by Default
Your product already uses the most secure available configuration in its factory settings. Users therefore do not need to take any action themselves to set up Security Features.
→ Security by Evidence
We create the basis for audits, certifications, and the EU Declaration of Conformity by making security demonstrable through test reports or threat analyses, for example, and documenting it comprehensively and without gaps.
Security by Design means that cybersecurity is not checked only after development has been completed, but is incorporated into the development process from the outset as a requirement. In electronics development, this includes early threat analysis, the selection of security-relevant hardware components such as Secure Elements or TPMs, security tests throughout development, and documentation of all security measures. At TQ, we pursue Security by Design as an integral approach.
TQ supports compliance with CRA (Cyber Resilience Act), RED (Radio Equipment Directive, Article 3.3 d/e/f), IEC 62443 for industrial cybersecurity, ETSI EN 303 645 for consumer IoT, and OWASP ASVS for web and software applications. Depending on the industry and product, additional specific requirements may apply.
TQ's cybersecurity team has extensive industry expertise and is familiar with the specific requirements in profiles in medical technology, aviation, and energy management.
A penetration test (pentest) is a controlled attack simulation on a product or system with the aim of identifying security vulnerabilities before a real attacker finds them. TQ carries out pentests using black-box (no prior knowledge), white-box (full prior knowledge), and grey-box methods (partial prior knowledge). Pentests are useful before market launch, before approvals under CRA or RED, after major software changes, and as a regular security review during operation.
SAST (Static Application Security Testing) analyzes the source code without executing the software — ideal for finding vulnerabilities early in the development process. DAST (Dynamic Application Security Testing) tests applications while they are running and finds vulnerabilities that only occur in operation, such as insecure configurations or runtime errors. TQ uses both methods complementarily: SAST and SecCodeReview in the development phase, DAST additionally before release or during acceptance tests.
SBOM stands for Software Bill of Materials, a complete, machine-readable list of all software components included in a product, including open-source libraries and their versions. SBOMs are mandatory under the Cyber Resilience Act because they form the basis for vulnerability management: only those who know which components are in the product can respond when a security vulnerability becomes known for one of them.
We would be happy to support you in creating SBOMs. Contact us directly for a non-binding quote.
