Security analysis update

This clause provides assessment for the requirements in [clause 5.5](#security-updates) relating to CRA [\[i.1\]](#_ref_i.1) Annex I Part 1 (2) (c).

### 6.5.2 REQ-SU-02 (MI-KEVD) Documentation for secure update before or during first use

#### 6.5.2.1 Objective

Prevent exploitation of known exploitable vulnerabilities at first use.

#### 6.5.2.2 Preparation

Examine public or private vulnerability information sources and select a fixed vulnerability for testing. Filter candidates to ensure each vulnerability specifically affects the platform, architecture, or software components used by the product. Then, prioritize those candidates based on the existence of publicly available exploit code (e.g., Proof of Concept), evidence of active exploitation in the wild, the severity of the vulnerability, and the potential impact its exploitation would have on the product.

#### 6.5.2.3 Activities

On a new product:

* Carry out the initial secure update

* Scan the product to see if a recently fixed vulnerability has been fixed on the product

* Examine the documentation for the required info

#### 6.5.2.4 Verdict

PASS If **all** of the following are fulfilled:

* The secure update completes successfully, and

* the most recently fixed vulnerability is fixed, and

* the documentation includes all the required information.

Otherwise FAIL

#### 6.5.2.5 Evidence

* Documentation of vulnerability handling

* Documentation of how to securely update the product

* The report for the selected vulnerability

* Description of how to scan for the vulnerability

* Log of vulnerability scan results

### 6.5.3 REQ-SU-03 (MI-KEVA) Automatic secure update before or during first use

#### 6.5.3.1 Objective

* Description of how to scan for the vulnerability

* Log of vulnerability scan results

### 6.5.4 REQ-SU-04 (MI-KEVE) Automatic secure update via administrator action before or during first use

### 6.5.4 REQ-SU-04 (MI-KEVE) Automatic secure update via operational environment before or during first use

#### 6.5.4.1 Objective

New update version numbers, and log of querying the product parts' versions, installing the update, and querying the versions again

### 6.5.7 REQ-SU-07 (MI-SUDC) Documentation of secure update

#### 6.5.7.1 Objective

Prevent exploitation of known vulnerabilities.

#### 6.5.7.2 Preparation

None.

#### 6.5.7.3 Activities

Assess the documentation for completeness.

#### 6.5.7.4 Verdict

PASS if **all** of the following are fulfilled:

* Documentation describes secure update methods sufficiently for a third party to implement.

Otherwise FAIL

#### 6.5.7.5 Evidence

* Documentation and analysis of completeness

### 6.5.8 REQ-SU-08 (MI-SUOE) Secure update provided by operational environment

#### 6.5.8.1 Objective

* Logs or screenshots demonstrating the failure to read the data without authorization

* Documentation validating the encryption/hashing algorithms used

### 6.7.16 REQ-CON-16 Inform user of limits of privacy protection

#### 6.7.16.1 Objective

Privacy protection

#### 6.7.16.2 Preparation

Perform first install of product.

#### 6.7.16.3 Activities

Launch product.

#### 6.7.16.4 Verdict

PASS if **all** of the following are fulfilled:

* Initial onboarding provides information regarding boundaries of privacy protection.

Otherwise FAIL

#### 6.7.16.5 Evidence

* Screenshots

## 6.8 Integrity protection

### 6.8.1 Overview

* Packet capture

* Any log messages showing packet was dropped

### 6.8.6 REQ-INT-06 Application protocol validity checks by operational environment

#### 6.8.6.1 Objective

Prevent unauthorized and/or malicious traffic in the VPN connection.

#### 6.8.6.2 Preparation

None

#### 6.8.6.3 Activities

Assess the technical documentation provided with the product.

#### 6.8.6.4 Verdict

PASS if the technical documentation describes how the protocol checks can be provided by the operational environment.

Otherwise FAIL

#### 6.8.6.5 Evidence

* Documentation

* Analysis of documentation

* Documentation of intended purpose

## 6.9 Data minimisation

### 6.9.1 Overview

* Logs of measurements

* Explanation of availability metrics

### 6.10.4 REQ-AP-04 (MI-DOST-1) Document risk transfer to operational environment for denial of service

### 6.10.4 REQ-AP-04 (MI-DOST-1) Availability protection provided by operational environment

#### 6.10.4.1 Objective

#### 6.10.4.3 Activities

Examine documentation.

Assess the technical documentation provided with the product.

#### 6.10.4.4 Verdict

PASS if **all** of the following are fulfilled:

* Documentation exists, and

* is appropriate to the typical user.

PASS if the technical documentation describes how the availability protection can be provided by the operational environment.

Otherwise FAIL

* Network package capture

* Log messages

### 6.10.6 REQ-AP-06 (MI-DOST-3) Automatic traffic handling during denial-of-service attack

#### 6.10.6.1 Objective

Maintain service availability during denial-of-service attacks.

#### 6.10.6.2 Preparation

None

#### 6.10.6.3 Activities

1. Capture traffic on all interfaces,

2. start the VPN connection,

3. shutdown or disable traffic to the currently connected VPN server, and

4. observe automatic reconnection or traffic rerouting to the next available VPN server.

#### 6.10.6.4 Verdict

PASS if **all** of the following are fulfilled:

* Connection is automatically restored.

Otherwise FAIL

#### 6.10.6.5 Evidence

* Network package capture

* Log messages

## 6.11 Non-interference

### 6.11.1 Overview