Delete REQ-SSD-06 (MI-SCFS) (5a85494a) · Commits · STAN4CRA / EN 304 620 Virtual Private Networks Part 1

EN-304-620.md

+1 −10

Original line number	Diff line number	Diff line
		@@ -833,8 +833,7 @@ Requirements that mitigate this threat: REQ-SSD, REQ-EMM, REQ-LOG

		Mitigations for Likelihood:

		* Medium to Low: REQ-SSD-06 (MI-SCFS)
		* High to Low: (REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)), REQ-SSD-06 (MI-SCFS), REQ-EMM-02 (MI-NUTI-1), REQ-INT-05 (MI-NUTI-2)
		* High to Low: (REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)), REQ-EMM-02 (MI-NUTI-1), REQ-INT-05 (MI-NUTI-2)

		Mitigations for Impact:

		@@ -1372,13 +1371,11 @@ Table { seq tab }: Mapping of risks to requirements

		## D.1 _UC-1_ Individual consumer

		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SU-02 (MI-KEVD) or REQ-SU-03 (MI-KEVA)

		## D.2 _UC-2_ Privacy conscious household

		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		* REQ-SU-02 (MI-KEVD)
		@@ -1386,7 +1383,6 @@ Table { seq tab }: Mapping of risks to requirements
		## D.3 _UC-3_ Journalist, activist, legal professionals

		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		* REQ-SU-02 (MI-KEVD)
		@@ -1394,7 +1390,6 @@ Table { seq tab }: Mapping of risks to requirements
		## D.4 _UC-4_ Small enterprise, small not-for-profit organization

		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		* REQ-SU-02 (MI-KEVD)
		@@ -1402,7 +1397,6 @@ Table { seq tab }: Mapping of risks to requirements
		## D.5 _UC-5_ Large enterprise

		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		* REQ-SU-02 (MI-KEVD)
		@@ -1410,13 +1404,11 @@ Table { seq tab }: Mapping of risks to requirements
		## D.6 _UC-6_ Enterprise with independent VPN infrastructure

		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)

		## D.7 _UC-7_ Mesh Network

		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		* REQ-SU-02 (MI-KEVD)
		@@ -1427,7 +1419,6 @@ Table { seq tab }: Mapping of risks to requirements
		\|------------------------:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|
		\| REQ-SSD-03 (MI-FZ95) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-04 (MI-BTIN) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-06 (MI-SCFS) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-KEV-02 (MI-KEVT) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-07 \| x \| x \| x \| x \| x \| \| x \|
		\| REQ-SBD-02 (MI-CONF-5) \| x \| x \| x \| x \| x \| \| x \|

clauses/5.Requirements.md

+0 −24

Original line number	Diff line number	Diff line
		@@ -24,10 +24,6 @@ Use cases (as described in [clause 4.6](#use-cases) and [annex B](#annex-b-inf

		[//]: # (TODO link B.TK above)

		#### 5.2.1.3 Compilation mitigation mechanisms (MI-SCFS)

		In addition to memory safety, compiled software is a potential target based on platform and language. Products hardened against these known attack vectors reduce risk to end users.

		### 5.2.3 REQ-SSD-03 (MI-FZ95) Runtime code coverage checking with memory access error detection (MI-FZ95)

		#### 5.2.3.1 Requirement
		@@ -72,25 +68,6 @@ The product's technical documentation shall record any memory errors along with
		* UC-6: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply
		* UC-7: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply

		### 5.2.6 REQ-SSD-06 (MI-SCFS) Secure compilation flags

		#### 5.2.6.1 Requirement

		1. REQ-SSD-06 (MI-SCFS)-1 Products shall incorporate built-in exploit mitigation mechanisms appropriate to the target platform and language (e.g., Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), or Stack Canaries), and
		2. REQ-SSD-06 (MI-SCFS)-2 any exceptions to these mitigations shall be documented as to how each exception does not create an unacceptable risk.

		#### 5.2.6.2 Applicability

		This requirement applies to products that are implemented in a compiled programming language and fall within the following use cases:

		* UC-1: required
		* UC-2: required
		* UC-3: required
		* UC-4: required
		* UC-5: required
		* UC-6: required
		* UC-7: required

		### 5.2.7 REQ-SSD-07 Applicability of Annex R

		##### 5.2.7.1 Requirement
		@@ -121,7 +98,6 @@ This requirement does not apply to UC-6 because by definition that use case does
		\|---------------------:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|:----:\|
		\| REQ-SSD-03 (MI-FZ95) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-04 (MI-BTIN) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-06 (MI-SCFS) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-07 \| x \| x \| x \| x \| x \| \| x \|

		¹ REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply

clauses/6.Assessment-Criteria.md

+0 −29

Original line number	Diff line number	Diff line
		@@ -135,35 +135,6 @@ Otherwise FAIL
		* Memory error report
		* Documentation of any memory errors

		### 6.2.6 REQ-SSD-06 (MI-SCFS): Secure compilation flags

		#### 6.2.6.1 Objective

		Secure software design and development

		#### 6.2.6.2 Preparation

		Document the exploit mitigations technically relevant to the architecture of the target platform.

		#### 6.2.6.3 Activities

		1. Inspect the compiled executable binaries to verify the presence of the required exploit mitigations
		2. Review documentation for exceptions

		#### 6.2.6.4 Verdict

		PASS if all of the following are fulfilled:

		* Binaries actively implement the appropriate exploit mitigations, and
		* all exceptions have corresponding documentation demonstrating that each does not constitute an unacceptable cybersecurity risk.

		Otherwise FAIL

		#### 6.2.6.5 Evidence

		* Output of binary analysis tools demonstrating the presence of exploit mitigations
		* Documentation of exceptions

		### 6.2.7 REQ-SSD-07 Applicability of Annex R

		See annex R.5 for full assessment criteria.