Anti-reflection attack approved in Tuesday meeting (23305215) · Commits · STAN4CRA / EN 304 620 Virtual Private Networks Part 1

EN-304-620.md

+11 −1

Original line number	Diff line number	Diff line
		@@ -1531,11 +1531,13 @@ Mitigations for Likelihood:
		* REQ-INT-01
		* REQ-INT-02
		* REQ-INT-03
		* REQ-IM-02

		* High to Low:
		* REQ-INT-01
		* REQ-INT-02
		* REQ-INT-03
		* REQ-IM-02

		Mitigations for Impact:

		@@ -1591,7 +1593,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		\| [TH-META](#b.4.14-th-meta-compromise-of-privacy-due-to-metadata-and-traffic-analysis) \| REQ-CON-14, REQ-CON-15 \|
		\| [TH-RCOM](#b.4.15-th-rcom-compromise-of-privacy-via-rdps) \| REQ-DM-01, REQ-DM-02, REQ-DM-03, REQ-DM-04, REQ-DM-05, REQ-SSD-03, REQ-LOG-04 \|
		\| [TH-DSTR](#b.4.16-th-dstr-unauthorized-access-to-data-stored-on-product) \| REQ-DRT-01, REQ-DRT-02, REQ-DRT-03, REQ-DRT-04, REQ-CON-14 \|
		\| [TH-HINT](#b.4.17-th-hint-interference-with-host) \| REQ-INT-01, REQ-INT-02, REQ-INT-03, REQ-LOG-01, REQ-LOG-02 \|
		\| [TH-HINT](#b.4.17-th-hint-interference-with-host) \| REQ-INT-01, REQ-INT-02, REQ-INT-03, REQ-IM-02, REQ-LOG-01, REQ-LOG-02 \|

		## B.8: Accounting of requirements for each use case

		@@ -1630,6 +1632,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-01
		* REQ-AP-02
		* REQ-AP-03
		* REQ-IM-02
		* REQ-EMM-01
		* REQ-EMM-02
		* REQ-EMM-03
		@@ -1689,6 +1692,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-02
		* REQ-AP-03
		* REQ-IM-01
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -1755,6 +1759,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-03
		* REQ-AP-04
		* REQ-IM-01
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -1810,6 +1815,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-01
		* REQ-AP-02
		* REQ-AP-03
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -1860,6 +1866,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-02
		* REQ-AP-03
		* REQ-AP-04
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -1914,6 +1921,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-02
		* REQ-AP-03
		* REQ-AP-04
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -1974,6 +1982,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		* REQ-AP-01
		* REQ-AP-02
		* REQ-AP-03
		* REQ-IM-02
		* REQ-MAS-01
		* REQ-EMM-01
		* REQ-EMM-02
		@@ -2055,6 +2064,7 @@ For each risk untreated by the product itself in any applicable use case, a corr
		\| REQ-AP-04 \| \| \| x⁹ \| \| x⁹ \| x⁹ \| \|
		\| \| \| \| \| \| \| \| \|
		\| REQ-IM-01 \| \| x \| x \| \| \| \| \|
		\| REQ-IM-02 \| x \| x \| x \| x \| x \| x \| x \|
		\| \| \| \| \| \| \| \| \|
		\| REQ-MAS-01 \| \| x \| x \| x \| x \| x \| x \|
		\| \| \| \| \| \| \| \| \|

clauses/5.Requirements.md

+22 −1

Original line number	Diff line number	Diff line
		@@ -1285,11 +1285,32 @@ The VPN shall by default not establish routes between different client endpoints
		* UC-6: not required
		* UC-7: not required

		### 5.11.3 Mapping of requirements to use cases
		### 5.11.3 REQ-IM-02: Minimise data transmitted to unverified sources {#REQ-IM-02}

		#### 5.11.3.1 Requirement

		The product shall minimise the data originating from the product itself that is transmitted to an address that has not been verified as requesting the transmitting data.

		#### 5.11.3.2 Applicability

		* UC-1: required
		* UC-2: required
		* UC-3: required
		* UC-4: required
		* UC-5: required
		* UC-6: required
		* UC-7: required

		#### 5.11.3.3 Guidance

		Denial of service attacks over the network often use traffic reflection or amplification techniques, in which the threat actor sends packet to third party devices with a spoofed source address. The third party then sends a response packet to the spoofed source destination - a reflection attack. If the response is larger than the packet it is responding to, then it is an amplification attack. By minimising or rate-limiting the data sent to potentially spoofed source addresses, a product can reduce its interference with other devices.

		### 5.11.4 Mapping of requirements to use cases

		\| Requirements \| UC-1 \| UC-2 \| UC-3 \| UC-4 \| UC-5 \| UC-6 \| UC-7 \|
		\|-------------:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|
		\| REQ-IM-01 \| \| x \| x \| \| \| \| \|
		\| REQ-IM-01 \| x \| x \| x \| x \| x \| x \| x \|

		## 5.12 Attack surface minimization

clauses/6.Assessment-Criteria.md

+32 −1

Original line number	Diff line number	Diff line
		@@ -155,7 +155,7 @@ Otherwise FAIL
		* Sufficient analysis of untrusted inputs
		* List of test inputs
		* Logs of testing inputs and recording behaviour
		* Sufficiency analysis of testing logs
		* Sufficient analysis of testing logs

		#### 6.2.4.6 Guidance

		@@ -1833,6 +1833,37 @@ Otherwise FAIL
		* Log messages
		* Packet capture

		### 6.11.3 [REQ-IM-02](#REQ-IM-02): Minimise data transmitted to unverified sources

		#### 6.11.3.1 Objective

		Minimise negative impact on other devices or services.

		#### 6.11.3.2 Preparation

		Identify interfaces that may transmit data originating from the product itself in reply to incoming data to addresses that have not been verified as requesting the transmitted data. Identify network input that may cause the interface to transmit data in such a manner.

		#### 6.11.3.3 Activities

		For each identified network input, transmit the input to the interface and record any data the product transmits in response. Analyse the amount of data sent in response in the context of the product function and cybersecurity risk assessment.

		#### 6.11.4.4 Verdict

		PASS if all of the following are fulfilled:

		* the response is consistent with reasonable minimisation of data in the response.

		Otherwise FAIL

		#### 6.11.2.5 Evidence

		* List of identified interfaces
		* List of methods for identifying interfaces
		* Sufficient analysis of methods for identifying interfaces
		* List of identified inputs
		* Packet captures or other appropriate logs of the data transmitted
		* Sufficient analysis of amount of data in response

		## 6.12 Attack surface minimization

		### 6.12.1 Overview