Loading EN-304-620-1.md +85 −85 Original line number Diff line number Diff line Loading @@ -706,8 +706,8 @@ Attacker may use unknown exploitable vulnerabilities in the product implementati | max(DAT, FUN, COM) = 1 | Medium | SP-2 | | max(DAT, FUN, COM) = 0 | Low | SP-1 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading Loading @@ -736,8 +736,8 @@ Attacker may use known exploitable vulnerabilities in the product implementation | all others | Medium | SP-2 | | max(DAT, FUN, COM) = 0 or ADM = 0 | Low | SP-1, SP-3 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -756,14 +756,14 @@ Mitigations for Likelihood: Attacker may gain unauthorized access to an endpoint in a manner not under control of the product, exposing product assets. | Risk factors | Likelihood | Security profile | |-------------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |-------------------|------------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading Loading @@ -796,35 +796,35 @@ Requirements: TODO (RDPS) ### C.4.x TH-MTM: Attacker attempts to read or modify traffic by capturing and relaying activity between endpoints | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-1, SP-3 | | all others | Medium | SP-2 | | ADM = 0 | Low | SP-4 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Requirements: CRYPT, NPII, LOGG | Likelihood | Impact | Mitigation | Security profile | |------------|------------|--------------------------------|------------------| | Likelihood | Impact | Mitigation | Security profiles | |------------|------------|--------------------------------|-------------------| | High | High | CRYPT-1, CRYPT-2, NPII-2, LOGG | SP-3 | | all others | all others | CRYPT-2, LOGG | SP-1, SP-2, SP-4 | ### C.4.x TH-LEK: Attacker reads sensitive data sent outside the VPN connection by the product. | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | DNC = 2 | High | SP-\* | | DNC = 1 | Medium | none | | DNC = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -845,14 +845,14 @@ Mitigations for Impact: ### C.4.x TH-PLN: Transmitting data in the clear | Risk factors | Likelihood | Security profile | |--------------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------------|------------|-------------------| | CFG = 2 or ADM = 2 | High | SP-\* | | CFG = 1 | Medium | none | | CFG = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -873,14 +873,14 @@ Mitigations for Impact: ### C.4.x TH-UNA: Someone is trying to login to your VPN | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-\* | | ADM = 1 | Medium | none | | ADM = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -901,14 +901,14 @@ Mitigations for Impact: ### C.4.x TH-LDEL: Attacker deletes local logs to hide activity | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-\* | | ADM = 1 | Medium | none | | ADM = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -931,14 +931,14 @@ Mitigations for Impact: _Complete sentence describing the threat._ | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | | High | | | | Medium | | | | Low | | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading Loading
EN-304-620-1.md +85 −85 Original line number Diff line number Diff line Loading @@ -706,8 +706,8 @@ Attacker may use unknown exploitable vulnerabilities in the product implementati | max(DAT, FUN, COM) = 1 | Medium | SP-2 | | max(DAT, FUN, COM) = 0 | Low | SP-1 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading Loading @@ -736,8 +736,8 @@ Attacker may use known exploitable vulnerabilities in the product implementation | all others | Medium | SP-2 | | max(DAT, FUN, COM) = 0 or ADM = 0 | Low | SP-1, SP-3 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -756,14 +756,14 @@ Mitigations for Likelihood: Attacker may gain unauthorized access to an endpoint in a manner not under control of the product, exposing product assets. | Risk factors | Likelihood | Security profile | |-------------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |-------------------|------------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading Loading @@ -796,35 +796,35 @@ Requirements: TODO (RDPS) ### C.4.x TH-MTM: Attacker attempts to read or modify traffic by capturing and relaying activity between endpoints | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-1, SP-3 | | all others | Medium | SP-2 | | ADM = 0 | Low | SP-4 | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Requirements: CRYPT, NPII, LOGG | Likelihood | Impact | Mitigation | Security profile | |------------|------------|--------------------------------|------------------| | Likelihood | Impact | Mitigation | Security profiles | |------------|------------|--------------------------------|-------------------| | High | High | CRYPT-1, CRYPT-2, NPII-2, LOGG | SP-3 | | all others | all others | CRYPT-2, LOGG | SP-1, SP-2, SP-4 | ### C.4.x TH-LEK: Attacker reads sensitive data sent outside the VPN connection by the product. | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | DNC = 2 | High | SP-\* | | DNC = 1 | Medium | none | | DNC = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -845,14 +845,14 @@ Mitigations for Impact: ### C.4.x TH-PLN: Transmitting data in the clear | Risk factors | Likelihood | Security profile | |--------------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------------|------------|-------------------| | CFG = 2 or ADM = 2 | High | SP-\* | | CFG = 1 | Medium | none | | CFG = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -873,14 +873,14 @@ Mitigations for Impact: ### C.4.x TH-UNA: Someone is trying to login to your VPN | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-\* | | ADM = 1 | Medium | none | | ADM = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -901,14 +901,14 @@ Mitigations for Impact: ### C.4.x TH-LDEL: Attacker deletes local logs to hide activity | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | ADM = 2 | High | SP-\* | | ADM = 1 | Medium | none | | ADM = 0 | Low | none | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading @@ -931,14 +931,14 @@ Mitigations for Impact: _Complete sentence describing the threat._ | Risk factors | Likelihood | Security profile | |--------------|------------|------------------| | Risk factors | Likelihood | Security profiles | |--------------|------------|-------------------| | | High | | | | Medium | | | | Low | | | Risk factors | Impact | Security profile | |-------------------|--------|------------------| | Risk factors | Impact | Security profiles | |-------------------|--------|-------------------| | DAT = 2 & FUN = 2 | High | SP-3 | | all others | Medium | SP-2, SP-4 | | DAT = 0 & FUN = 0 | Low | SP-1 | Loading
