@@ -963,6 +963,39 @@ The product shall have vulnerability handling processes compliant with [\[2\]](#
* Verdict: Vulnerability handling documentation is compliant with [\[2\]](#_ref_2) prEN 40000-1-3: \"Cybersecurity requirements for products with digital elements – Vulnerability Handling\" => PASS, otherwise FAIL
* Evidence: Vulnerability handling documentation, comparison with [\[2\]](#_ref_2) prEN 40000-1-3: \"Cybersecurity requirements for products with digital elements – Vulnerability Handling\"
### 5.2.19 TR-AVAI: Availability
#### 5.2.19.1 Requirement
The product shall protect the availability of essential and core functions.
#### 5.2.19.4 MI-FDRP: Fast packet drop
The product shall check network traffic from untrusted sources for validity and discard it efficiently, using reasonable efforts to minimize use of system resources on invalid packets.
Guidance: One method of minimizing resource use on invalid packets is to do the least resource-intensive validity checks first, and to do validity checks before using system resources based on possibly invalid data. For example, verifying that the length of a packet is valid should be done before verifying that the source address is valid, and both should be done before allocating memory necessary to process a packet of that length.
* Reference: TR-AVAI
* Objective: Maintain service availability during denial of service attacks
* Preparation: Create a selection of invalid packets and enable some type of instrumentation or logging in the packet validity checking code
* Activities: For each invalid packet, send the packet to the product and record the checks it makes and its use of system resources before it drops the packet
* Verdict: For each invalid packet, if the packet used resources that were not reasonably required to reject the packet, or the packet was not rejected => FAIL, otherwise PASS
* Evidence: Invalid packets and their descriptions, logs of processing, annotations explaining why the order of operations is the most efficient reasonable way to process the packet.
#### 5.2.19.5 MI-LMEM: Limit memory usage
> TODO: Write mitigation requiring the interface limit memory usage triggered by user input via network or host.
#### 5.2.19.6 MI-FAIR: Fair resource usage and prioritization
> TODO: Write mitigation requiring the interface implement some form of ensuring fair resource usage by multiple sources of input, including the ability to prioritize some sources of input
#### 5.2.19.7 MI-DOST: Document risk transfer to operational environment for denial of service
> TODO: Write mitigation documenting that the operational environment must provide denial of service protection, such as an external or internal firewall, fair queueing or filtering be the OS, a proxy, etc.
