Verified Commit f7f628b3 authored by Aki Braun's avatar Aki Braun
Browse files

Checked some math! 

This commit does not change any requirements' applicability, it merely corrects mistakes and oversights in the risk factor tables. The risk mapping to use case in B.5 is unchanged. Mostly, this means use cases stay on the line they were on. On rare occasion, a use case moves up or down a line in impact/likelihood level—in those cases, no requirement assignments are changed.
parent 0fee3bf5

EN-304-620.md

+42 −42
Original line number Diff line number Diff line
@@ -881,9 +881,9 @@ Attacker may use unknown exploitable vulnerabilities in the product implementati 
**Table B.4.3-2: Unknown exploitable vulnerabilities**



| Risk factors | Impact | Use cases         |

|--------------|--------|------------------------------|

| FUN is 2     | High   | UC-3                         |

| all others   | Medium | UC-2, UC-4, UC-5, UC-6, UC-7 |

|--------------|--------|-------------------|

| FUN is 2     | High   | UC-3, UC-5, UC-6  |

| all others   | Medium | UC-2, UC-4, UC-7  |

| FUN is 0     | Low    | UC-1              |



Mitigations for Likelihood:
@@ -915,7 +915,7 @@ Attacker may use known exploitable vulnerabilities in the product implementation 


| Risk factors  | Likelihood | Use cases                          |

|---------------|------------|------------------------------------|

| ADM is 1 or 2 | High       | UC-1, UC-3, UC-2, UC-4, UC-6, UC-7 |

| ADM is 1 or 2 | High       | UC-1, UC-2, UC-3, UC-4, UC-6, UC-7 |

| all others    | Medium     | UC-5                               |



**Table B.4.4-2: Known exploitable vulnerabilities**
@@ -1142,18 +1142,18 @@ Attacker may read sensitive data transmitted without encryption in a single endp 
**Table B.4.9-1: Transmitting sensitive data in the clear in a single endpoint VPN**



| Risk factors                         | Likelihood | Use cases                    |

|--------------------------------------|------------|------------------------|

|--------------------------------------|------------|------------------------------|

| UAP is 0 and NET is 2 and DTX is 2   | High       | UC-3                         |

| all others                           | Medium     | UC-2                         |

| UAP is not 0 or NET is 0 or DTX is 0 | Low        | UC-1, UC-4, UC-5, UC-7 |

| UAP is not 0 or NET is 0 or DTX is 0 | Low        | UC-1, UC-4, UC-5, UC-6, UC-7 |



**Table B.4.9-2: Transmitting sensitive data in the clear in a single endpoint VPN**



| Risk factors                            | Impact | Use cases                    |

|-----------------------------------------|--------|------------------------|

|-----------------------------------------|--------|------------------------------|

| UAP is 0 and (FUN is 2 or PRI is 2)     | High   | UC-3                         |

| all others                              | Medium | UC-2, UC-7             |

| UAP is not 0 or (FUN is 0 and PRI is 0) | Low    | UC-1, UC-4, UC-5, UC-6 |

| all others                              | Medium | UC-2                         |

| UAP is not 0 or (FUN is 0 and PRI is 0) | Low    | UC-1, UC-4, UC-5, UC-6, UC-7 |



Mitigations for Likelihood:
@@ -1243,16 +1243,16 @@ Attacker may compromise endpoint without the user learning of it. 
**Table B.4.11-1: Unknown compromise of endpoint**



| Risk factors | Likelihood | Use cases                    |

|--------------|------------|------------------------|

| ADM is 2     | High       | UC-1, UC-2, UC-3       |

| all others   | Medium     | UC-4, UC-5, UC-6, UC-7 |

|--------------|------------|------------------------------|

| ADM is 2     | High       | UC-1, UC-3                   |

| all others   | Medium     | UC-2, UC-4, UC-5, UC-6, UC-7 |



**Table B.4.11-2: Unknown compromise of endpoint**



| Risk factors                                                  | Impact | Use cases              |

|----------------------------------------------|--------|------------------|

| DTX is 2 or DST is 2 or FUN is 2 or PRI is 2 | High   | UC-3, UC-4, UC-5 |

| all others                                   | Medium | UC-1, UC-2, UC-7 |

|---------------------------------------------------------------|--------|------------------------|

| RDP is 2 and (DTX is 2 or DST is 2 or FUN is > 0 or PRI is 2) | High   | UC-3, UC-4, UC-5       |

| all others                                                    | Medium | UC-1, UC-2, UC-6, UC-7 |



