Add more details to risk factors, data and threats

This list of use cases is an informative resource to the manufacturer to simplify choosing a set of security requirements. Each use case is mapped to a security level, which is a collection of risks and the security requirements necessary to mitigate them.

* **UC-0** ~~Microenterprise, hobbyist~~

  * (this type of user is likely using VPN software that is preinstalled on a router or modem, not offered as a product with digital elements on the EU market. out of scope.)

* **UC-0** Hobbyists, internet communities

  * individuals in the "self-hosting" community, running their own private infrastructure, like network-accessible storage, media servers.

  * informal communities that have shared private infrastructure, like game servers or collaboration tools.

* **UC-1** Small enterprise, small not-for-profit organisation

  * limited or no full-time IT/network administration

  * **CFG-L-2** End user is provided clear configuration instructions and software is supplied directly by manufacturer or MDM

  * **CFG-L-3** End user is provided configuration information for any protocol-appropriate software to connect to the network

* End-point authorisation

* End-point heterogeneity

  * **EPH-L-0** End-points are using a constrained set of OS types and versions, with software fully managed by enterprise IT; users don't have admin permissions

  * **EPH-L-1** End-points are using a small set of OS types and versions; network admins have control, but users also have admin access

  * **EPH-L-2** End-points are running on a broad set of OS types and versions (potentially outdated), users have full admin access

* Account management and authentication of endpoints

  * **AUT-L-0** Customer uses third party identity provider

  * **AUT-L-1** TK

  * **AUT-L-1** Account details are managed by the customer through a centralized identity system (e.g. active directory)

  * **AUT-L-2** Each system used by the customer involves its own set of account information & secrets

* Method of administrator access

  * **ADM-L-0** Restricted to limited IT professionals with a physical presence on the private network

  * **ADM-L-1** Administrators access VPN management portal via a separate secure network

  * **ADM-L-2** Administrators can access VPN management portal via the VPN

* Administrative control of network configuration

  * **ACN-L-0** A small set of individuals within the same team/organization have administrative access to the management of the VPN network

  * **ACN-L-1** Several teams spread across a large organization have administrative access, with each team potentially having a need to manage different parts of configuration (user accounts & roles; network access policies; API keys; telemetry)

  * **ACN-L-2** Administrative control to VPN configuration is delegated to individuals outside of the customer organization (e.g. contractors) or third-party systems through API integrations.

* Physical access to data processing

  * **PHY-L-N**

  * **PHY-L-N**

  * **PHY-L-N**

* Method of administrator access to VPN configuration

  * **ADM-L-0** Restricted to IT professionals with physical presence on the private network

  * **ADM-L-1** Administrators access VPN management portal via a separate secure network

  * **ADM-L-2** Administrators can access VPN management portal via the VPN itself

  * **ADM-L-3** VPN management portal is publicly accessible on the internet

* Node exposure to a public network

  * **PUB-L-0** Node is always behind a firewall on a private network and does not move

  * **PUB-TK-1** Node is in the DMZ? Is that a thing people do?

  * **PUB-L-2** Node does not maintain a consistent location and connects directly to a public network (not through a firewall)

* Access to management server and data processing

  * **PHY-L-N** physically and logically managed by the customer

  * **PHY-L-N** logically managed by the customer, hosted in the cloud

  * **PHY-L-N** hosted and managed by the manufacturer, single-tenant

  * **PHY-L-N** hosted and managed by the manufacturer, multi-tenant

* Exposure to public networks

  * **PUB-L-0** VPN tunnels are established over a private backbone controlled by the customer

  * **PUB-L-1** VPN tunnels are established over public networks with dedicated medium (ethernet, *dsl)

  * **PUB-L-2** VPN tunnels are established over public networks with shared medium (satellite, wireless)

### 4.X.1 Mapping of use cases to risk factors and security profiles

> What data is stored on the product?

- Activity logs

- Data transmitted over the VPN network

- Management and configuration data

  - Configuration data

  - Management application certificates

  - CA information, certificates & keys (public, private, PSK)

  - End-point details including authentication, location, and potential PII

- Statistics and telemetry data

  - Network configuration audit logs

  - Network flow logs and other statistics about data transferred over the network

  - Debugging logs from end-points and VPN gateways

### C.1.2 Product functions

> Example threats can be found in the same documents suggested in the section on security requirements.

- End-point compromise

  - End-point malware hijacking traffic or recording activity

- Social engineering resulting in credential harvesting

  - Unauthorised but authenticated access by a compromised node/end-point

  - Misconfigured end-point exposing authentication information

- DoS attack, particularly if a node/end-point is outside of a firewall

  - Cloning of the end-point machine to gain unauthorized access

- Social engineering resulting in credential harvesting (both for end-users, and admins accessing the management server)

- DoS attack (both for tunnel endpoints, and for the management server)

- manufacturer cnfra compromise & isolation bugs in a multin-tenant saas system

- Activity exposure via unauthorised log access

- Out-of-the-box configuration that necessarily requires modification to be secure