Reformat mitigations to match NI/OS

The product shall be securely updatable by the user.

> TODO: Specification of how secure updates can be done securely is in progress.

#### 5.2.4.2 MI-SUDC: Documentation of secure update

The product shall be accompanied by documentation of the secure update methods for any firmware or software in the product.

* Verdict: Update check fails and error is reported => PASS, otherwise => FAIL

* Evidence: Error message, before and after comparison showing update metadata is not changed

### 5.2.5 **[TR-ROUT]** VPN traffic routed only through VPN connection during VPN connection

### 5.2.5 TR-ROUT VPN traffic routed only through VPN connection during VPN connection

#### 5.2.5.1 Overview: TR-ROUT

#### 5.2.5.1 Requirement

From the moment the user activates the VPN connection until the user knowingly deactivates the VPN connection, no network traffic intended for the VPN connection shall exit the endpoint via anything other than the VPN connection, whether not it is functioning.

#### 5.2.5.2 **[MI-ROUT-1]** VPN routing stays in effect until VPN connection deactivated

#### 5.2.5.2 MI-ROUT-1 VPN routing stays in effect until VPN connection deactivated

The product shall only report that the VPN connection is established after it has configured the system in such a way that all traffic intended to be routed through the VPN connection will only exit through the VPN connection until the user knowingly deactivates the VPN connection. This assumes no other software on the user's endpoint changes relevant network configuration (network interfaces, routes, DNS).

  * Verdict: No network traffic intended for the VPN exits the host

  * Evidence: Configuration of VPN client, method used to force connection to end without allowing shutdown tasks to run, network configuration, log of actions, error messages, packet capture with annotations

#### 5.2.5.3 **[MI-ROUT-2]** VPN routing stays in effect during network-level tunnel failure

#### 5.2.5.3 MI-ROUT-2 VPN routing stays in effect during network-level tunnel failure

The product shall ensure that when the connection to the VPN server is lost at the network level (e.g., due to firewall rules or network outage), no traffic intended for the VPN connection can exit the endpoint through another interface.

  * Verdict: No network traffic intended for the VPN exits the host via a non-VPN interface

  * Evidence: Method used to induce tunnel failure, network configuration, log of actions, error messages, packet capture with annotations

#### 5.2.5.4 **[MI-ROUT-3]** Tunnel all traffic by default

#### 5.2.5.4 MI-ROUT-3 Tunnel all traffic by default

The VPN client shall by default be configured to route all network traffic from the endpoint through the VPN connection. If the client offers a mode that only tunnels traffic from specific applications (e.g., "split tunneling" or browser-only mode), this shall not be the default mode, and the user must be clearly informed of its limitations before enabling it.

All mitigations are required for all products.

### 5.2.6 **[TR-CONF]** VPN client preserves system configuration

### 5.2.6 TR-CONF VPN client preserves system configuration

#### 5.2.6.1 Overview: TR-CONF

#### 5.2.6.1 Requirement

The establishment and ending of a VPN connection shall not result in functional changes to the system configuration unless explicitly authorized by the user.

#### 5.2.6.2 **[MI-CONF-1]** VPN client restores any system configuration it changes to its previous state after the VPN connection ends

#### 5.2.6.2 MI-CONF-1 VPN client restores any system configuration it changes to its previous state after the VPN connection ends

After the user knowingly deactivates the VPN connection, the VPN client shall restore any system configuration it has changed to a state that is functionally equivalent to the state it was in before the VPN connection began.

  * Verdict: All system configuration collected is functionally the same before and after the VPN connection starts and ends => PASS, otherwise FAIL

  * Evidence: Collected system configuration, annotations of any configuration changes explaining why they aren't functional, log messages from tests

#### 5.2.6.3 **[MI-CONF-2]** VPN client provides a method to restore any system configuration it changes to its previous state

#### 5.2.6.3 MI-CONF-2 VPN client provides a method to restore any system configuration it changes to its previous state

The VPN client shall provide a simple user-accessible documented method to restore any system configuration it has changed to a state that is functionally equivalent to the state it was in before the VPN connection began, regardless of whether a previous VPN connection was able to complete connection shutdown tasks.

