Verified Commit cdb91f91 authored by Aki Braun's avatar Aki Braun
Browse files

Editorial: Whitespace, typo

parent c820e4f1

EN-304-620.md

+7 −7
Original line number Diff line number Diff line
@@ -64,7 +64,7 @@ The present document provides the technical cybersecurity requirements for the p 


[Clause 5](#technical-requirements-for-products) specifies technical cybersecurity requirements for the product to mitigate the identified risks, including their applicability conditions.



[Clause 6](#assessment-criteria-for-compliance-with-technical-requirements) specifies the assessment criteria and compliance verification procedures with the requirements of clause 5.

[Clause 6](#assessment-criteria-for-compliance-with-technical-requirements) specifies the assessment criteria and compliance verification procedures with the requirements of [clause 5](#technical-requirements-for-products).



[Annex A](#annex-a-informative-relationship-between-the-present-document-and-the-requirements-of-eu-regulation-eu-20242847---the-cyber-resilience-act) maps the technical requirements of the present document with the essential requirements of the CRA [\[i.1\]](#_ref_i.1) regulation.
@@ -170,7 +170,7 @@ The following referenced documents may be useful in implementing an ETSI deliver 


<span id="_ref_i.13">[i.13]</span> ETSI TS 104 103: “Cyber Security (CYBER); Encrypted Traffic Integration (ETI); Problem Statement review and requirements definition”. <https://www.etsi.org/deliver/etsi_ts/104100_104199/104103/01.01.01_60/ts_104103v010101p.pdf>



<span id="_ref_i.14">[i.14]</span>  prEN 50770 series: “Security for operational technologies” (produced by CENELEC).

<span id="_ref_i.14">[i.14]</span> prEN 50770 series: “Security for operational technologies” (produced by CENELEC).



# 3 Definition of terms, symbols and abbreviations
@@ -1242,7 +1242,7 @@ Attacker may compromise endpoint without the user learning of it. 
**Table B.4.11-2: Unknown compromise of endpoint**



| Risk factors                                 | Impact | Use cases        |

|-------------------------------------------------|--------|------------------|

|----------------------------------------------|--------|------------------|

| DTX is 2 or DST is 2 or FUN is 2 or PRI is 2 | High   | UC-3, UC-4, UC-5 |

| all others                                   | Medium | UC-1, UC-2, UC-7 |

clauses/5.Requirements.md

+5 −5
Original line number Diff line number Diff line
@@ -79,7 +79,7 @@ Where the product relies on a remote data processing solution (RDPS) for the pro 


##### 5.2.7.2 Applicability



This requirement applies to all products which provide any manner of RDPS, including 

This requirement applies to all products which provide any manner of RDPS, including:



* UC-1: required

* UC-2: required
@@ -755,7 +755,7 @@ The product shall ensure that when the connection to the VPN server is lost at t 


#### 5.7.5.1 Requirement



The VPN traffic shall be encrypted using session keys generated and held only by the communicating endpoints; intermediary nodes shall not possess keys capable of decrypting such #transitory traffic.

The VPN traffic shall be encrypted using session keys generated and held only by the communicating endpoints; intermediary nodes shall not possess keys capable of decrypting such transitory traffic.



> NOTE: In consumer or enterprise VPN scenarios which offer multiple VPN servers, remote data processing usually generates the VPN credentials and populates this to the respective VPN client. This allows the remote data processing service to eavesdrop on the VPN connection since it administers the VPN credentials. In a mesh scenario, the credentials have to be generated and maintained by the endpoint itself to ensure no intermediate party can eavesdrop on the connection.
@@ -1556,8 +1556,8 @@ VPNs are expected to provide the ability to securely delete data and settings, a 


#### 5.15.2.1 Requirement



* **REQ-DRT-02 (MI-RSET)-1** The product shall provide a secure deletion or “factory reset” functionality, and

* **REQ-DRT-02 (MI-RSET)-2** the product shall remove all data and settings and reset to its secure-by-default state after the secure deletion or “factory reset” functionality is used.

1. **REQ-DRT-02 (MI-RSET)-1** The product shall provide a secure deletion or “factory reset” functionality, and

2. **REQ-DRT-02 (MI-RSET)-2** the product shall remove all data and settings and reset to its secure-by-default state after the secure deletion or “factory reset” functionality is used.



#### 5.15.2.2 Applicability

clauses/6.Assessment-Criteria.md

+14 −14
Original line number Diff line number Diff line
@@ -1566,7 +1566,7 @@ Retrieve internal policy from VPN manufacturer. 
PASS if **all** of the following are fulfilled:



* All labelled Personal Data collected is either:

   * strictly necessary for the confidentiality or availability of the product as outlined in the internal policy and intended use of the VPN manufacturer or

  * strictly necessary for the confidentiality or availability of the product as outlined in the internal policy and intended use of the VPN manufacturer, or

  * Personal Data collected is explicitly necessary for authentication, access control, or subscription management.

* No personal data is collected from the user’s VPN tunnelling and routing functionality which is not indented for the VPN manufacturer.

clauses/K.Cryptography.md

+10 −10

File changed.

Contains only whitespace changes.