@@ -966,11 +966,11 @@ Attacker may use configuration errors to get unauthorized access to the product
| all others | Medium | SP-2, SP-4 |
| DAT = 0 & FUN = 0 | Low | SP-1 |
Requirements that mitigate this threat: EISO, TRAF, IPv6, CDST, DMIN, LOGG
Requirements that mitigate this threat: CONF, EISO, TRAF, IPv6, CDST, DMIN, LOGG
Mitigations for Likelihood:
* Medium to Low: EISO, (TRAF-1 or (TRAF-2 and TRAF-3 and TRAF-4)), IPv6-\*
* Medium to Low: CONF-6, EISO, (TRAF-1 or (TRAF-2 and TRAF-3 and TRAF-4)), IPv6-\*
* High to Low: EISO, TRAF-1, IPv6-\*
@@ -1018,8 +1018,6 @@ Threat: Metadata and traffic‑analysis risks
-TR: User interfaces, especially in regard to settings, shall be designed in a manner that prevents unintentional disabling of default security features.
Threat: Misconfigured end-point exposing authentication information
Threat: Manufacturer infra compromise & isolation bugs in a multi-tenant SaaS system
### C.5.2 Mapping of use cases to risk factors and security profiles
@@ -481,6 +481,20 @@ Guidance: The VPN product should be able to operate without a wide set of permis
* Verdict: The VPN client did not request any permissions => PASS, otherwise FAIL
* Evidence: Collected permission states, annotations of any permission requests explaining why they are more restricted/secure, log messages from tests
#### 5.2.6.6 MI-CONF-5: User interfaces shall prevent unintentional disabling of security features
User interfaces, especially in regard to settings, shall be designed in a manner that prevents unintentional disabling of default security features.
> TODO: Fill in below
* Applicability: (optional, for requirements that depend on a feature)
* Reference: TR-
* Objective:
* Preparation:
* Activities:
* Verdict:
* Evidence:
### 5.2.7 TR-NUTI No untrusted traffic in the VPN connection