  * Verdict: All system configuration collected is functionally the same before and after the VPN connection starts and the system configuration restoration method completes => PASS, otherwise FAIL

  * Evidence: Collected system configuration, annotations of any configuration changes explaining why they aren't functional, log messages from tests, method used to force connection to end without allowing shutdown tasks to run, method used to restore system configuration

#### 5.2.6.4 **[MI-CONF-3]** VPN client does not degrade system security

#### 5.2.6.4 MI-CONF-3 VPN client does not degrade system security

The VPN client shall not reduce system security after the end of the VPN connection, even if normal connection shutdown tasks have not completed.

  * Verdict: All system configuration collected is at least as secure/restricted as before the VPN connection started => PASS, otherwise FAIL

  * Evidence: Collected system configuration, annotations of any configuration changes explaining why they are more restricted/secure, log messages from tests, method used to force connection to end without allowing shutdown tasks to run

#### 5.2.6.5 **[MI-CONF-4]** VPN client does not degrade system security

#### 5.2.6.5 MI-CONF-4 VPN client does not degrade system security

Custom VPN clients shall not require permissions that it does not need.

All mitigations are required for all products.

### 5.2.7 **[TR-NUTI]** No untrusted traffic in the VPN connection

### 5.2.7 TR-NUTI No untrusted traffic in the VPN connection

#### 5.2.7.1 Overview: TR-NUTI

#### 5.2.7.1 Requirement

Traffic from an unauthorized or unauthenticated source shall not be permitted to transit the VPN connection.

#### 5.2.7.2 **[MI-NUTI-1]** Policy-driven traffic exclusion

#### 5.2.7.2 MI-NUTI-1 Policy-driven traffic exclusion

The VPN client and server shall implement or integrate with a policy engine (e.g., a packet filter or firewall) to enforce granular packet filtering by application, port, and endpoint identity, and shall only permit traffic explicitly authorized to transit the VPN connection.

  * Verdict: The traffic does not enter the VPN connection, and does not exit it => PASS, otherwise FAIL

  * Evidence: Configuration file including the deny rule, packet capture of both incoming and outgoing interface, log message recording the denied traffic

#### 5.2.7.4 **[MI-NUTI-2]** Protocol validity checks

#### 5.2.7.3 MI-NUTI-2 Protocol validity checks

The VPN client and server shall implement data validity checks on all incoming packets to ensure they conform to the expected format and protocol of the restricted network.

| UC-1             | NUTI-1               |

| UC-2, UC-3, UC-4 | NUTI-1, NUTI-2       |

### 5.2.8 **[TR-AUTH]** Authentication of nodes

### 5.2.8 TR-AUTH Authentication of nodes

#### 5.2.8.1 Overview: TR-AUTH

#### 5.2.8.1 Requirement

All elements of the product that connect to nodes providing security-relevant services shall authenticate the node before using any services from the node.

#### 5.2.8.2 **[MI-AUTH-1]** Authentication via pre-shared secrets

#### 5.2.8.2 MI-AUTH-1 Authentication via pre-shared secrets

The VPN client shall require the use of pre-shared secrets, certificates, or fingerprints to authenticate the identity of any security-relevant node involved in the VPN connection.

FIXME requirements on RDPS

#### 5.2.8.3 **[MI-AUTH-2]** Transmitted credentials must be encrypted

#### 5.2.8.3 MI-AUTH-2 Transmitted credentials must be encrypted

The VPN client shall by default encrypt all transmitted user credentials or sensitive authentication material used for any supported authentication method or transport protocol.