Mitigations for Likelihood:
@@ -1283,15 +1283,15 @@ Attacker may use configuration errors to get unauthorized access to product asse 


| Risk factors                                     | Likelihood | Use cases              |

|--------------------------------------------------|------------|------------------------|

| UAP is 0 and NET is 2 and (CFG is 2 or ADM is 2) | High       | UC-2, UC-3             |

| all others                                       | Medium     | UC-1                   |

| UAP is 0 and NET is 2 and (CFG is 2 or ADM is 2) | High       | UC-1, UC-3             |

| all others                                       | Medium     | UC-2                   |

| UAP is not 0 or NET is 0 or CFG is 0 or ADM is 0 | Low        | UC-4, UC-5, UC-6, UC-7 |



**Table B.4.12-2: Access to assets via configuration errors in single endpoint VPN**



| Risk factors                                                      | Impact | Use cases                    |

|-------------------------------------------------------------------|--------|------------------------------|

| UAP is 0 and DTX is 2 or DST is 2 or FUN is 2 or PRI is 2         | High   | UC-3                         |

| UAP is 0 and (DTX is 2 or DST is 2 or FUN is 2 or PRI is 2)       | High   | UC-3                         |

| all others                                                        | Medium | UC-2                         |

| UAP is not 0 or (DTX is 0 and DST is 0 and FUN is 0 and PRI is 0) | Low    | UC-1, UC-4, UC-5, UC-6, UC-7 |
@@ -1333,10 +1333,10 @@ Attacker may use configuration errors to get unauthorized access to product asse 
**Table B.4.13-1: Access to assets via configuration errors in a multi-endpoint VPN**



| Risk factors                                         | Likelihood | Use cases         |

|------------------------------------------------------|------------|------------------|

| UAP is not 0 and NET is 2 and (CFG is 2 or ADM is 2) | High       | UC-4, UC-7       |

| all others                                           | Medium     | UC-3, UC-5, UC-6 |

| UAP is 0 or NET is 0 or (CFG is 0 and ADM is 0)      | Low        | UC-1, UC-2       |

|------------------------------------------------------|------------|-------------------|

| UAP is not 0 and NET is 2 and (CFG is 2 or ADM is 2) | High       | UC-4, UC-5, UC-7  |

| all others                                           | Medium     | UC-6              |

| UAP is 0 or NET is 0 or (CFG is 0 and ADM is 0)      | Low        | UC-1, UC-2, UC-3, |



**Table B.4.13-2: Access to assets via configuration errors in a multi-endpoint VPN**
@@ -1420,16 +1420,16 @@ Attacker may compromise privacy of user via the product's remote data processing 
**Table B.4.15-1: Compromise of privacy via RDPS**



| Risk factors                           | Likelihood | Use cases              |

|-----------------------|------------|------------------------|

| RDP is 2 and UAP is 0 | High       | UC-3                   |

|----------------------------------------|------------|------------------------|

| RDP is 2 and UAP is 0 and PRI is not 0 | High       | UC-3                   |

| all others                             | Medium     | UC-1, UC-2, UC-4, UC-7 |

| RDP is 0 or UAP is 2                   | Low        | UC-5, UC-6             |



**Table B.4.15-2: Compromise of privacy via RDPS**



| Risk factors                  | Impact | Use cases              |

|---------------------------|--------|------------------------|

| RDP is 2 and PRI is not 0 | High   | UC-2, UC-3, UC-7       |

|-------------------------------|--------|------------------------|

| RDP is not 0 and PRI is not 0 | High   | UC-2, UC-3, UC-7       |

| all others                    | Medium | UC-1, UC-4, UC-5, UC-6 |



Mitigations for Likelihood: