@@ -542,93 +542,93 @@ A basic overview of VPN functions follows. See Clause 4.2 for a detailed overvie
## C.2 Risk factors
### C.2.1 General
Risk factors determine which mitigation(s) satisfy each of the technical requirements in Clause 5.2. The assessor of a product determines the level of each risk factor via the development of a threat model and risk profile based on the intended and foreseeable use and misuse of the operating system.
Risk factors may increase the likelihood of an incident, increase the impact of an incident, or both. As a result, different mitigation strategies may be more or less relevant to different risk factors.
The overall risk related to each use case should be considered as a result of combining risk factors affecting both likelihood and impact of an incident.
**[CFG]** End-point configuration
### C.2.2 RF-CFG: End-point configuration
Description: Affects likelihood of threats involving misconfiguration.
Rationale: The complexity of the end-point configuration can directly affect the likelihood of threats
***[CFG-L-0]** End-point requires no configuration
***[CFG-L-1]** End-point requires simple configuration, such as choosing a region to connect to
***[CFG-L-2]** End-point requires configuration by a skilled administrator
***[CFG-0]** End-point requires no configuration
***[CFG-1]** End-point requires simple configuration, such as choosing a region to connect to
***[CFG-2]** End-point requires configuration by a skilled administrator
**[AUT]** Account management and authentication of endpoints
### C.2.3 RF-AUT: Account management and authentication of endpoints
Description: Affects likelihood of threats involving authentication.
Rationale: An improper account management and authentication implementation can directly impact with a successful breach
***[AUT-L-0]** Customer uses third party identity and authentication provider
***[AUT-L-1]** Identity and authentication are managed by the customer through a centralized identity system
***[AUT-L-2]** Each system used by the customer involves its own set of account information and secrets
***[AUT-0]** Customer uses third party identity and authentication provider
***[AUT-1]** Identity and authentication are managed by the customer through a centralized identity system
***[AUT-2]** Each system used by the customer involves its own set of account information and secrets
**[DAT]** Sensitivity of data
### C.2.4 RF-DAT: Sensitivity of data
Description: Affects impact of threats involving loss of data confidentiality, availability, or integrity.
Rationale: More sensitive data leads to a higher impact with a successful breach.
***[DAT-L-0]** User data is generally trivial and unimportant (ie. TV or streaming content, etc)
***[DAT-L-1]** User data is moderately important
***[DAT-L-2]** User data is important for preservation of human rights of user
***[DAT-0]** User data is generally trivial and unimportant (ie. TV or streaming content, etc)
***[DAT-1]** User data is moderately important
***[DAT-2]** User data is important for preservation of human rights of user
**[FUN]** Sensitivity of functions
### C.2.5 RF-FUN: Sensitivity of functions
Description: Affects impact of threats involving loss of availability of product functions.
Rationale: Loss of product functions' availability can have a major impact on threats.
***[FUN-L-0]** Loss of function would be a minor annoyance (e.g. preventing accessing unimportant web sites)
***[FUN-L-1]** Loss of function would impede daily activities
***[FUN-L-2]** Loss of function would threaten human rights of user
***[FUN-0]** Loss of function would be a minor annoyance (e.g. preventing accessing unimportant web sites)
***[FUN-1]** Loss of function would impede daily activities
***[FUN-2]** Loss of function would threaten human rights of user
**[ADM]** Availability of administration
### C.2.6 RF-ADM: Availability of administration
Description: What the availability and skill of administration is for the product.
Rationale: Skilled, fully resourced administration allows more risk transfer and can reduce the impact of incidents.
Description: Exposure of manufacturer infrastructure responsible for essential functions of the product
Rationale: More users with physical access to manufacturer infrastructure increases likelihood of an attack via hardware interfaces.
***[RDP-L-0]** Manufacturer does not provide any remote data processing
***[RDP-L-1]** Manufacturer has direct access to all remote data processing infrastructure
***[RDP-L-2]** Manufacturer infrastructure in a multi-tenant SaaS system
***[RDP-0]** Manufacturer does not provide any remote data processing
***[RDP-1]** Manufacturer has direct access to all remote data processing infrastructure
***[RDP-2]** Manufacturer infrastructure in a multi-tenant SaaS system
**[LDS]** Data stored locally by end-user software
### C.2.8 RF-LDS Data stored locally by end-user software
Description: How much sensitive information about the user/usage of the VPN is saved to the end-user's local system (such as local logs).
Rationale: The greater the information saved, the higher the odds that an attacker can reconstruct user behaviour.
***[LDS-L-0]** Production builds of end-user software do not save any information, such as logs
***[LDS-L-1]** Production builds of end-user software save only minimal information necessary for security purposes, such as configuration changes
***[LDS-L-2]** Production builds of end-user software log sensitive information about the user and/or user behavior
***[LDS-0]** Production builds of end-user software do not save any information, such as logs
***[LDS-1]** Production builds of end-user software save only minimal information necessary for security purposes, such as configuration changes
***[LDS-2]** Production builds of end-user software log sensitive information about the user and/or user behavior
**[RDS]** Data stored outside end-user software
### C.2.9 RF-RDS: Data stored outside end-user software
Description: How much sensitive information about the user/usage of the VPN is saved outside of the end-user's local system (such as remote logs).
Rationale: The greater the information saved, the higher the odds that an attacker can reconstruct user behaviour.
***[RDS-L-0]** Production instances of VPN infrastructure do not save any remote information, such as logs
***[RDS-L-1]** Production instances of VPN infrastructure remotely save only minimal information necessary for security purposes, such as configuration changes
***[RDS-L-2]** Production instances of VPN infrastructure log sensitive information about the user and/or user behavior
> TODO-HAS: add data leak threats
***[RDS-0]** Production instances of VPN infrastructure do not save any remote information, such as logs
***[RDS-1]** Production instances of VPN infrastructure remotely save only minimal information necessary for security purposes, such as configuration changes
***[RDS-2]** Production instances of VPN infrastructure log sensitive information about the user and/or user behavior
## C.3 Assumptions
@@ -680,6 +680,7 @@ The mitigations that reduce risk by type are:
> TODO-HAS: Add below threats
- Data leaks
- End-point compromise
- End-point malware hijacking traffic or recording activity
- Unauthorised but authenticated access by a compromised node/end-point