  * Verdict: No plaintext string matching the user's credential is found => PASS, otherwise FAIL

  * Evidence: The authentication method and transport used, a packet capture, the plain text of the user's credential, and the output of a search for the credential in the packet capture

#### 5.2.8.4 **[MI-AUTH-3]** Authentication timeout

#### 5.2.8.4 MI-AUTH-3 Authentication timeout

The VPN client, server, or other node shall implement an authentication timeout that requires periodic re-authentication of the user for active sessions.

  * Verdict: No traffic is transmitted through the VPN connection => PASS, otherwise FAIL

  * Evidence: Log messages showing VPN connection establishment, authentication timeout or disconnection, packet capture with timestamps synchronized with log messages

#### 5.2.8.5 **[MI-AUTH-4]** Cloned credentials detection

#### 5.2.8.5 MI-AUTH-4 Cloned credentials detection

Some VPN node shall detect when multiple VPN clients are using credentials that should be unique to a VPN client and notify the users of both VPN clients or only allow one connection per credential.

  * Verdict: Notification of both VPN clients or only one connection is active at a time => PASS, otherwise FAIL

  * Evidence: Configuration of clients, log messages showing notifications and/or connection status

#### 5.2.8.6 **[MI-AUTH-5]** Forced revocation of authorization of endpoints

#### 5.2.8.6 MI-AUTH-5 Forced revocation of authorization of endpoints

The VPN service shall provide a method to force revocation, temporary or permanent, of authorization of an endpoint by an authorized user. The revocation of authorization of the VPN client shall end the VPN connection for that client by the time the revocation indicates it has completed.

| UC-1             | AUTH-1, AUTH-2                         |

| UC-2, UC-3, UC-4 | AUTH-1, AUTH-2, AUTH-3, AUTH-4, AUTH-5 |

### 5.2.9 **[TR-DNSL]** DNS leak prevention

### 5.2.9 TR-DNSL DNS leak prevention

#### 5.2.9.1 Overview: TR-DNSL

#### 5.2.9.1 Requirement

The VPN client shall implement methods to reduce the likelihood of DNS queries being routed to unauthorized DNS servers while the VPN connection is active.

Guidance: The network configuration of a system is frequently changed by multiple different pieces of software, many of which the VPN client has no control over or insight into.

#### 5.2.9.2 **[MI-DNSL-1]** Inform user of visibility of DNS queries

#### 5.2.9.2 MI-DNSL-1 Inform user of visibility of DNS queries

The VPN client shall prominently inform the user of the visibility of their DNS queries under the current configuration and their consequences in simple plain language, focusing on the potential risk and impact to the user of such visibility. The VPN client shall inform the user about the circumstances under which their DNS queries may become visible on a public network or to the operators of DNS servers including but not limited to, and where applicable:

  * Verdict: Information is displayed at VPN client startup, information is clear and complete, VPN connection is not usable until the user confirms

  * Evidence: Logs, screenshots, screen recordings, packet captures

#### 5.2.9.3 **[MI-DNSL-2]** Configurable exclusive DNS routing

#### 5.2.9.3 MI-DNSL-2 Configurable exclusive DNS routing

The VPN client shall offer a configuration option to route all DNS queries through the VPN connection to authorized DNS servers.

  * Verdict: All DNS traffic shall be routed exclusively through the VPN connection to authorized DNS servers => PASS, otherwise FAIL

  * Evidence: VPN client configuration, a list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries

#### 5.2.9.4 **[MI-DNSL-3]** Exclusive DNS routing by default

#### 5.2.9.4 MI-DNSL-3 Exclusive DNS routing by default

By default the VPN client shall route all DNS queries through the VPN connection to authorized DNS servers.

  * Verdict: All DNS traffic shall be routed exclusively through the VPN connection to authorized DNS servers => PASS, otherwise FAIL

  * Evidence: A list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries

#### 5.2.9.5 **[MI-DNSL-4]** DNS misconfiguration

#### 5.2.9.5 MI-DNSL-4 DNS misconfiguration

The VPN client shall inspect the system DNS configuration when attempting to connect and shall validate any DNS configuration it receives from the VPN server. If it detects a statically configured, non-authorized DNS server, the client shall either reject the configuration, refuse to connect, or provide a clear warning to the user.

