Commit bd4edb5f authored by Valerie Aurora's avatar Valerie Aurora
Browse files

Add complexity of network configuration and update risk factors table

parent cecfcc59

EN-304-620-1.md

+16 −6
Original line number Diff line number Diff line
@@ -616,6 +616,16 @@ Rationale: More users with physical access to manufacturer infrastructure increa 
* **[RDP-1]** Manufacturer has direct access to all remote data processing infrastructure

* **[RDP-2]** Manufacturer infrastructure in a multi-tenant SaaS system



### C.2.7 RF-CNC: Difficulty of network configuration



Description: Difficulty of configuring, controlling, and monitoring the configuration of the network connection on the platform the product is running on.



Rationale: The more difficult it is to configure the network connection, maintain control over that configuration, and learn about changes to the configuration, the more likely it is that the configuration will become insecure.



* **[CNC-0]** Product has complete control over the network configuration

* **[CNC-1]** Product is using a well-defined, predictable platform service to configure the network connection

* **[CNC-2]** Other software can change network configuration without notification or permission from the product



## C.3 Assumptions



**[AS-PP]:** The platform the product is running on is trustworthy.
@@ -750,12 +760,12 @@ Requirements: CRYPT-1, CRYPT-2 


### C.5. Mapping of use cases to risk factors



|      | Use case                    | CFG | AUT | DAT | FUN | ADM |

|------|-----------------------------|-----|-----|-----|-----|-----|

| UC-1 | Individual consumer         | 1   | 0   | 0   | 0   | 2   |

| UC-2 | Privacy conscious household | 1   | 0   | 1   | 1   | 1   |

| UC-3 | Journalist or activist      | 1   | 1   | 2   | 2   | 1   |

| UC-4 | Small organization          | 2   | 1   | 1   | 1   | 0   |

| Use case | Description                 | CFG | AUT | DAT | FUN | ADM | RDP | CNC |

|----------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|

| UC-1     | Individual consumer         | 1   | 0   | 0   | 0   | 2   | 2   | 2   |

| UC-2     | Privacy conscious household | 1   | 0   | 1   | 1   | 1   | 2   | 2   |

| UC-3     | Journalist or activist      | 1   | 1   | 2   | 2   | 1   | 2   | 2   |

| UC-4     | Small organization          | 2   | 1   | 1   | 1   | 0   | 1   | 2   |



_Table C.TODO — Use cases mapped to risk factors_