Move C.6 to 5.3

| Security Profile     | Requires mitigations   |

|----------------------|------------------------|

|                      |                        |

## 5.3 Security profiles

Security profiles are an informative resource to the manufacturer to allow them to appropriately evaluate risks based on use cases. All VPNs will have a baseline of security requirements regardless of the use case and environment of their product. Additional security requirements will align with the reasonably foreseeable use (and, potentially, the reasonably foreseeable mis-use) of their particular product, based on the security profile appropriate for their product.

The different user types have varying needs that correspond directly to the security profiles defined in the present document. A manufacturer should take these into account to ensure the product's security is proportionate to its intended use. Due to the wide variety of potential users and usages of a single VPN product, multiple security profiles may apply to a single product.

> TODO-HAS: Update risk factors

| Security profile                   | CFG | AUT | DAT | FUN | ADM |

|------------------------------------|-----|-----|-----|-----|-----|

| SP-1  Individual consumer          |   1 |   0 |   0 |   0 |   2 |

| SP-2  Privacy conscious household  |   1 |   0 |   1 |   1 |   1 |

| SP-3  Journalist or activist       |   1 |   1 |   2 |   2 |   1 |

| SP-4  Small organization           |   2 |   1 |   1 |   1 |   0 |

_Table C.1 — Security profiles mapped to risk factors_

> TODO-HAS: Update mitigation sets

| Mitigation            | SP-1 | SP-2 | SP-3 | SP-4 |

|-----------------------|------|------|------|------|

| ROUT-1                | Y    | Y    | Y    | Y    |

| CONF-1                | Y    | Y    | Y    | Y    |

| CONF-2                | Y    | Y    | Y    | Y    |

| CONF-3                | Y    | Y    | Y    | Y    |

| NUTI-1                | Y    | Y    | Y    | Y    |

| NUTI-2                | N    | Y    | Y    | Y    |

| AUTH-1                | Y    | Y    | Y    | Y    |

| AUTH-2                | Y    | Y    | Y    | Y    |

| AUTH-3                | N    | Y    | Y    | Y    |

| AUTH-4                | N    | Y    | Y    | Y    |

| AUTH-5                | N    | Y    | Y    | Y    |

| DNSL-1                | Y    | Y    | Y    | N    |

| DNSL-2                | Y    | Y    | Y    | Y    |

| DNSL-3                | N    | Y    | Y    | N    |

| DNSL-4                | N    | Y    | Y    | Y    |

| DNSL-5                | N    | N    | Y    | N    |

| DNSL-6                | N    | N    | Y    | N    |

| EISO                  | Y    | Y    | Y    | Y    |

| TRAF-1                | N    | N    | Y    | N    |

| TRAF-(1 or 2 & 3 & 4) | Y    | Y    | N    | Y    |

_Table C.2 — Security profiles mapped to mitigations_

> TODO-HAS: Turn below threats into formal threats and mitigations

Threat: someone is trying to login to your VPN

- TR: log access attempts

Threat: attacker has access to your VPN client/network, changes config

- TR: log configuration changes

Threat: attacker deletes local logs to hide activity

- TR: send selected logs to a remote server

Threat: someone (maybe VPN provider) gets access to remote logs

- TR: don't remotely log sensitive info

- TR: don't remotely log identifying info

- TR: don't remotely log anything

- TR: delete remote logs frequently

Threat: using your connection unauthorized to transmit data

- TR: don't send data through without user's knowledge <- what is sufficient?

Threat: Transmitting data in the clear

  - using compromised keys

    - TR: key rotation

    - TR: allow for forced key expiry

- Unauthorized reads of config data

  - TR: stored in form that can only be read with authorization

  - TR: do not transmit in the clear

- Remote code execution (on client, server, element)

  - TR: mitigation: limit privileges of VPN software

  - TR: split into smaller pieces with lower privileges on some

  - TR: fuzz testing of input data?

  - note: secure design/devel outside scope of this part unless testable on product

- DNS Leaks to local network

  - TR: integrate with things that monitor traffic

Threat: Unencrypted traffic exposes private information

: Warning when disabling encryption

  If a VPN product is capable of disabling encryption, it **shall** provide a warning against disabling encryption

User interfaces, especially in regard to settings, shall be designed in a manner that prevents unintentional disabling of default security features.

User-manageable VPN settings shall be configurable in a manner that introducing unexpected punctuation or other formatting errors cannot result in a failure of encryption.

- Requirement: administrators must be able to revoke and regenerate credentials, individually or in bulk, in case of exploit

- Disable remote access for administrators?

- MFA, obviously