@@ -371,102 +371,33 @@ In VPNs using a hub-and-spoke topology, management server is often implemented a
## 4.4 Use cases
> Create a list of representative use cases, each one representing a different threat profile. If the threat profile is the same for two use cases, then it is basically the same use case for the purposes of the present document. Use cases should include both intended and reasonably foreseeable use/misuse. Use cases don't include industrial operations, automotive, transport, marine, airplane, medical, military, national security, etc.
> When you have many use cases, group them into 3 - 5 levels of risk. These will probably be your security levels.
### 4.4.1 Overview
This list of use cases is an informative resource to the manufacturer to simplify choosing a set of security requirements. Each use case is mapped to a security level, which is a collection of risks and the security requirements necessary to mitigate them.
XXX VPN client software
XXX VPN server software
——
/ | XXXX enterprise hardware
risk / | XXXX enterprise-controlled cloud
transfer \ | XXXX manufacturer hardware
\ | XXXX manufacturer cloud
——
XXX VPN management
### 4.X.X VPN clients
All VPN clients carry with them the inherent risk of being the entry point to a private network.
***UC-UR-1** Small business staff accessing office resources from off-site
* connections likely brief, task-driven
* endpoint hardware is unmanaged
***UC-US-2** Students accessing university resources off-campus
Control plane in mesh VPNs: typically managed by vendor/manufacturer?
***UC-ME-1** TK TODO
### 4.X.X Managing distributed workforces
#### 4.X.X.1 VPN server and gateway installed on enterprise-managed infra
***UC-OP-1** VPN management deployed on-premises
* Installed and set up by enterprise network admins or IT
* Network access and permissions managed by enterprise IT
* Installed on equipment physically accessible by network administration
* HQ, multi-tenant data centre, or single-tenant data centre
* Positioned on the private network side of firewall
***UC-OP-2** VPN deployed fully or in-part to "cloud" infrastructure
* Installed and set up by enterprise network admins or IT
* Network access and permissions managed by enterprise IT
* Access controls managed without physical access to network
#### 4.X.X.2 VPN server and gateway as a service (manufacturer infra)
***UC-CL-1** VPN-as-a-service
* TK TODO
### 4.X.X Connecting data centres
***UC-DC-2** Always-on data centre VPN
* Used to securely connect on-premises equipment with cloud data centres
* Managed by IT or software operations
* Provides backup and disaster recovery, cloud bursting, and centralised identity management
* Common in hybrid cloud setups
* Used for ongoing activities, such as real-time data synchronisation, identity federation, or persistent application connectivity.
***UC-DC-1** On-demand data centre VPN
* Used to securely connect on-premises equipment with cloud data centres
* Managed by IT or software operations
* Provides backup and disaster recovery, cloud bursting, and centralised identity management
* Activated for discrete tasks, for example, during backup operations, scheduled data transfers, or specific maintenance windows.
### 4.X.X IoT VPNs
***UC-IT-1** IoT-Specific VPNs
* TK TODO
### 4.X.X Networks with higher security needs
***UC-HR-1** Hospitals, healthcare
* TK TODO
***UC-HR-2** Financial institutions
* TK TODO
***UC-0** ~~Microenterprise, hobbyist~~
* (this type of user is likely using VPN software that is preinstalled on a router or modem, not offered as a product with digital elements on the open market. out of scope.)
***UC-1** Small enterprise, small not-for-profit organisation
* limited or no full-time IT/network administration
* seeking secure connections primarily to SaaS products
* requires managed service for configuration and maintenance
***UC-2** Medium enterprise, medium to large not-for-profit organisation
* small IT/network administration staff
* seeking secure access to SaaS products or networked resources (printer, NAS)
* hybrid setup of on-premises and cloud
***UC-3** Large enterprise, university, non-classified government entities
* distinct network and IT teams
* experienced IT professionals managing configuration
* connecting distributed workforce and multiple locations with distinct private networks
* values control over configuration and management
***UC-4** Hospitals, financial institutions, certain newspapers and broadcasters
