Editorial: whitespace, numbering, spelling and other typos (157f84f1) · Commits · STAN4CRA / EN 304 620 Virtual Private Networks Part 1

EN-304-620-1.md

+55 −87

Original line number	Diff line number	Diff line
		@@ -451,8 +451,6 @@ The following risks are delegated by the VPN product to other components within

		## 4.7 Use cases

		### 4.7.1 Description of use cases

		This list of use cases is an informative resource to the manufacturer to simplify choosing a set of security requirements. It is not an exhaustive list, and deployments may cross over more than one use.

		See [i.3] for formal definitions of micro, small, and medium-sized enterprises.
		@@ -659,7 +657,7 @@ Rationale: More features mean more code and more interfaces mean attack surface.

		### C.2.10 RF-CON: Connectivity offered

		Description: Whether the VPN connects different endpoints to each other via a private network or simply provides a tunnel from a single endpoint to a public netowrk
		Description: Whether the VPN connects different endpoints to each other via a private network or simply provides a tunnel from a single endpoint to a public network

		Rationale: Different connectivity requirements create different risks and mitigations.

		@@ -738,13 +736,11 @@ Requirements that mitigate this threat: SSDD, NUTI, LOGG
		Mitigations for Likelihood:

		* Medium to Low: SSCA, SCFS

		* High to Low: SSCA, (FZ95 or BTIN or IMSL), SCFS, NUTI-1, NUTI-2

		Mitigations for Impact:

		* Medium to Low: LOGG-1, CDST

		* High to Low: LOGG-1, LOGG-2, CDST

		### C.4.4 TH-KEVU: Known exploitable vulnerabilities
		@@ -772,7 +768,6 @@ All mitigations from TH-UEVU apply (using that requirement's risk formula), in a
		Mitigations for Likelihood:

		* Medium to Low: (KEVD or KEVA), (KEVM or KEVT or SCAN), (SUVP or SUAP or SUOE or SUAO), VULH

		* High to Low: KEVD, KEVA, (KEVM or KEVT or SCAN), (SUAP or SUAO), SUCS, SUAU, SUVH, SURP, SURC, SUSR, SUMV, SUED, VULH

		### C.4.5 TH-UEAC: Unauthorised endpoint access
		@@ -800,13 +795,11 @@ Requirements that mitigate this threat: AUTH, DMIN
		Mitigations for Likelihood:

		* Medium to Low: TODO: add risk transfer to environment

		* High to Low: TODO: add risk transfer to environment

		Mitigations for Impact:

		* Medium to Low: AUTH-3, AUTH-5, CDST

		* High to Low: AUTH-3, AUTH-4, AUTH-5, CDST

		### C.4.6 TH-RDOS: Denial of service on remote data processing
		@@ -834,13 +827,11 @@ Requirements that mitigate this threat: AVAI
		Mitigations for Likelihood:

		* Medium to Low: DOST

		* High to Low: DOST

		Mitigations for Impact:

		* Medium to Low: FDRP, LMEM

		* High to Low: FDRP, LMEM, FAIR

		### C.4.7 TH-MITM: Machine-in-the-middle
		@@ -868,13 +859,11 @@ Requirements that mitigate this threat: CRYPT, LOGG
		Mitigations for Likelihood:

		* Medium to Low: CRYPT-2

		* High to Low: CRYPT-1, CRYPT-2

		Mitigations for Impact:

		* Medium to Low: LOGG-1

		* High to Low: LOGG-1, LOGG-2

		### C.4.8 TH-LEAK: Sensitive data leaks
		@@ -901,13 +890,11 @@ Requirements that mitigate this threat: ROUT, CONF, DNSL, IPv6, CRYPT
		Mitigations for Likelihood:

