#ANSSI — insecure by design

info1 source

ANSSI Refreshes Corporate Wi-Fi Security Guidance Under Its 'Essentiels' Collection

France's national cybersecurity agency, ANSSI, released a new baseline publication focused on corporate Wi-Fi security. Published under their 'Les Essentiels' series, the document is targeted at organizations looking to lock down their wireless footprint regardless of their baseline technical maturity. Unlike exhaustive configuration documents or granular hardening guidelines, this format functions as an accessible collection of standalone, complementary best practices. The recommendations encompass core defensive measures such as adopting the `WPA3` protocol and tightening wireless credential management policies. According to the agency's publication metadata, the material serves to distill practical, anti-intrusion advice reflecting ANSSI's operational perspective at the time of release. The guidance aims to address common operational pitfalls in corporate wireless environments across roughly twenty practical recommendations. ANSSI noted that this series of recommendations is designed to evolve continuously. Updates will be issued based on shifts in the wireless threat landscape, emerging protocols, and empirical feedback from incident response engagements. The document is distributed directly through the agency's dedicated MesServicesCyber platform to provide broad accessibility across private and public sector infrastructure operators. Organizations evaluating their perimeter defense are encouraged to treat these guidelines as a pragmatic reference check against their internal wireless deployment standards.

medium1 source

France Ramps Up Cyber Resilience Act Enforcement with ANSSI and ANFR Mandates for Connected Hardware and Software

French regulatory and cybersecurity agencies, including ANSSI, the ANFR, and the DGE, hosted an industry alignment event in Paris focused on the operational rollout of the European Union's Cyber Resilience Act (CRA). Key European and French officials convened to emphasize the necessity of the CRA, framing the framework as an indispensable regulatory baseline for any vendor shipping hardware or software with digital components. Regulators highlighted that widespread vulnerabilities documented between 2025 and 2026 stemmed directly from absent baseline security hygiene that the CRA now mandates by law. Crucially, the regulatory machinery is already active, as hardware and software manufacturers have been required under Article 14 of the CRA to actively notify authorities of exploited vulnerabilities and severe security incidents since September 11, 2026. The broader compliance horizon is approaching rapidly, requiring all products containing digital elements sold across the European single market to satisfy essential CRA cybersecurity requirements by December 11, 2027. To enforce these standards domestically, France has divided regulatory responsibilities between market surveillance and national CSIRT oversight. The ANFR will operate as the designated national market surveillance authority, conducting direct technical assessments and teardowns of connected devices to confirm real-world compliance. Should vendors fail to meet baseline standards, the ANFR holds administrative policing powers to issue steep financial penalties or mandate full market recalls. Concurrently, ANSSI will fulfill the dual role of national CSIRT for vulnerability intake and the notifying authority tasked with auditing, vetting, and certifying Conformity Assessment Bodies (CABs/OECs). Officials concluded by presenting compliance roadmaps, trusted third-party resources, and designated testing bodies to assist manufacturers in overhauling their product development lifecycles ahead of the 2027 deadline.