  * Verdict: In all tests, the client refuses the connection or displays an explicit warning to the user detailing the risk of a DNS leak

  * Evidence: Client logs or screenshots demonstrating that the conflicting DNS configuration was detected and that the appropriate action was taken

#### 5.2.9.6 **[MI-DNSL-5]** Monitoring of DNS configuration

#### 5.2.9.6 MI-DNSL-5 Monitoring of DNS configuration

The VPN client shall monitor the DNS configuration of the system and take a user-configurable action when it detects that the DNS configuration has changed from the one the VPN client specified in a way that affects DNS query visibility to third parties. By default, the user-configurable option shall be to disable network traffic outside of the system. The VPN client shall detect DNS configuration changes within 30 seconds.

Guidance: A platform-independent method of monitoring would be for the VPN client to send DNS queries periodically and check the source of the answer.

#### 5.2.9.7 **[MI-DNSL-6]** Secure DNS protocols

#### 5.2.9.7 MI-DNSL-6 Secure DNS protocols

The VPN client shall block or notify users of potential DNS bypass via encrypted DNS protocols, including DNS over TLS (DoT) and DNS over HTTPS (DoH), if the traffic is routed via the VPN connection.

  * Verdict: For all tests, either DNS connections to well-known public DNS providers should be blocked, or the user should be notified that some software on their OS is using encrypted DNS protocols with servers that don't belong to the VPN provider

  * Evidence: A description of the method used to prevent DNS over TLS (DoT) and DNS over HTTPS (DoH) leaks, a list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries

#### 5.2.9.7 **[MI-DNSL-7]** No DNS leaks during network-level tunnel failure

#### 5.2.9.7 MI-DNSL-7 No DNS leaks during network-level tunnel failure

The VPN client shall ensure that DNS queries are not sent to non-authorized DNS servers when the connection to the VPN server is lost at the network level.

  * Verdict: No DNS queries are sent to DNS servers outside of the VPN connection.

  * Evidence: Method used to induce tunnel failure, packet capture, log messages.

#### 5.2.9.8 **[MI-DNSL-8]** Disclose DNS provider

#### 5.2.9.8 MI-DNSL-8 Disclose DNS provider

The VPN client shall clearly inform the user about the operator of the DNS servers being used by the VPN service (e.g., "DNS resolution provided by VPN Provider" or "DNS resolution provided by Google"). This information should be easily accessible in the client's interface.

### 5.2.10 **TR-EISO**: Endpoint isolation

#### 5.2.10.1 Overview: TR-EISO

#### 5.2.10.1 Requirement

The VPN provider shall by default not establish routes between different client endpoints.

### 5.2.11 **TR-TRAF**: No traffic through the node unless explicitly approved

#### 5.2.11.1 Overview: TR-TRAF

#### 5.2.11.1 Requirement

The VPN client shall not route traffic through the endpoint from sources/destinations other than the endpoint without the user's explicit informed consent, and such routing shall not be necessary for the use of any unrelated function.

### 5.2.12 **TR-DMIN**: Data minimization

#### 5.2.12.1 Overview: TR-DMIN

#### 5.2.12.1 Requirement

The product shall not collect data unnecessary for the functions of the product.

| UC-1, UC-2, UC-4     | NPII-1, NPII-2         |

| UC-3                 | NPII-1, NPII-2, NPII-3 |

### 5.2.13 **[TR-IPV6]** Secure IPv6 Handling

### 5.2.13 TR-IPV6 Secure IPv6 Handling

#### 5.2.13.1 Overview: TR-IPV6

#### 5.2.13.1 Requirement6

The VPN product shall handle IPv6 traffic in a secure manner that prevents data leaks.