		* Medium to Low: ROUT-1, ROUT-2, CONF-1, CONF-2, CONF-3, CONF-4, CONF-5, DNSL-1, DNSL-2, DNSL-7, DNSL-8, IPv6-1, IPv6-2

		* High to Low: ROUT-1, ROUT-2, ROUT-3, CONF-1, CONF-2, CONF-3, CONF-4, CONF-5, DNSL-1, DNSL-2, DNSL-3, DNSL-4, DNSL-5, DNSL-6, DNSL-7, DNSL-8, IPv6-1, IPv6-2

		Mitigations for Impact:

		* Medium to Low: LOGG-1

		* High to Low: LOGG-1, LOGG-2

		### C.4.9 TH-PLNS: Transmitting sensitive data in the clear in a single endpoint VPN
		@@ -935,13 +922,11 @@ Requirements that mitigate this threat: EISO, CRYPT, AUTH, ROUT, DNSL
		Mitigations for Likelihood:

		* Medium to Low: EISO, CRYPT-2, ROUT-1, AUTH-1, AUTH-2

		* High to Low: EISO, DNSL-6, CRYPT-1, CRYPT-2, ROUT-1, ROUT-2, ROUT-3, AUTH-1, AUTH-2, AUTH-3, AUTH-4, AUTH-5, AUTH-6

		Mitigations for Impact:

		* Medium to Low: LOGG-1

		* High to Low: LOGG-1, LOGG-2

		### C.4.10 TH-PLNM: Transmitting sensitive data in the clear in multi-endpoint VPN
		@@ -954,7 +939,7 @@ Attacker may read sensitive data transmitted without encryption in a VPN which c
		\| all others \| Medium \| none \|
		\| CON = 0 or CFG = 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-2, SP-3 \|

		Table: _Table C.13_
		Table: _Table C.15_

		\| Risk factors \| Impact \| Security profiles \|
		\|------------------------------\|--------\|-------------------\|
		@@ -962,23 +947,21 @@ Table: _Table C.13_
		\| all others \| Medium \| none \|
		\| CON = 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-2, SP-3 \|

		Table: _Table C.14_
		Table: _Table C.16_

		Requirements that mitigate this threat: CRYPT, AUTH, ROUT, DNSL

		Mitigations for Likelihood:

		* Medium to Low: CRYPT-2, ROUT-1, AUTH-1, AUTH-2

		* High to Low: DNSL-6, CRYPT-1, CRYPT-2, ROUT-1, ROUT-2, ROUT-3, AUTH-1, AUTH-2, AUTH-3, AUTH-4, AUTH-5, AUTH-6

		Mitigations for Impact:

		* Medium to Low: LOGG-1

		* High to Low: LOGG-1, LOGG-2

		### C.4.10 TH-UNAA: Unauthorised authentication
		### C.4.11 TH-UNAA: Unauthorised authentication

		Attacker may attempt to authenticate in an unauthorised manner to get access to product assets.

		@@ -987,7 +970,7 @@ Attacker may attempt to authenticate in an unauthorised manner to get access to
		\| max(DAT, FUN) = 2 \| High \| SP-3, SP-4, SP-5 \|
		\| all others \| Medium \| SP-1, SP-2 \|

		Table: _Table C.15_
		Table: _Table C.17_

		\| Risk factors \| Impact \| Security profiles \|
		\|--------------------\|--------\|-------------------\|
		@@ -995,23 +978,21 @@ Table: _Table C.15_
		\| all others \| Medium \| SP-2 \|
		\| max (DAT, FUN) = 0 \| Low \| SP-1 \|

		Table: _Table C.16_
		Table: _Table C.18_

		Requirements that mitigate this threat: AUTH, LOGG

		Mitigations for Likelihood:

		* Medium to Low: AUTH-6

		* High to Low: AUTH-6

		Mitigations for Impact:

		* Medium to Low: AUTH-3, LOGG-1

		* High to Low: AUTH-3, AUTH-4, AUTH-5, LOGG-1, LOGG-2

		### C.4.11 TH-LDEL: Attacker removes evidence of compromise
		### C.4.12 TH-LDEL: Attacker removes evidence of compromise

		Attacker may remove evidence of compromise from the endpoint.

