Annex B.1: Expand with explanation, more assets, impact/value

This annex applies state-of-the-art methodology to identify threats and identify & evaluate risks based on product use cases.

The security analysis in this Annex represents a risk assessment done by the standardisers solely for the purpose of informing the applicability of technical requirements.

A list of product assets are used to identify potential threats to the product. The assumptions are used to define the scope of potential threats that are addressed by this security analysis.

Risk factor levels for each use case are determined by using the operational coenvironment of each use case to choose a risk factor level that most accurately represents the highest risk for that use case. The use case is determined by the intended purpose and reasonably foreseeable use specified by the manufacturer.

For each threat, a formula based on the risk factor levels is used to calculate the likelihood and impact of the threat. This security analysis uses the likelihood and impact of each threat to identify specific technical requirements that treat that risk.

## B.1 Assets

(previously ## B.1)

(previously ## C.1)

The purpose of cybersecurity is to protect the product assets, which include product data, product functions, digital assets, human-related assets, and hardware. The compromise of each type of asset will have a different impact on the cybersecurity and the functionality of the product. Each asset has a corresponding value to the cybersecurity of the asset.

### B.1.1 Data

### B.1.1 Data assets

(previously ### C.1.1)

- Data transmitted over the VPN network

- Management and configuration data

  - Configuration data

  - Management application certificates

  - CA information, certificates & keys (public, private, PSK)

  - End-point details including authentication, location, and potential Personal Data

- Statistics and telemetry data

  - Network configuration audit logs

  - Network flow logs and other statistics about data transferred over the network

  - Debugging logs from end-points and VPN gateways

- Software applications

  - Device-native applications for connecting to the network (Client or Node software)

| Asset                                 | Compromise impacts                    | Value  |

|---------------------------------------|---------------------------------------|--------|

| Data transmitted over the VPN network | Confidentiality, integrity, functions | High   |

| Product configuration                 | Confidentiality, functions            | High   |

| CA information, certificates & keys   | Authorization/access control          | High   |

| Management application certificates   | Authorization/access control          | Medium |

| Logs with identifying information     | Confidentiality, monitoring           | Medium |

| Configuration audit logs              | Monitoring                            | Low    |

| Network statistics                    | Monitoring                            | Low    |

| Debugging logs                        | Monitoring                            | Low    |

| Telemetry                             | Monitoring                            | Low    |

### B.1.2 Product functions

A basic overview of VPN functions follows. See [clause 4.2](#42-product-architecture) for a detailed overview of the essential functions of a VPN product.

* Edge: uses a public network to communicate with the restricted use network

* Gateway: provides link between public network and restricted

* Router: forward traffic between nodes in the restricted use network

* Filter: select which traffic may transit this node

* Relays: assist nodes in connecting to the restricted use network

* Auth: grant nodes access to the restricted network

| Asset                                           | Compromise impacts            | Value  |

|-------------------------------------------------|-------------------------------|--------|

| Authentication/access control of VPN end-points | Authentication/access control | High   |

| Authentication/access control of VPN servers    | Authentication/access control | High   |

| Encryption of network traffic                   | Confidentiality               | High   |

| Privacy protection                              | Confidentiality               | High   |

| Network traffic routing/filtering/forwarding    | Access control, functions     | Medium |

### B.1.3 Digital assets

| Asset                      | Compromise impacts                            | Value        |

|----------------------------|-----------------------------------------------|--------------|

| VPN server applications    | Everything                                    | Astronomical |

| VPN end-point applications | All end-point assets, some VPN network assets | High         |

### B.1.4 Human-associated assets

| Asset          | Compromise impacts           | Value  |

|----------------|------------------------------|--------|

| Credentials    | Authorization/access control | High   |

| Identity       | Confidentiality              | High   |

| Location       | Confidentiality              | Medium |

| Personal data  | Confidentiality              | Medium |

| VPN usage data | Confidentiality              | Low    |

### B.1.4 Hardware assets

None for the products in the scope of this document.

## B.2 Risk factors