#### 5.2.13.2 **[MI-IPV6-1]** Block IPv6 if Unsupported

#### 5.2.13.2 MI-IPV6-1 Block IPv6 if Unsupported

If the VPN provider does not support IPv6, the VPN client shall block all IPv6 traffic to prevent it from leaking outside the VPN tunnel.

  * Verdict: The connection to the IPv6-only service fails.

  * Evidence: Packet capture showing that no IPv6 traffic is leaving the device.

#### 5.2.13.3 **[MI-IPV6-2]** Full Support if Claimed

#### 5.2.13.3 MI-IPV6-2 Full Support if Claimed

If the VPN provider claims to support IPv6, it shall provide full, native IPv6 connectivity, and all security requirements in this standard shall apply to IPv6 traffic.

### 5.2.14 **TR-CRYPT**: Use strong, VPN specific cryptography

#### 5.2.14.1 Overview: TR-CRYPT

#### 5.2.14.1 Requirement

The VPN provider shall use strong cryptography

The VPN provider shall use strong cryptography.

#### 5.2.14.2 **MI-CRYPT-1**: Use a PSK

The product shall record security-relevant internal events, including but not limited to changes to configuration and access or modification of data and functions. The product shall provide an opt-out mechanism.

#### 5.2.15.1 MI-LOGG: Logging

#### 5.2.15.2 MI-LOGG: Logging

The product shall record log messages indicating security-relevant internal events in an internal log or transmit them to the host system logging system. The log messages shall not include any confidential information such as PII, secrets, or credentials, or any information which might reasonably be expected to include such items.

The product shall protect the availability of essential and core functions.

#### 5.2.19.4 MI-FDRP: Fast packet drop

#### 5.2.19.2 MI-FDRP: Fast packet drop

The product shall check network traffic from untrusted sources for validity and discard it efficiently, using reasonable efforts to minimize use of system resources on invalid packets.

  * Verdict: For each invalid packet, if the packet used resources that were not reasonably required to reject the packet, or the packet was not rejected => FAIL, otherwise PASS

  * Evidence: Invalid packets and their descriptions, logs of processing, annotations explaining why the order of operations is the most efficient reasonable way to process the packet.

#### 5.2.19.5 MI-LMEM: Limit memory usage

#### 5.2.19.3 MI-LMEM: Limit memory usage

The product shall limit and fairly allocate memory usage triggered by untrusted input to maintain availability of product functions and the functions of the underlying platform and other products sharing system resources.

  * Verdict: For each set of inputs, the product functions and the platform functions remain acceptably available => PASS, otherwise FAIL

  * Evidence: Set of inputs, logs of measurements, explanation of availability metrics

#### 5.2.19.6 MI-FAIR: Fair resource usage

#### 5.2.19.4 MI-FAIR: Fair resource usage

The product and supporting remote data processing services shall implement mechanisms to fairly allocate VPN system resources among multiple users.

  * Verdict: Each source of traffic makes steady progress without unreasonable stalls => PASS, otherwise FAIL

  * Evidence: Specification of traffic sources, measurements of bandwidth and latency, analysis of bandwidth and latency

#### 5.2.19.7 MI-DOST: Document risk transfer to operational environment for denial of service

#### 5.2.19.5 MI-DOST: Document risk transfer to operational environment for denial of service

The product shall be accompanied by documentation informing the user that denial of service protection must be provided by the environment, in a form appropriate for a typical user for the intended purpose and reasonably foreseeable use and misuse of the product.

> Copy-n-paste mitigation format

### 5.2.X **TR-XXXX**:

### 5.2.X TR-XXXX:

#### 5.2.X.1 Requirement

#### 5.2.X.1 Overview: TR-XXXX

_Description of high-level requirement in "shall" format_.

#### 5.2.X.x **MI-XXXX**:

#### 5.2.X.x MI-XXXX:

_Description of mitigation in "shall" format_

_Description of mitigation in "shall" format_.

  * Applicability: (optional, for requirements that depend on a feature)

  * Reference: TR-