		@@ -1020,30 +1001,28 @@ Attacker may remove evidence of compromise from the endpoint.
		\| max(DAT, FUN) = 2 \| High \| SP-3, SP-4, SP-5 \|
		\| all others \| Low \| SP-1, SP-2 \|

		Table: _Table C.17_
		Table: _Table C.19_

		\| Risk factors \| Impact \| Security profiles \|
		\|-------------------\|--------\|-------------------\|
		\| max(DAT, FUN) = 2 \| High \| SP-3, SP-4, SP-5 \|
		\| all others \| Low \| SP-1, SP-2 \|

		Table: _Table C.18_
		Table: _Table C.20_

		Requirements that mitigate this threat: LOGG

		Mitigations for Likelihood:

		* Medium to Low: LOGG-2

		* High to Low: LOGG-2

		Mitigations for Impact:

		* Medium to Low: CDST

		* High to Low: CDST

		### C.4.12 TH-CNFS: Access to assets via configuration errors in single endpoint VPN
		### C.4.13 TH-CNFS: Access to assets via configuration errors in single endpoint VPN

		Attacker may use configuration errors to get unauthorised access to product assets in a single endpoint VPN.

		@@ -1053,7 +1032,7 @@ Attacker may use configuration errors to get unauthorised access to product asse
		\| all others \| Medium \| SP-2 \|
		\| CON > 0 or CFG = 0 or max(ADM, COM) = 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-4, SP-5 \|

		Table: _Table C.19_
		Table: _Table C.21_

		\| Risk factors \| Impact \| Security profiles \|
		\|------------------------------\|--------\|-------------------\|
		@@ -1061,23 +1040,21 @@ Table: _Table C.19_
		\| all others \| Medium \| SP-2 \|
		\| CON > 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-4, SP-5 \|

		Table: _Table C.20_
		Table: _Table C.22_

		Requirements that mitigate this threat: CONF, TRAF, IPv6, CDST, LOGG

		Mitigations for Likelihood:

		* Medium to Low: CONF-5, (TRAF-1 or (TRAF-2 and TRAF-3 and TRAF-4)), IPv6-1, IPv6-2

		* High to Low: TRAF-1, IPv6-1, IPv6-2

		Mitigations for Impact:

		* Medium to Low: AUTH-3, LOGG-1, CDST

		* High to Low: AUTH-3, AUTH-4, AUTH-5, LOGG-1, LOGG-2, CDST

		### C.4.12 TH-CNFM: Access to assets via configuration errors in a multi-endpoint VPN
		### C.4.14 TH-CNFM: Access to assets via configuration errors in a multi-endpoint VPN

		Attacker may use configuration errors to get unauthorised access to product assets in a multi-endpoint VPN.

		@@ -1087,7 +1064,7 @@ Attacker may use configuration errors to get unauthorised access to product asse
		\| all others \| Medium \| SP-4 \|
		\| CON = 0 or CFG = 0 or max(ADM, COM) = 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-2, SP-3 \|

		Table: _Table C.19_
		Table: _Table C.23_

		\| Risk factors \| Impact \| Security profiles \|
		\|------------------------------\|--------\|-------------------\|
		@@ -1095,23 +1072,21 @@ Table: _Table C.19_
		\| all others \| Medium \| none \|
		\| CON = 0 or max(DAT, FUN) = 0 \| Low \| SP-1, SP-2, SP-3 \|

		Table: _Table C.20_
		Table: _Table C.24_

		Requirements that mitigate this threat: CONF, TRAF, IPv6, CDST, LOGG

		Mitigations for Likelihood:

		* Medium to Low: CONF-5, (NUTI-1 or TRAF-1 or (TRAF-2 and TRAF-3 and TRAF-4)), IPv6-1, IPv6-2

		* High to Low: NUTI-1, NUTI-2, IPv6-1, IPv6-2

		Mitigations for Impact:

		* Medium to Low: AUTH-3, LOGG-1, CDST

		* High to Low: AUTH-3, AUTH-4, AUTH-5, LOGG-1, LOGG-2, CDST

		### C.4.13 TH-META: Compromise of PII due to metadata and traffic analysis
		### C.4.15 TH-META: Compromise of PII due to metadata and traffic analysis

		Attacker may use user metadata such as IP addresses and traffic analysis to compromise personally identifiable information.

