Loading EN-304-620-1.md +22 −12 Original line number Diff line number Diff line Loading @@ -624,6 +624,16 @@ Rationale: The more difficult it is to configure the network connection, maintai * **[DNC-1]** Product is using a well-defined, predictable platform service to configure the network connection * **[DNC-2]** Other software can change network configuration without notification or permission from the product ### C.2.7 RF-COM: Complexity of feature set Description: How complex the features necessary for the product's foreseeable use are. Rationale: More features mean more code and more interfaces mean attack surface. * **[COM-0]** Foreseeable use requires only basic features to tunnel encrypted traffic * **[COM-1]** Foreseeable use requires a few additional features related to tunneling encrypted traffic * **[COM-2]** Foreseeable use requires many additional features ## C.3 Assumptions **[AS-PP]:** The platform the product is running on is trustworthy. Loading Loading @@ -925,23 +935,23 @@ Mitigations for Impact: ### C.5. Mapping of use cases to risk factors and security profiles | Use case | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | SP | |----------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|------| | UC-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | SP-1 | | UC-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | SP-2 | | UC-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | SP-3 | | UC-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | SP-4 | | Use case | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | COM | SP | |----------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|-----|------| | UC-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | 0 | SP-1 | | UC-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | 1 | SP-2 | | UC-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | 1 | SP-3 | | UC-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | 2 | SP-4 | _Table C.TODO — Use cases mapped to risk factors and security profiles_ ### C.6. Mapping of security profiles to risk factors | Security profile | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | |------------------|-----------------------------|-----|-----|-----|-----|-----|-----|-----| | SP-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | | SP-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 2 | 2 | | SP-3 | Journalist or activist | 1 | 1 | 2 | 2 | 1 | 2 | 2 | | SP-4 | Small organization | 2 | 1 | 1 | 1 | 0 | 1 | 2 | | Security profile | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | COM | |------------------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|-----| | SP-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | 0 | | SP-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | 1 | | SP-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | 1 | | SP-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | 2 | _Table C.TODO — Security profiles mapped to risk factors_ Loading Loading
EN-304-620-1.md +22 −12 Original line number Diff line number Diff line Loading @@ -624,6 +624,16 @@ Rationale: The more difficult it is to configure the network connection, maintai * **[DNC-1]** Product is using a well-defined, predictable platform service to configure the network connection * **[DNC-2]** Other software can change network configuration without notification or permission from the product ### C.2.7 RF-COM: Complexity of feature set Description: How complex the features necessary for the product's foreseeable use are. Rationale: More features mean more code and more interfaces mean attack surface. * **[COM-0]** Foreseeable use requires only basic features to tunnel encrypted traffic * **[COM-1]** Foreseeable use requires a few additional features related to tunneling encrypted traffic * **[COM-2]** Foreseeable use requires many additional features ## C.3 Assumptions **[AS-PP]:** The platform the product is running on is trustworthy. Loading Loading @@ -925,23 +935,23 @@ Mitigations for Impact: ### C.5. Mapping of use cases to risk factors and security profiles | Use case | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | SP | |----------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|------| | UC-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | SP-1 | | UC-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | SP-2 | | UC-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | SP-3 | | UC-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | SP-4 | | Use case | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | COM | SP | |----------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|-----|------| | UC-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | 0 | SP-1 | | UC-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | 1 | SP-2 | | UC-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | 1 | SP-3 | | UC-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | 2 | SP-4 | _Table C.TODO — Use cases mapped to risk factors and security profiles_ ### C.6. Mapping of security profiles to risk factors | Security profile | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | |------------------|-----------------------------|-----|-----|-----|-----|-----|-----|-----| | SP-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | | SP-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 2 | 2 | | SP-3 | Journalist or activist | 1 | 1 | 2 | 2 | 1 | 2 | 2 | | SP-4 | Small organization | 2 | 1 | 1 | 1 | 0 | 1 | 2 | | Security profile | Description | CFG | AUT | DAT | FUN | ADM | RDP | DNC | COM | |------------------|-----------------------------|-----|-----|-----|-----|-----|-----|-----|-----| | SP-1 | Individual consumer | 1 | 0 | 0 | 0 | 2 | 2 | 2 | 0 | | SP-2 | Privacy conscious household | 1 | 0 | 1 | 1 | 1 | 0 | 2 | 1 | | SP-3 | Journalist or activist | 1 | 1 | 2 | 2 | 2 | 2 | 2 | 1 | | SP-4 | Small organization | 2 | 1 | 2 | 1 | 0 | 1 | 2 | 2 | _Table C.TODO — Security profiles mapped to risk factors_ Loading