		@@ -1127,23 +1102,21 @@ Table: _Table C.25_
		\| PII = 2 \| High \| SP-3 \|
		\| all others \| Medium \| SP-1, SP-2, SP-4, SP-5 \|

		Table: _Table C.22_
		Table: _Table C.26_

		Requirements that mitigate this threat:

		Mitigations for Likelihood:

		* Medium to Low: TODO - transfer risk to user

		* High to Low: TODO - transfer risk to user

		Mitigations for Impact:

		* Medium to Low: TODO - transfer risk to user

		* High to Low: TODO - transfer risk to user

		### C.4.14 TH-RCOM: RDPS compromise and isolation
		### C.4.16 TH-RCOM: RDPS compromise and isolation

		Attacker may use compromise or isolation errors in remote data processing system to gain access to product assets.

		@@ -1153,7 +1126,7 @@ Attacker may use compromise or isolation errors in remote data processing system
		\| all others \| Medium \| SP-4 \|
		\| RDP = 0 or DAT = 0 or FUN = 0 \| Low \| SP-1, SP-2 \|

		Table: _Table C.23_
		Table: _Table C.27_

		\| Risk factors \| Impact \| Security profiles \|
		\|-------------------\|--------\|-------------------\|
		@@ -1161,23 +1134,21 @@ Table: _Table C.23_
		\| all others \| Medium \| SP-2, SP-4 \|
		\| DAT = 0 & FUN = 0 \| Low \| SP-1 \|

		Table: _Table C.24_
		Table: _Table C.28_

		Requirements that mitigate this threat: TODO

		Mitigations for Likelihood:

		* Medium to Low: TODO

		* High to Low: TODO

		Mitigations for Impact:

		* Medium to Low: TODO

		* High to Low: TODO

		### C.4.15 TH-USED: Access to data via access to used product
		### C.4.17 TH-USED: Access to data via access to used product

		Attacker may get unauthorised access to confidential data stored on the product through access to or acquisition of a device containing the used product.

		@@ -1187,7 +1158,7 @@ Attacker may get unauthorised access to confidential data stored on the product
		\| all others \| Medium \| SP-2, SP-5 \|
		\| DAT = 0 \| Low \| SP-1 \|

		Table: _Table C.25_
		Table: _Table C.29_

		\| Risk factors \| Impact \| Security profiles \|
		\|--------------\|--------\|-------------------\|
		@@ -1195,23 +1166,21 @@ Table: _Table C.25_
		\| all others \| Medium \| SP-2, \|
		\| DAT = 0 \| Low \| SP-1 \|

		Table: _Table C.26_
		Table: _Table C.30_

		Requirements that mitigate this threat: AUTH, CDST, SCDL, SDEF
		Requirements that mitigate this threat: AUTH, CDST, SCDL, SDRF

		Mitigations for Likelihood:

		* Medium to Low: (RSET or INST or DELE), SDRF, SDTR

		* High to Low: (RSET or INST or DELE), SDRF, SDTR

		Mitigations for Impact:

		* Medium to Low: AUTH-5, CDST

		* High to Low: AUTH-3, AUTH-4, AUTH-5, CDST

		### C.4.15 TH-CPII: Compromise of PII stored or transmitted by the product
		### C.4.18 TH-CPII: Compromise of PII stored or transmitted by the product

		Attacker may get unauthorised access to personally identifiable information stored or transmitted by the product.

		@@ -1220,23 +1189,22 @@ Attacker may get unauthorised access to personally identifiable information stor
		\| PII = 2 & DATA = 2 & FUN = 2 \| High \| SP-3 \|
		\| all others \| Medium \| SP-1, SP-2, SP-4, SP-5 \|

		Table: _Table C.25_
		Table: _Table C.31_

		\| Risk factors \| Impact \| Security profiles \|
		\|--------------\|--------\|------------------------\|
		\| PII = 2 \| High \| SP-3 \|
		\| all others \| Medium \| SP-1, SP-2, SP-4, SP-5 \|

		Table: _Table C.26_
		Table: _Table C.32_

		Requirements that mitigate this threat: AUTH, DMIN, CRYPT, AUTH, ROUT, DNSL, CDST, SCDL, SDEF, LOGG
		Requirements that mitigate this threat: AUTH, DMIN, CRYPT, AUTH, ROUT, DNSL, CDST, SCDL, SDRF, LOGG

		All mitigations from TH-UEAC, TH-MITM, TH-LEAK, TH-PLNS, TH-PLNM, TH-UNAA, TH-CONF, TH-META, TH-RCOM, TH-USED apply (using those requirement's risk formula), in addition to:

		Mitigations for Impact:

		* Medium to Low: NPII-1

		* High to Low: NPII-1, NPII-2, NPII-3, NPII-4

		## C.5 Mapping of use cases to risk factors and security profiles
		@@ -1249,7 +1217,7 @@ Mitigations for Impact:
		\| UC-4 \| Small organisation \| 2 \| 2 \| 2 \| 1 \| 1 \| 2 \| 2 \| 2 \| 1 \| 1 \| SP-4 \|
		\| UC-5 \| Large enterprise \| 2 \| 2 \| 2 \| 2 \| 0 \| 2 \| 2 \| 2 \| 2 \| 1 \| SP-4 \|

		Table: _Table C.27 — Use cases mapped to risk factors and security profiles_
		Table: _Table C.33 — Use cases mapped to risk factors and security profiles_

		## C.6 Security profiles

		@@ -1267,7 +1235,7 @@ Security profiles are an informative resource to the assessor. Each security pro
		\| SP-4 \| Small organisation \| 2 \| 2 \| 2 \| 1 \| 1 \| 1 \| 2 \| 2 \| 1 \| 1 \|
		\| SP-5 \| Large enterprise \| 2 \| 2 \| 2 \| 2 \| 0 \| 1 \| 2 \| 2 \| 2 \| 1 \|

		Table: _Table C.28 — Security profiles mapped to risk factors_
		Table: _Table C.34 — Security profiles mapped to risk factors_

		# Annex D (informative): Risk evaluation guidance

		@@ -1309,8 +1277,8 @@ This clause describes the methodology followed in the current text.
		\| CNFM \| CONF, TRAF, IPv6, CDST, LOGG \|
		\| META \| TODO \|
		\| RCOM \| TODO \|
		\| USED \| AUTH, CDST, SCDL, SDEF \|
		\| CPII \| AUTH, DMIN, CRYPT, AUTH, ROUT, DNSL, CDST, SCDL, SDEF, LOGG \|
		\| USED \| AUTH, CDST, SCDL, SDRF \|
		\| CPII \| AUTH, DMIN, CRYPT, AUTH, ROUT, DNSL, CDST, SCDL, SDRF, LOGG \|

		Table: _Table D.1 — Map of risks to requirements_

clauses/5.Requirements.md

+1 −1

Original line number	Diff line number	Diff line
		@@ -168,7 +168,7 @@ The input fields of the product that may produce memory errors shall be identifi
		All security-relevant software shall be compiled with secure compilation flags and options appropriate to the target platform and language. All compilation flags used shall be documented as to their rationale, along with any exceptions or limitations. Any exceptions to the flags or warnings shall be documented as to why they do not create an unacceptable risk.

		* Applicability: Product implemented in a compiled language
		* Reference: TR-SDDV
		* Reference: TR-SSDD
		* Objective: Secure design and development
		* Preparation: Document which flags should be used
		* Activities: Review compilation flags, warnings, and documentation for exceptions